EN

Privacy notice

Last updated: 14 October 2026

This notice explains what personal data we process, why, for how long, and how you can exercise your rights.

Who the data controller is

SynerTrain is a tool used by personal trainers to manage their clients. That means we act in two different capacities, and which one applies determines who you should contact to exercise your rights.

What data we process and where it comes from

If you are a trainer, we process the data you give us when you register and use the platform: first name, surname, email address, language, your account settings and the identifiers our payment provider generates to manage your subscription. We never store your card details.

If you are a client of a trainer, the data is entered by your trainer, or by you within the space they created: name and contact details, the team you belong to, your training and nutrition plans, your measurements and progress photographs, your answers to periodic reviews, and the conversations you have with them inside the app.

If you sign in with your Google account, Google gives us your account identifier, your email address, your name and the link to your profile photo. If you sign in with your Apple account, Apple gives us your account identifier, your email address and your name, if you choose to share it. Apple also lets you hide your email: in that case we receive a forwarding address Apple creates for you, not your real email. We never receive your Google or Apple password.

If you leave your details in the notify-me form on this website, we store what you type into it: your name, your email address and, if you say so, the client bracket you work with. Nothing else: not where you came from, nor which pages you looked at before.

We also record the minimum technical data needed for the service to work and stay secure: session identifiers, your device token if you enable notifications, and access logs to prevent abuse.

For what purpose and on what legal basis

We process trainer account data to provide the contracted service, charge the subscription and meet our accounting and tax obligations. The legal basis is performance of the contract and, for invoicing, compliance with a legal obligation.

We process the notify-me form data for a single purpose: to write to you when the app is available. The legal basis is your consent (Article 6(1)(a) of the Regulation), which you give by ticking the box and which you can withdraw at any time by writing to the contact address. We do not use that data for anything else, we do not send newsletters, and we do not share it with anyone.

We process security and abuse prevention data on the basis of our legitimate interest in the platform not being used fraudulently.

We send service notifications to tell you what is happening in your account. You can turn off each type of notice in your preferences without losing access to the service.

Data a trainer stores about their clients is processed on that trainer's behalf and on their instructions, not for purposes of our own. We do not sell it, we do not share it with third parties outside the provision of the service, and we do not use it to train artificial intelligence models.

Health data: training and nutrition

Nutrition plans, body measurements, progress photographs and review answers are data concerning health, which the General Data Protection Regulation treats as a special category and protects more strictly.

Performance of the contract is not a sufficient basis for this data: your explicit consent is required. Your trainer obtains it before starting to work with you, and you can withdraw it at any time by contacting them. Withdrawal does not affect the lawfulness of earlier processing, but it will prevent your trainer from continuing to prepare your programme.

This data is accessible only to you and your trainer. No other user of the platform can see it, and our staff access it only where strictly necessary to resolve a technical incident that you or your trainer have reported.

Who is controller and who is processor: you, your trainer and us

For trainer account data, we are the controller: we decide why and how it is processed.

For the data of each trainer's clients, the controller is the trainer and we act solely as processor: we provide the tool and process the data on their instructions. That relationship is governed by a data processing agreement incorporated into the terms each trainer accepts.

In practice this means that if you are a client and want to access, rectify or erase your data, your point of contact is your trainer. If you contact us we will help you reach them and pass your request on, but the decision is theirs.

Note that the notes your trainer writes about you, even though the app presents them as private from other users, are your personal data and are covered by your right of access.

Who we share data with and which providers are involved

We do not sell personal data and we do not share it for advertising purposes. To provide the service we rely on the following providers, which act as processors or sub-processors and are bound by the corresponding contracts:

The visit count for that website is not done by any provider: we keep it ourselves, in our own database, and all that is stored for each visit is the page, the day and how many times. No IP address, no browser, no time of day, no referrer.

Anthropic's role deserves to be spelled out, because it is the least obvious: when your trainer imports a plan, whether from a file or by pasting its text, the content of that plan is sent to Anthropic to be interpreted. That provider automatically deletes the operational logs of the request after seven days and does not use the content to train its models.

International transfers

The database, the files and the measurement of visits remain in the European Union. However, the remaining providers (Stripe, Anthropic, Vercel and Google, both for notifications and for email) are established in the United States, so their involvement entails an international transfer of data.

These transfers rely on the standard contractual clauses approved by the European Commission, incorporated into each provider's processing agreement, together with the supplementary measures each of them documents. You can ask us for further information about those safeguards at the contact address given above.

How long we keep each thing

We keep your account data for as long as the account remains active. When you request deletion, the account is scheduled for deletion and your access is limited to your profile; the data is permanently purged after thirty days, a window that exists so a deletion requested by mistake can be reversed.

The notify-me form data is kept until we send the launch notice, or until you ask us to delete it, whichever comes first. If the launch never happens, it is deleted anyway: data kept for a purpose that no longer exists is not retained.

Support enquiries, together with their attachments, are kept for up to twelve months from the last message in the conversation or from the closure of the account, whichever is later, and are fully deleted within the following 30 days. If you close your account, the thread is unlinked from your profile and keeps only your email address, which is what allows a later claim to be matched with its conversation.

Information with accounting or tax relevance, such as subscription invoices, is kept for the periods required by commercial and tax law, regardless of whether you have closed your account.

The data of a trainer's clients is kept for as long as that trainer maintains the relationship and chooses to keep it, since they determine its retention period.

Your rights and how to exercise them

You can request access to your data, its rectification or erasure, the restriction of or objection to its processing, and portability in a structured, commonly used format. Where processing is based on your consent, you can withdraw it at any time.

To exercise them, write to the contact address given at the start of this notice. We will reply within one month, extendable if the request is complex, in which case we will let you know.

Remember what is said above: if you are a client of a trainer, requests about your training, nutrition or progress data must be addressed to them.

You can delete your account yourself, without writing to anyone, from your profile in the app or in the web dashboard. The steps, and what to do if you cannot get in, are on the account deletion page.

Complaints to the supervisory authority

If you believe the processing of your data does not comply with the applicable rules, you can lodge a complaint with the Spanish Data Protection Agency (calle Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es).

We would be grateful if, before doing so, you gave us the chance to resolve the problem by writing to our contact address.