SuperRecord

Privacy Policy

Last updated: October 2026

1. Data controller

AthletePro (the “Service”) is operated by Borja Alfaraz. For any question regarding the processing of your data, contact info@athletepro.es.

2. Data we collect

  • Account data: name, email and password (the latter stored hashed with bcrypt).
  • Physical and sports data (only if you provide it): height, weight, CdA, critical power (CP), W′, MMP. Required to personalise the pacing model.
  • Activity data (only if you upload it): FIT files from your rides, which may include power, heart rate, cadence, speed and GPS position. Used to analyse your actual performance.
  • Plans and routes: GPX files you upload, segments, weather conditions, notes.
  • Technical data: IP address, browser, OS (in server logs, kept 30 days for security incident detection).

Garmin Edge data field (SuperRecord Pacer)

If you use the SuperRecord Pacer data field on a Garmin bike computer, the field talks to our server through the Garmin Connect app on your phone to receive the plan your coach has sent you. To do so we store:

  • A device identifier, hashed with a one-way function (SHA-256): we do not store the Garmin's original identifier.
  • The device model (e.g. Edge 540), the time of its last connection and the last plan it downloaded.
  • The link between the device and your athlete profile, and the temporary pairing code (it expires after 72 hours and works once).
  • Which plan you chose to load from your “My plans” page and when the device received it.

The field does not send our server your position, power, heart rate or any other activity data. The power target for each second is written into the activity's own FIT file, on your device; that file only reaches SuperRecord if you or your coach upload it. Communication between the Garmin, your phone and Garmin Connect is also governed by Garmin's privacy policy.

We use this data only to deliver the right plan to your device and to let your coach see whether it arrived. Unpairing the device removes its link, and an unlinked device that does not connect for 7 days is deleted entirely.

3. Purpose and legal basis

  • Provide the service (contract execution, GDPR art. 6.1.b): generate your pacing plan, render charts, allow export.
  • Account security (legitimate interest, GDPR art. 6.1.f): logs, rate-limiting, anti-brute-force.
  • Legal obligations (GDPR art. 6.1.c): invoicing where applicable.
  • Heart-rate and health data (GDPR art. 9.2.a, explicit consent): if you upload heart rate or other data that may reveal health information, we process it solely to generate your analysis, with your consent, and never share it with third parties for other purposes. You can withdraw consent and delete it at any time.

Your athletes' data. When a coach adds athletes and uploads their data, the coach is the controller of that data and the Service acts as processor on their behalf. The coach must have a legal basis (e.g. the athlete's consent) to process it. A data processing agreement (DPA) is available on request at info@athletepro.es.

4. Retention

We keep your data while your account is active. If you request deletion, the data is removed within a maximum of 30 days, except for what we must retain by legal obligation.

5. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction and portability at any time by writing to info@athletepro.es. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority within the EU.

6. Cookies and local storage

We only use strictly necessary cookies for the service to work:

  • ap_token (HttpOnly cookie, session or 30 days with “Remember me”): keeps you signed in.
  • ap_theme, ap_lang (localStorage): remember your theme (light/dark) and language.

We do not use analytics or advertising cookies. To know how many people visit the site we use Cloudflare Web Analytics, which works without cookies, without device fingerprinting and without identifying anyone: it counts page views and where they come from, nothing else. That is why no prior consent is required (Spanish LSSI art. 22.2).

7. Data processors and transfers

To run the service we rely on a small number of carefully selected data processors, all offering adequate GDPR safeguards. By category:

  • Hosting and infrastructure (database, backend, CDN), preferably in the European Union.
  • Payment and subscription processing: card data is handled directly by a PCI-DSS certified payment provider; we never see or store it.
  • Sending of transactional emails (account verification, notices).
  • Optional integrations that only activate if you connect them (e.g. importing your own routes).
  • Weather and mapping sources, which receive no personally identifiable data.

For security reasons we do not publish the specific identity of each provider. We will provide the full, up-to-date list of sub-processors on request at info@athletepro.es.

International transfers. Some providers may process data outside the European Economic Area. In those cases the transfer relies on the European Commission's Standard Contractual Clauses or other adequate safeguards under GDPR art. 46.

8. Changes

Any substantial change will be announced on this page with an updated date. If the changes affect your rights, we will notify you by email.