Privacy policy
Last updated:
1. Contact
- Contact email:
hola@tandivia.com
2. What data we process
About visitors to this website: the site is static, uses no analytics and submits no forms. The server records HTTP requests, such as IP address, timestamp, resource and user agent, for security and diagnostics.
During sign-up and billing:
- email address, language, selected plan and term;
- team name and estimated initial number of athletes, where applicable;
- Stripe customer, Checkout and subscription identifiers;
- subscription status, billed quantities, and trial, renewal, failed-payment, cancellation and retention dates;
- country and billing details required to validate the subscription.
Full card details are entered directly into Stripe and are not stored by Tandivia.
About people using the application:
- account data: name, email address, password protected by hashing, language, time zone and weight unit;
- training data: programmes, microcycles, completed sets, loads, repetitions, effort and estimates derived from them;
- physical data entered by the user, such as body weight, needed to compute strength estimates;
- relationship data: assigned coach, team and role within it;
- technical session data: session and refresh identifiers and their expiry dates.
3. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Handling sign-up, providing the service and managing the subscription | Pre-contractual steps and performance of a contract |
| Processing payments, issuing invoices and meeting tax and accounting duties | Contract and legal obligation |
| Maintaining sessions, protecting accounts and preventing fraud or offer abuse | Contract and legitimate interest |
| Answering enquiries and bringing or defending legal claims | Legitimate interest |
Physical and training data are the content of the service.
4. Who has access to the data
- Your coach and the people responsible for your team, where you belong to one, so they can access your programmes and training history and provide the service.
- Stripe, to host Checkout and manage payment methods, subscriptions, invoices, fraud prevention and the billing portal. Stripe also processes certain data under its own privacy policy.
- OVHcloud, which hosts the application in Gravelines, France.
- Brevo, for invitations, password recovery and operational notices.
- Backblaze B2, for backups in the configured European region.
Data is not sold or shared for advertising. Some providers, particularly Stripe, may process data outside the European Economic Area. Where applicable, recognised safeguards are used, such as adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses.
5. Retention
Operational data is kept while the account has access. When a subscription ends, the account or team and its operational data are retained for six months so they can be recovered, then deleted by a scheduled process.
Sign-up attempts and a minimal record of offers already used are kept for as long as needed to manage the subscription, resolve incidents and prevent a one-time offer from being restarted by deleting and recreating accounts. They will be deleted or anonymised when those purposes end, unless another legal duty requires their retention.
Billing, payment and transaction records are retained for the periods required by tax, accounting and fraud-prevention law or for as long as needed to handle claims. Stripe also applies its own retention periods.
Backups remain encrypted and access-restricted until automatic rotation: 7 daily and 4 weekly copies are kept and are not used to reactivate a deleted account. Emails that exhaust their retries keep their encrypted content for no more than 7 days; delivered messages are removed from the queue.
An erasure request is separate from cancelling a subscription and may be made at any time. Data that must remain for a legal obligation or to bring, exercise or defend claims will be restricted or blocked for the applicable period.
6. Your rights
You can request access, rectification, erasure, objection, restriction and portability by writing to the contact email in section 1. If you believe the processing does not comply with the law, you can lodge a complaint with the Spanish Data Protection Agency or your local supervisory authority.
7. Security
Passwords are stored using a purpose-built hashing function, never in clear text. Sessions use
httpOnly, Secure cookies that page JavaScript cannot read. Traffic is encrypted with TLS and the
database is backed up daily.
8. Changes
Any material change to this policy will be announced in the application and reflected in the update date at the top of this page.