Privacy policy

Who is responsible for your data

If you are a coach's client, the controller is your coach: they are the one who decides what data is collected and for what purpose. Axiren Systems acts as a processor: that is, it provides the platform and processes the data following your coach's instructions. To exercise your rights you can contact your coach or write to us at privacidad@axirensystems.com and we will pass your request on.

If you are a coach, we are the controller of your account data (sign-up, billing and support) and the processor of your clients' data.

Special categories of personal data

OnTrain does not ask you anything about your health on its own. What you are asked is decided by your coach, not by us: each coach builds their own forms with the questions they need, so there is no fixed list of fields that we could publish here. If one of their forms asks about your health, what you answer there is data that the General Data Protection Regulation (GDPR) considers special categories of personal data (Article 9), and so may be what you choose to tell them in the chat or when you log a workout.

When your coach marks a form as a health form, the app asks for your explicit consent before you answer it, with its questions in front of you. The purpose is a single one: for your coach to prepare and adjust your training and your nutrition; it is not used for anything else. You can withdraw it at any time from your profile: your answers to those forms are deleted and you won't be able to send them until you authorise it again. Withdrawing it does not affect the lawfulness of the processing carried out before.

It is not a single permission: the photographs, the use of artificial intelligence and the publication of your images for promotional purposes are requested separately, and none of them is mandatory. You can say no to any of them and your coaching works just the same.

What data we process and why

• Identification and contact details (name, email address, phone number): to give you access and to communicate with you.
• Training (programmes, sets, loads, comments): so that your coach can follow your progress and adjust the plan.
• Check-ins: the answers, measurements and photographs your coach asks you for in the form they have built, to assess how you are progressing.
• Chat, including images and voice notes: for communication with your coach.
• Appointments and video call links: to organise check-ins. Video calls take place on our own servers and are not recorded.
• Minimal technical data (session, error logs and logs of requests to the server): to keep the service secure and working. Server logs keep the full IP address for at most 7 days, so that an attack can be investigated; after that they are only kept without the last part of the IP address, for up to 30 days. We use those same logs to count visits to the website in aggregate (pages viewed, at what time and from which website people arrive): without cookies, without storing anything on your device and without storing the IP address. So as not to count the same person twice in one day, a temporary code is used and deleted at the end of the day; all we keep are the totals.
• Access log: the IP address and browser you log in with, failed attempts against your account and sensitive actions (such as downloading a copy of your data). It is a security measure of the platform: it is used to detect and stop access that is not yours. It is deleted after 6 months.

Legal basis

If you are a coach's client, your coach processes your data to provide the coaching you have agreed on (Article 6(1)(b) GDPR) and, for special categories of personal data, on the basis of your explicit consent (Article 9(2)(a) GDPR). Progress photographs, the artificial intelligence features and the publication of your images are based on the consent you give for each of them separately. Your identification and contact details are necessary to give you access: without them your account cannot be opened.

If you are a coach, we process your account data to perform the service contract (Article 6(1)(b) GDPR): it is necessary to open your account and provide the service, and without it we cannot do so. What we keep because of a legal obligation, such as invoicing, is based on compliance with that obligation (Article 6(1)(c) GDPR).

For everyone, technical data and the access log are based on our legitimate interests in keeping the platform secure and detecting access that is not yours (Article 6(1)(f) GDPR).

Artificial intelligence

The platform includes AI-assisted features that your coach may have switched on:

• An assistant that answers the coach's questions about their clients by consulting the information already on the platform.
• Transcription of voice notes into text, so that they can be searched and the assistant can take them into account.
• Suggestions for meal plans and recipes.

For these features, the content needed (messages, notes, audio recordings, comments and what you answer in your coach's forms) is sent to Google Cloud, which acts as a processor and does not use this data to train its models. The processing takes place in data centres in the European Union.

Before any text is sent to the AI, the names of the people on the platform and identifiers (email addresses, phone numbers, identity documents…) are replaced with codes that the provider cannot link to anyone: the table that says who each code refers to never leaves our servers. Voice notes are sent as audio to be transcribed, with no name or other data attached. Photographs, both from check-ins and from the chat, are not sent to any AI system.

If the AI provider's safety filters block a message as a use that is not allowed, it is neither sent nor kept in the conversation, but we keep a copy, already pseudonymised, for 30 days so that a person can review it; after that it is deleted and only a record of the warning remains, without the text. If it keeps happening, the AI for that account is paused as a precaution until a person reviews it, and the final decision is always taken by a person.

Apart from that pause, these features do not make automated decisions about you: they are an aid for your coach, who is the one who decides.

Who we share data with

We do not sell data or pass it on for advertising purposes. We use the following providers, which act as processors and are bound by contract:

• Supabase: database, authentication and files (EU).
• Hostinger International Ltd.: application hosting, video processing and video calls (France (EU)).
• Resend: sending transactional email (EU / US (DPF)).
• Google Cloud (Vertex AI): the coach's assistant, meal plan generation and the recipe chat (EU (European multi-region)).
• Google Cloud (Speech-to-Text): transcription of chat voice notes (EU (European multi-region)).

Stripe processes your coach's payment data as an independent controller, not as our processor: it decides on its own what it keeps in order to take payments, prevent fraud and comply with payment regulations. If you are a coach's client, you pay nothing here and your data does not pass through it.

YouTube (Google) only appears when your coach links a demonstration video hosted there. The player loads in cookie-free mode and only if you press play; until then, nothing is sent to Google. The videos the coach uploads are stored in Supabase, not on YouTube.

When a provider processes data outside the European Economic Area, the transfer is covered by an adequacy framework in force or by the European Commission's standard contractual clauses, a copy of which you can request from us.

Cookies and storage on your device

We do not use analytics, advertising or third-party cookies, and we do not track you across other websites. That is why you will not see a cookie banner: we only store what is essential for the app to work, and for that the law does not require us to ask for your permission (though it does require us to tell you).

• Session (ontrain-session): keeps you identified as you move between screens. Without it you would have to log in again on every page. It expires when you log out.
• Known device (ontrain-dispositivo): only on the accounts of coaches and their teams. It identifies this browser so that we can alert you by email if someone logs in to your account from another one. It lasts 400 days; if you delete it, the next login from here counts as a new device and you will receive that alert.
• Access during downtime (ax_mantenimiento): only created if you open an access link we have given you while the platform is under maintenance. It lasts 12 hours.
• Website language (ontrain-idioma): only stored if you choose a language on the website or decline the suggestion to view it in the other one. It remembers your choice so that we do not suggest the other one to you again. It is not a cookie: it stays in your browser's storage and is not sent to any server.
• Platform language (ontrain-idioma): on the login pages, in the dashboard and in the app the same choice is a cookie, because those screens are prepared on the server and need to know which language to use. It is only created when you choose a language (or arrive from the English website or from an email in English), it only stores ‘es’ or ‘en’ and it lasts a year. If you have an account, the language is also saved in it, so the platform, our emails and our notifications reach you in the language you chose on any device.
• Preferences: the theme and the app settings, and the workouts you log without signal until they sync. They are not cookies: they stay in your browser's storage and are not sent to any server. You can delete them by clearing the site data.

If you press play on a YouTube video your coach has linked, from that moment on Google may store data on your device under its own policy. It is your decision: the player does not load until you press it.

How long we keep it

The periods below are those for a coach's client. If you are a coach, the one for your own account is different (shorter, because it is the period of a contract and not that of following a person's progress) and is set out in the terms of service.

While your account is active, your history is kept, with two limits that apply automatically even if nobody does anything:

• Progress photographs: the first one in each category is kept (the one that serves as the ‘before’ in comparisons), along with all those from the last 12 months. Older ones in between are deleted.
• Chat images, audio and videos: deleted after 12 months. The message stays, with its date and its text; the file does not.

From then on it depends on what happens, because ending the coaching and deleting the data are not the same thing:

• If your coach closes your profile, the service ends: you lose access to the app (you can only log in to ask us to delete your data) and the permissions you gave are no longer in force. What the AI had generated about you is deleted: the assistant's index and the transcripts of your voice notes. The rest is kept for 12 months in case you resume the coaching (to come back, you have to accept it yourself), and once that period has passed everything is deleted automatically: the account, the workouts, the measurements, the photographs and the conversations.
• If you ask us to delete your data (from your profile or by writing to us), you do not have to wait for those 12 months: we pass it on to your coach, who is the one who decides about it, and everything (the account, the photographs, the audio recordings and the transcripts made from them) is deleted within one month at the latest. If your coach does not do it, we do it within that period. This cannot be undone.

For everyone, coaches included: the IP address and browser in the access log are deleted after 6 months. Only the fact that there was an access, and when, is kept, for as long as your account exists: it is deleted with it. Server logs are deleted after 30 days.

Data is deleted from active systems immediately; database backups are kept for 7 days, after which it disappears from them too. Photographs and files are deleted immediately and permanently: they are not included in backups.

In both cases we may keep what is strictly necessary to comply with legal obligations (for example, invoicing). The payments your coach had recorded survive the deletion unlinked from your profile: your coach needs them to balance their accounts, and they no longer point to you.

Content uploaded by your coach

The videos, photos and audio on the platform are uploaded by coaches, not by us. If something in here infringes your rights (you appear in a video without having consented, or the material is yours), you can let us know at ontrain.app/en/report-content. We review it and tell you what we decided.

Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent. Write to us at privacidad@axirensystems.com.

In particular, you can object at any time to processing based on our legitimate interests (technical data and the access log): we will stop unless we can demonstrate compelling legitimate grounds that override your rights, or we need it to defend ourselves against claims.

You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency) at aepd.es, or with the supervisory authority of the EU country where you live or work.

Security

Data travels encrypted, access is restricted to your coach and to you through controls at database level, and files (photographs, audio recordings and chat images) are served through temporary, non-public links. If someone logs in to the account of a coach or a member of their team from a device we had not seen before, we alert them by email straight away.

Changes

If we change this policy, we will update the date at the top and, when the change is significant, we will let you know through the platform itself.