Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using our Service, including account information (name, email address, password, profile picture) and communications such as messages, support tickets, and feedback. We also collect fitness profile data (FTP, heart rate zones, sport preferences), weekly schedule and race calendar inputs, saved workouts and training plans, integration connection tokens when you link third-party services, and content such as workouts and training data you create. For Vo2Max Pro subscribers, payment details (such as billing address and payment method) are collected and processed by Paddle - we do not store full card numbers on our servers.

2.2 Information Collected Automatically

When you use the Service we automatically collect device information (device type, operating system, browser type), usage data (pages visited, features used, generation events, time spent, clicks), log data (IP address, access times, referring URLs), and general location based on IP address (country or region). We may use privacy-respecting analytics to understand how the product is used.

2.3 Information From Third Parties

We may receive information from analytics providers (aggregated usage statistics) and from authentication providers if you sign in with Google, Apple, or similar. When you connect Strava, Intervals.icu, Wahoo, or similar integrations, we receive activity data, profile metrics, and tokens needed to sync workouts and training load. For Vo2Max Pro subscribers we receive transaction and billing information (such as subscription status, payment confirmations, and invoice details) from our payment processor, Paddle.

3. How We Use Your Data

3.1 Service Delivery

We use your data to provide and maintain the Service, manage your account and preferences, and enable features and functionality.

3.2 Communication

We send transactional emails (such as account confirmations and password resets), provide customer support, send important service announcements, and with your consent may send marketing communications.

3.3 Improvement, Analytics, and Algorithm Development

We analyze usage patterns and aggregated training data to improve the Service, develop new features, tune plan-generation algorithms, conduct research and analysis, and monitor and prevent technical issues. Where possible we use anonymized or aggregated data for product improvement. We do not sell your personal training data to third parties.

3.4 Security & Compliance

We use your data to protect against fraud and abuse, ensure platform security, comply with legal obligations, and enforce our Terms of Service.

4. Legal Basis for Processing

4.1 Contract Performance

We process data where necessary to fulfill our contract with you: providing access to the Service, managing your account, and delivering the features you use.

4.2 Legitimate Interests

We process data based on our legitimate interests in improving and optimizing the Service, preventing fraud and ensuring security, and marketing our services to existing customers where permitted.

4.3 Consent

Where we rely on your explicit consent we use it for marketing communications, optional analytics and personalization, and non-essential cookies.

4.4 Legal Obligations

We process data when required by law, including for tax and accounting records, responding to legal requests, and regulatory compliance.

5. Data Sharing & Third Parties

5.1 Service Providers

We may share your personal data with service providers who assist us: cloud hosting for data storage and computing, email services for transactional and marketing emails, analytics for usage analysis and reporting, and customer support tools. For Vo2Max Pro subscriptions we share relevant data (such as your email address and subscription details) with Paddle for payment processing, subscription management, and fraud prevention. Paddle's use of your data is governed by the Paddle Privacy Policy.

5.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity.

5.3 Legal Requirements

We may disclose your data if required by law or in response to valid legal requests from public authorities.

5.5 Third-Party Integrations

When you connect Strava, Intervals.icu, Wahoo, or other supported platforms, we exchange data necessary to import activities, export planned workouts, and update training load metrics. Each integration is governed by that provider's own privacy policy. You may revoke access at any time through your Vo2Max account settings or through the third party's connected-apps settings. Revoking access stops future data exchange but does not automatically delete data already imported.

5.6 With Your Consent

We may share your data with other third parties when you have given us explicit consent to do so.

6. Data Retention

We retain your personal data for as long as necessary to provide the Service to you, comply with legal obligations (typically 5-7 years for financial records), resolve disputes and enforce our agreements, and maintain security and prevent fraud.

After account deletion or subscription cancellation, active data is retained for 30 days to allow recovery and backups for up to 90 days. You may request earlier deletion of your account and associated personal data through Account settings or by emailing support@vo2max.icu. Legal and financial records are retained as required by law. Anonymized analytics data may be retained indefinitely.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 Access

You have the right to request a copy of the personal data we hold about you.

7.2 Rectification

You have the right to request correction of inaccurate or incomplete personal data.

7.3 Erasure

You have the right to request deletion of your personal data in certain circumstances.

7.4 Data Portability

You have the right to receive your personal data in a structured, machine-readable format.

7.5 Restriction

You have the right to request restriction of processing of your personal data.

7.6 Objection

You have the right to object to processing based on legitimate interests or for direct marketing.

7.7 Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

7.8 Exercising Your Rights

To exercise any of these rights, please contact us at support@vo2max.icu. We will respond to your request within 30 days.

7.9 Complaints

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority.

8. Cookies & Tracking

8.1 What Are Cookies

Cookies are small text files stored on your device that help us provide and improve the Service.

8.2 Types of Cookies We Use

We use essential cookies required for the Service to function (authentication and security), functional cookies to remember your preferences and settings, analytics cookies to understand how you use the Service, and with your consent marketing cookies to deliver relevant advertisements.

8.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the Service.

8.4 Do Not Track

We currently do not respond to "Do Not Track" browser signals. We may update this policy as industry standards evolve.

9. Data Security

9.1 Technical Measures

We use encryption for data in transit (TLS/SSL) and at rest, secure authentication and access controls, regular security audits and penetration testing, intrusion detection and prevention, and regular software updates and security patches.

9.2 Organizational Measures

Access to personal data is restricted on a need-to-know basis. We maintain incident response procedures and carry out regular security reviews.

9.3 Data Breach Response

In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities as required by law, typically within 72 hours of becoming aware of the breach.

10. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we do so we use appropriate safeguards such as Standard Contractual Clauses approved by relevant authorities, adequacy decisions where applicable, or other lawful transfer mechanisms.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Policy Changes

We may update this Privacy Policy from time to time as the product evolves. Material changes will be posted on this page with an updated "Last updated" date. For significant changes we may also notify you by email or through an in-app notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.