Dashboard privacy

If you subscribe directly, the controller of your data is Cristiano Cunha - Zero Ventuno, Via Lurisia, 3, 12100 Cuneo (CN), Italy, cristiano@zeroventuno.com.

If you joined through a coaching team, the team decides how your data is used in your coaching and is responsible for that, and Zero Ventuno processes the data on its behalf. You can talk to the team or write to the same email, and we'll pass your request on.

• Account. Email, name, nickname and phone when provided, language, plan and preferences. Your access key is stored only as a hash, a code that can't be reversed. With coaching teams, also the monthly amount the team records for you.
• Training. Races, cycles, planned and completed workouts, duration, distance, pace, power, zones, load, perceived effort, strength and performance milestones, including what comes from .fit files and connected watches.
• Health. Heart rate, HRV, sleep, readiness, hydration, pain and injuries, weight and body composition, meal plan and nutrition targets, plus the notes you or your AI write about them. The GDPR treats this data as a special category.
• Menstrual cycle. Only if you ask to track it: date of the last cycle, length and notes.
• Connections. Which service you connected, when, and the credentials it returns so the dashboard can reach it.

• Health data: building and showing your dashboard, based on your explicit consent (Art. 9(2)(a) GDPR), asked for before you use the account.
• Account and training: creating the account, showing the dashboard, importing workouts, sending them to your watch and sending service emails, such as signup and key recovery. The legal basis is our contract with you (Art. 6(1)(b)).
• Security and technical logs: keeping the service running and protected from abuse, based on our legitimate interest (Art. 6(1)(f)).

We don't sell your data, use it for advertising or use it to train AI models. MY TRAKR doesn't prescribe training or diagnose anything: the dashboard's indicators and alerts are calculations on your data and decide nothing about you.

You can withdraw at any time, and that doesn't affect what was done before. The dashboard doesn't work without health data, so withdrawing means deleting the account: use Delete my account, under Your data, or write to cristiano@zeroventuno.com. To withdraw only part of it, such as the menstrual cycle, write to the same email.

You decide whether to connect Claude, ChatGPT or another AI. Connected through your personal link, it reads and writes on your dashboard, health data included. What it reads and what you tell it is then processed by the AI provider, under your account and its rules: we don't see those conversations and aren't responsible for that processing. To stop, disconnect it in the AI itself. The link contains your key, so treat it like a password.

The person in charge of the team and the professionals assigned to you, such as coach, nutritionist and physio, see your data and can record workouts and plans. These professionals can also connect their own AI, and that AI's provider then receives what they look up about you. Before you accept this notice, the team may already have registered your name, email and phone.

People who work for the team also have data here: name, role and email, when provided, used to give them access. The legal basis is the contract with the team, and the rights below apply equally.

• Supabase Pte. Ltd. Stores the database, in Ireland.
• Vercel Inc. (United States). Runs the site, the dashboard and the AI connector on servers in Ireland: the data passes through them.
• Hostinger (group based in Lithuania). Hosts the automation server (n8n) and the email used for service emails.
• Only if you connect them: COROS, Strava, Garmin and Hammerhead Karoo, which exchange workouts and what the connection requires with the dashboard.

The first three process the data on our behalf. The services you connect and your AI follow their own rules. Beyond that, we only hand over data under a legal obligation.

The database, the automation server and the processing for the site, the dashboard and the AI connector are in Europe. Because Vercel is a United States company, it may process data there, such as technical logs, relying on its certification under the EU-U.S. Data Privacy Framework and, where required, on standard contractual clauses. Supabase and Hostinger state that they use standard contractual clauses when they transfer data outside the European Economic Area. Your AI and the services you connect may process data outside Europe, under their own rules.

• Account, training and health: for as long as the account exists. When you delete the account, it all leaves the database immediately.
• Database backups: may hold this data until they expire, and aren't used for anything else.
• Emailed links: the signup link lasts 14 days, and the key recovery link, 2 hours.
• Hosting logs: for the period set by the provider.

Under Your data, on the dashboard, you can download everything as JSON and delete the account immediately. For access, correction, restriction, objection or any other request, write to cristiano@zeroventuno.com; we reply within one month.

You can also complain to the Garante per la protezione dei dati personali, in Italy, or to the data protection authority in your country. People in Brazil have equivalent rights under the LGPD and can use the same email.

The dashboard is for people aged 18 or older.

Each athlete's data is isolated in the database, keys are stored only as hashes and traffic is encrypted. No system is infallible: if a breach puts you at risk, we'll tell you.

If the way we use your data changes, we'll ask for your consent again. The date at the top shows the latest version of this notice.