Privacy Policy

1. Who We Are

Elitebuilder is a coach-to-athlete fitness platform. Coaches build and assign workouts; athletes track performance. “We”, “us”, and “our” refer to the operator of the Elitebuilder app.

The controller within the meaning of Art. 4(7) GDPR is:

Full provider details are listed in the Imprint. We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR / § 38 BDSG.

2. Data We Collect

Physical metrics may be entered by the athlete during onboarding or updated by the coach.

3. How We Use Your Data

• Deliver the service — display assigned workouts, sync progress across devices, show workout history.
• Coach visibility — your coach and authorised members of your coaching organisation can view your workout completions, logged sets, physical metrics, and check-in responses.
• App improvement — aggregated, anonymised usage patterns help us prioritise features and fix bugs.
• Support — your email is used solely to respond to support requests you initiate.
• AI assistance — help coaches draft and adapt training programs and summarise athlete progress. See section 6.

We do not use your data for advertising or sell it to third parties.

4. Legal Bases for Processing

Under Art. 6(1) GDPR we rely on the following legal bases:

Providing your account data is necessary to use Elitebuilder: without it we cannot create an account or deliver the service. Where a field is optional in the app, leaving it blank has no consequence beyond the feature that depends on it being unavailable.

5. Health and Fitness Data

Body weight, height, workout performance and check-in answers say something about your physical condition. We treat them as data concerning health within the meaning of Art. 4(15) and Art. 9(1) GDPR. That is a special category of personal data and carries a higher standard of protection.

We process it on the basis of your explicit consent under Art. 9(2)(a) GDPR. You give that consent when you set up your athlete profile and confirm that your coach and the authorised members of your coaching organisation may see this data. Consent is voluntary. You can withdraw it at any time with effect for the future by emailing us or deleting your account, and withdrawal does not affect processing that already took place.

We do not share health data with anyone outside your coaching organisation and the sub-processors listed in section 9, and we never use it for advertising.

6. Elitebuilder AI

Elitebuilder includes AI-assisted features that help coaches draft and adapt training programs and summarise athlete progress. They are used by coaches. When such a feature is used, the relevant content is sent to a large language model and the generated response is returned to the app.

That content consists of coach-authored text such as program and exercise descriptions, together with workout performance data, physical metrics and check-in answers. No email addresses are sent to a model. We do not populate requests with athlete contact details. A coach writing free text can of course mention a name, so we ask coaches to keep prompts to the information the task needs. Because the content can include health data, this processing rests on your explicit consent under Art. 9(2)(a) GDPR as described in section 5.

All AI requests are routed through the Vercel AI Gateway operated by Vercel Inc. We do not tie the product to one model or one provider. The gateway selects a provider for each request from the pool of providers it supports, based on model availability, uptime and latency, so the provider handling a given request varies and the pool changes as providers are added or removed. The category of recipient is therefore AI model providers reachable through the Vercel AI Gateway, and the current membership of that pool is published by Vercel on its models and providers page.

We run the gateway with Zero Data Retention enabled. In that mode requests are routed only to providers with which Vercel has negotiated a zero-retention agreement: the provider processes the prompt to generate the response and does not store it afterwards. Zero Data Retention also covers training, so providers in the pool may not use your content to train their models.

AI output is a suggestion for the coach to review, never an automated decision about you. See section 15. You can ask us at any time which providers were reachable for your data during a given period by writing to info@elitebuilder.app.

7. Website Analytics & Cookies

On the elitebuilder.app website we use PostHog to understand how visitors move through the site, so we can see which pages are useful and where people get stuck. PostHog stores this data on servers in the European Union. Analytics traffic is routed through our own domain, which means it is not shared with any additional third party in transit.

With your consent, this includes session recordings — a replay of your visit showing page views, mouse movement, clicks, and scrolling. Text you type into form fields is masked and is not readable in a recording. We do not record the app itself, only the marketing website.

We ask for your consent before any of this begins. Until you choose, nothing is stored on your device and no analytics data is collected. Your options:

• Accept — we set a cookie to recognise your browser across visits, and session recording is enabled.
• Reject — no cookies are set, nothing is stored on your device, and no session recording takes place. We still count the visit in an anonymous, aggregate form that cannot be traced back to you.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your mind at any time, and withdrawing is as easy as giving consent:

Analytics data is never used for advertising, never sold, and never combined with your coaching or workout data.

8. Website Enquiries and Support Requests

The contact and support forms on elitebuilder.app submit your entry to our database so that we can reply. We store the email address you enter and, depending on the form, your name, your club or organisation, and your message. We also store the IP address the submission came from and your browser’s user agent string, which we keep in order to detect and block automated spam.

We use this data only to answer you and to follow up on your enquiry. We do not add you to a marketing mailing list, and we do not pass the data to anyone other than the hosting and database providers listed in section 9.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns entering into a contract, otherwise Art. 6(1)(f) GDPR, our legitimate interest in replying to people who write to us. Retention is covered in section 11.

9. Data Sharing & Sub-processors

We share data only with sub-processors required to operate the service:

Each sub-processor is bound by a data processing agreement and handles your data only as instructed.

10. International Data Transfers

Your account and workout data is stored in the European Union. Some sub-processors are nevertheless established in third countries, or may access data from there for support and maintenance.

• United States(Supabase, Vercel, PowerSync, Apple, PostHog): the European Commission has found that the EU-US Data Privacy Framework provides an adequate level of protection. Where a provider is certified under that framework we rely on it. Where it is not, the transfer is covered by the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR.
• AI model providersreached through the Vercel AI Gateway: because the gateway rotates across a changing pool, a request may be handled by a provider established in a third country for which the European Commission has issued no adequacy decision. Those transfers rest on Standard Contractual Clauses under Art. 46(2)(c) GDPR, passed through Vercel’s agreements with each provider and backed by the Zero Data Retention terms described in section 6, together with a transfer impact assessment on our side. Where a country grants public authorities broad access rights, the level of protection is not equivalent to the one guaranteed inside the EU.

To request a copy of the safeguards in place, email info@elitebuilder.app.

11. Data Retention

Account data is retained while your account is active. On a verified deletion request we delete or anonymise your personal data within 30 days, except where retention is required by law.

Website analytics data is kept only as long as it is useful for the purposes described in section 7. Session recordings are deleted automatically by PostHog after a limited retention period, which is shorter than the period we keep aggregate event counts.

Enquiries sent through our website forms are deleted once the matter is settled and no follow-up is expected, at the latest after 12 months. Where commercial or tax law requires longer storage we keep the record for the statutory period, normally six or ten years under § 257 HGB and § 147 AO, and restrict processing to that purpose. The IP address and user agent stored with a submission are deleted after 30 days.

We retain AI request content only for as long as the response is being generated. Where a model provider retains request content for abuse monitoring, that period is set by the provider’s own terms.

12. Your Rights

Depending on your jurisdiction you may have the right to:

• Access — receive a copy of the personal data we hold about you.
• Correct — fix inaccurate data.
• Delete — request erasure of your personal data.
• Restrict / Object — limit certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time with effect for the future.
• Lodge a complaint — under Art. 77 GDPR you may complain to a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise any right, email info@elitebuilder.app. We respond within one month of receiving your request, as required by Art. 12(3) GDPR.

13. Security

• All data in transit is encrypted with TLS.
• Data at rest is encrypted by Supabase.
• Production data access is restricted to authorised personnel.

No system is completely secure. We cannot guarantee absolute security, but we follow industry-standard practices to protect your data.

14. Children

Elitebuilder is not directed at children under 16. Germany has not lowered the age set in Art. 8(1) GDPR, so 16 is the age from which a child can consent to an online service on their own. We do not knowingly collect data from children under 16 without the consent of a parent or guardian. Contact us if you believe a child has created an account without that consent and we will delete it promptly.

15. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR. AI-generated training suggestions are reviewed by your coach before they reach you.

16. Changes

We may update this policy. Material changes will be communicated via in-app notice or email. The effective date at the top will always reflect the latest revision.