Privacy Policy

1. Data Controller

The controller of the processing described in this Policy is TIMETIME SOFTWARE, S.L., a company incorporated under the laws of Spain and the owner of TrainerStudio (“TrainerStudio”). Contact address for data protection matters: info@trainerstudio.io.

2. Role as Data Controller and Data Processor

• TrainerStudio as controller: with respect to the data of the Trainers who use the Service (account, billing, support and product usage) and of visitors to its website.
• TrainerStudio as processor: with respect to the data of the Clients that each Trainer manages in the Service (workouts, measurements, photos, messages, nutrition, etc.). In this case, the Trainer is the data controller and TrainerStudio processes the data solely in accordance with the Trainer's instructions, under the data processing agreement included in the Terms of Service.

Clients who wish to exercise their rights with respect to the data managed by their Trainer shall contact the Trainer. Any requests received directly by TrainerStudio shall be forwarded to the Trainer, whom TrainerStudio shall assist in responding to them.

3. Categories of Data Processed

Trainer Data

• Account data: name, email address, phone number, password (stored encrypted), photo, language and country.
• Professional data: business name, logo, services offered, public profile and trainer website.
• Billing data: tax details, billing address and payment history. Card data is processed by Stripe or, for in-app purchases, by Apple or Google; TrainerStudio does not store it.
• Support data: communications with the TrainerStudio team.

Client Data

• Identification data: name, email address, phone number, photo, date of birth and sex.
• Training and health data: logged workouts, weight, body measurements, progress photos, form responses, habits, nutrition, goals and information about injuries or health that the Client shares with its Trainer.
• Apple Health and Google: solely with the Client's express authorization on its device, data such as steps or physical activity, which is shown to the Trainer in the app. The authorization may be revoked at any time from the device settings.
• Communications: messages with the Trainer, signed documents and notifications.

Automatically Collected Data

• Device and connection: device type, operating system, browser, IP address and approximate location derived from it (never GPS geolocation).
• Usage: screens visited, features used, errors and app performance.
• Website and advertising: cookies and identifiers used to measure visits and campaigns, in accordance with the user's cookie preferences.

Data from Third Parties

• Google or Apple, when the user signs in through those services (name, email address and photo).
• Stripe, Apple and Google, regarding the status of payments and subscriptions.
• Advertising platforms, which provide aggregated or pseudonymized data about the campaign of origin.

4. Purposes and Legal Bases

Client data is processed on behalf of the Trainer, who, as data controller, is responsible for determining and obtaining the legal basis for the processing, including the legal basis applicable to health data.

5. Artificial Intelligence Features

When the Trainer uses an artificial intelligence feature, TrainerStudio discloses to the model provider only the information necessary to generate the requested response. TrainerStudio does not use Client data to train its own models. Artificial intelligence does not make decisions that produce legal effects concerning data subjects; the final decision always rests with the Trainer.

If you connect your TrainerStudio coach account to an external assistant such as ChatGPT (OpenAI) or Claude (Anthropic), that provider receives the data returned by the coaching tools you use. Depending on your request, this may include client profiles and contact details, workouts, body measurements, activity, coaching notes, and messages in conversations you participate in. The connection can also create, update, or delete coaching records and send invitations, messages, or workout reminders. It does not provide administrator or billing access. Only connect data you are authorized to share and review the selected provider's privacy policy and account settings. You can disconnect TrainerStudio in that assistant's settings; disconnecting does not delete information already shared with the provider. Contact info@trainerstudio.io for help with access or data protection requests.

6. Recipients and Sub-processors

TrainerStudio does not sell personal data. Data is disclosed only to the providers involved in providing the Service, acting as processors or sub-processors, with whom TrainerStudio has entered into the relevant agreements containing confidentiality and security obligations:

Data may also be disclosed where required by law or by a competent authority, to defend the rights of TrainerStudio or of third parties, or in connection with a merger, acquisition or transfer of the business, in which case the acquirer shall be bound by this Policy.

7. International Transfers

Some providers are located in the United States or in other countries outside the European Economic Area. Such transfers are based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the standard contractual clauses approved by the Commission. Further information may be requested at info@trainerstudio.io.

8. Retention Periods

Upon expiration of these periods, the data shall be deleted or anonymized. Backups are deleted in accordance with their ordinary rotation cycles. Data may be retained, duly restricted, for the limitation periods applicable to any actions that may arise from the processing.

9. Cookies

The website uses technical cookies, which are necessary for its operation, and, subject to the user's prior consent, analytics and advertising cookies used to measure visits and campaigns. The user may change their preferences or delete cookies at any time through their browser settings. The apps use local storage to maintain the user's session and preferences.

10. Data Subject Rights

Data subjects may at any time exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, and may withdraw any consent given, by sending a request to info@trainerstudio.io from the email address associated with their account. TrainerStudio shall respond within one month, which may be extended by two further months for complex requests, and may request proof of the requester's identity.

Data subjects also have the right to lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, www.aepd.es) or with the supervisory authority of their country of residence.

11. Minors

Trainer accounts are reserved for individuals aged 18 or over. A Trainer who provides services to Clients under the age of 14, or such other age as may be established by applicable law, shall first obtain the consent of the holders of parental authority or legal guardianship. TrainerStudio may delete any data of minors processed without such consent.

12. Security

TrainerStudio implements appropriate technical and organizational measures to protect the data, including encryption of communications and storage, encrypted storage of passwords, access control based on the principle of least privilege, and backups. No system is completely invulnerable; users are therefore advised to use strong passwords and not to share them. Personal data breaches shall be managed and notified in accordance with the GDPR.

13. Changes to the Policy

TrainerStudio may amend this Policy to reflect changes in the Service, in its providers or in the law. The date of the last update appears at the beginning of this document. Material changes shall be communicated by email or through the Service.

14. Language

This Policy is published in several languages. In the event of any discrepancy, the English version shall prevail.

15. Contact

Any inquiries regarding this Policy or the exercise of data protection rights may be sent to info@trainerstudio.io.