Private beta legal notice
This page is prepared for legal review, but public legal copy is not finalized. Public signup must stay closed until the operator supplies and approves the required legal facts below.
- Operator legal entity name: Privacy controller identity and Terms contracting party.
- Registered address: GDPR Article 13 controller contact details.
- Privacy / data-subject request email: Access, portability, erasure, objection, and restriction requests.
- Support / terms contact email: Account, terms, and operational support contact.
- Governing law: Terms governing-law clause.
- Court venue: Terms dispute venue clause.
- Lead supervisory authority name: Privacy complaint route for the operator's establishment.
- Lead supervisory authority URL: Direct complaint link.
Last updated: 2026-05-04
Privacy Policy
This policy explains what VLamax collects, why we use it, where it is stored, and how you can ask for access, export, correction, restriction, objection, or deletion.
Who runs this service
The controller identity, registered address, privacy contact, and lead supervisory authority are not configured yet. Public signup must remain closed until those operator details are supplied and reviewed.
What we collect
When you sign up we ask for an email address, password, name, and role. In the app you can add physiological test results, training plans, race goals, body-composition details, nutrition targets, sleep and HRV data, coach-athlete messages, and saved courses. If you connect Intervals.icu, we read the data you authorize through that connection.
We do not collect tracking cookies, advertising pixels, ad-network beacons, or device fingerprints. The app uses one required session cookie, vlamax_sid, to keep you signed in.
Why we collect it
- Contract, GDPR Article 6(1)(b): to create your account, run the coaching features, save your plans, and provide settings such as data export and account deletion.
- Legitimate interest, GDPR Article 6(1)(f): to keep the service secure through session records, login timestamps, failed login counters, IP address, and user-agent records.
- Explicit consent for beta health/performance processing: during private beta, signup requires a clear acknowledgement before training, metabolic, nutrition, and recovery data is processed for testing the platform.
Where it lives
Production data is currently stored in Postgres on a Hetzner Online GmbH server in Germany. Operational backups are intended to remain in the same region. If the hosting region or processor changes, this page must be updated before public launch or before the change applies.
How long we keep it
- Account and coaching data: kept while your account exists, then deleted when you delete the account.
- Wellness time series: capped at the most recent 90 days per athlete, with older rows removed automatically.
- Session and security records: active rows stay for the session lifetime; revoked records may be retained for up to 12 months for security review.
Who we share it with
We do not sell your data. We do not run ad-network tracking. We use a small number of processors to operate the service:
- Hetzner Online GmbH: server hosting in Germany.
- Resend: transactional email such as password resets and account notices. Resend receives recipient addresses and email content, not your training files or physiological test history.
Intervals.icu is your own third-party account. We access it only through the credentials or authorization you provide, and revoking that authorization cuts off access.
Your rights
- Access and portability: download a JSON copy from Settings.
- Erasure: delete your account from Settings. Deletion is immediate and irreversible.
- Correction: edit profile fields in Settings, or contact us if a field is not editable in-app.
- Restriction or objection: contact us to pause or object to a specific processing activity.
- Complaint: the lead supervisory authority must be confirmed before public launch.
Children
The service is not directed at children under 16. If you believe a minor has signed up, contact us and we will delete the account.
Changes
We update the date at the top when this policy changes. For material changes, such as new categories of data, new processors, or changed retention periods, we aim to email active accounts at least 30 days before the change takes effect.