Privacy policy
Version 2026-09-27
Who is responsible
Operador do programa-piloto Bastyra — identificação pendente is responsible for account, billing, security and support data. Each coach or organisation controls its athletes’ training data; Bastyra processes that data on its instructions.
Data we process
Identity and contact data; organisation membership; Bastyra Match requests and in-app messages; linked Drakon and Bastyra account identifiers for authorised cross-app access; workouts, 1RM, performance, nutrition and body metrics, athlete and coach notes; training videos that an athlete chooses to upload for technical review; notification subscriptions; billing identifiers (never card numbers); feedback; device, page and minimised technical error data. Marketplace contact details remain hidden from a coach until the first payment is confirmed. If a safety report is submitted, we also process the factual report, incident date, indicated evidence, responses, moderation decisions and necessary account identifiers.
Purposes and legal bases
We process data to perform the service contract, keep the service secure, meet legal obligations and support legitimate operational interests. Where training notes reveal health information, the organisation must establish an Article 9 GDPR condition and obtain explicit consent when required.
Recipients and transfers
Supabase provides authentication and database services; Vercel hosts the app; Stripe processes billing; Sentry records minimised technical errors; OpenAI processes pseudonymised data only when an authorised coach requests an IA Coach analysis; browser push providers deliver requested reminders. Their subprocessors may process data outside the EEA using applicable GDPR transfer safeguards.
Retention
Account and training data are kept while the organisation is active. Athletes may delete videos they uploaded at any time; deleted files are removed from active storage. After termination, the organisation has a 30-day export window; production data is then scheduled for deletion or irreversible anonymisation unless law requires retention. Residual encrypted backups expire through the supplier backup cycle. Security logs and feedback follow the internal retention schedule; billing records are retained for the period required by tax law.
Artificial intelligence
IA Coach is optional and sends only the minimum pseudonymised athlete data needed for the coach’s question. Requests are not used by Bastyra to make decisions with legal or similarly significant effects. AI output may be incomplete or incorrect and must be reviewed by a qualified professional before use.
Trust and safety reports
Reports are reviewed confidentially by authorised Bastyra staff. A report alone does not create a warning or close an account. The person concerned may be notified and given an opportunity to respond. Only a substantiated, documented decision may create a time-limited notice visible to a coach who already manages, or receives a direct request from, the athlete concerned. That notice does not expose the narrative, reporter or unnecessary personal data. Reports and decisions are retained for the documented defence and safety period, then deleted or anonymised unless a legal claim or authority request requires longer retention.
Your rights
You may request access, correction, restriction, objection, portability or deletion. Consent can be withdrawn without affecting earlier lawful processing. You may complain to Portugal’s CNPD. Requests are answered without undue delay and normally within one month.
Minors
Coach accounts are intended for adult professionals. An organisation may only add a minor athlete after identifying an appropriate legal basis, obtaining parental or guardian authorisation where required and providing age-appropriate information.
Security and incidents
We use tenant isolation, access controls, encryption in transit, restricted server credentials, backups and incident monitoring. No service can guarantee absolute security. Relevant breaches are documented and notified as required by the GDPR.