1. The essentials about your data
TrainingForever lets you plan workouts, record activities, analyse performance and collaborate with coaches and clubs. Some features use information that reveals or allows inferences about aspects of your health. That information receives special protection.
Creating an account or accepting the Terms of Service does not amount to consent to all processing. We will request specific authorisation where necessary to use health data, activate optional AI features using those data, connect a service or receive advertising. You can withdraw any consent you have given.
Your coach or club may be the controller of data it manages to provide its sports services to you. TrainingForever may act on its behalf as a technology provider. TrainingForever, in turn, is controller for its own processing, such as managing your account and service security. Section 3 explains this distinction.
2. Who TrainingForever is and how to contact it
| Item | Information |
|---|---|
| Entity | Trainingforever OÜ |
| Business register | Estonia, code 16941437 |
| Intra-Community VAT | EE102717330 |
| Address | Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia |
| Privacy and rights requests contact | [email protected] |
| Main website | trainingforever.com |
This policy applies to the official TrainingForever website and applications that incorporate it. It does not describe independent processing by an external sports platform, external AI client or your coach outside the TrainingForever service.
3. Who decides each processing activity
Each participant's role depends on who actually determines the purpose and essential means of processing, not solely on the name of their account.
| Situation | TrainingForever's role | Other people's or entities' roles |
|---|---|---|
| Registration, authentication, TrainingForever subscription, account support, security and its own obligations | Controller | Its providers act as processors or independent controllers for their lawful purposes, depending on the service |
| Sports diary and analysis used directly by an athlete as TrainingForever's own service | Controller | The athlete decides which features and connections to activate; this does not make them a professional controller |
| Data managed by a coach or club to provide its services to athletes | Processor, subject to the DPA and documented instructions | The coach or club is controller; where the coach works under the club's authority, they do not automatically become an independent controller |
| Coach operating as processor for another entity | Subprocessor, where authorisation exists and the corresponding chain has been formalised | The entity is controller and the coach retains their processor obligations |
| Integrations and AI within a coach or club workspace | Retains the role applicable to the sports processing; activating AI does not, by itself, change that role | The controller must have provided information and established a legal basis for that use and authorised the necessary subprocessors |
| External service you connect, including an MCP client | Controller for the relevant disclosure or processor executing a valid instruction | The external service may act as controller or processor according to its contract, purpose and configuration |
The identity and contact details of the coach or controller entity must be provided in the invitation, registration or sports relationship and in its own privacy information. You can ask us for help identifying it. When we receive a request falling to that controller, we will forward it and help it respond in accordance with the DPA.
If two entities jointly determine processing, they must establish the relevant joint controllership arrangement and provide you with its essential aspects. The DPA does not replace that arrangement.
4. What data are used and where they come from
Only data necessary for the features you use and permissions you have granted should be processed.
| Category | Examples and source |
|---|---|
| Identity and account | Name, email, identifier, language, country, age or date of birth where necessary, profile image and organisation membership; provided by you or through a lawful invitation |
| Contracting and payments | Plan, limits, invoices, tax data, payment status, transaction and subscription identifiers; from the contracting party and payment provider |
| Training | Discipline, goals, calendar, planned and completed sessions, exercises, sets, repetitions, loads, pace, power, cadence, distance, duration, elevation gain and completion; supplied by you, your coach or authorised connections |
| Health and fitness | Heart rate, zones and physiological metrics, estimated capacity or recovery, weight, body composition if provided, rest, fatigue, pain, injuries, limitations and comments revealing health information; supplied directly or from authorised connections |
| Sports location | Routes and coordinates of imported or recorded activities where required by the feature; a route may reveal a home address, regular locations or sensitive information |
| Clubs and communication | Membership, role, messages, comments, group or challenge participation and visibility preferences; supplied by authorised participants |
| AI and automations | Instructions, screen or activity context, history used, data returned by tools, responses, proposals, actions and execution logs; generated when these features are used |
| Integrations and API | Connected service, permissions, external identifiers, authorisation tokens and synchronisation logs; from the connection process and provider |
| Technical and support data | IP address, session, browser, device, security events, errors and communications with support; generated on access or when assistance is requested |
| Preferences and legal evidence | Version of texts provided, contractual acceptance, consent, withdrawal, date, context and proportionate evidence of the act performed |
A sports metric is not automatically health data in every context. We give it enhanced protection where it reveals or allows inferences about your physical condition or health. Derived estimates and profiles may also be health data. Watch metrics are not used to identify you through biometrics merely because they come from a sensor.
We do not need complete medical records, routine identity documents or data about third parties unrelated to training. Avoid including them in messages, files, support requests or instructions to AI.
If a coach supplies your data before you have an account, they must inform you of the source and purpose, recipients and rights within the statutory periods. Where TrainingForever is controller for indirectly obtained data, it will provide the information required by Article 14 GDPR, normally within one month and, where applicable, before the first communication or disclosure, unless a statutory exception applies.
5. Why data are processed and on what basis
The following bases apply to processing for which TrainingForever is controller. Use of Article 6 GDPR does not replace the additional exception required by Article 9 when health data are processed.
| Purpose | Basis under Article 6 GDPR | Additional conditions |
|---|---|---|
| Create and manage your account and provide the ordinary features requested | Performance of the contract with you or pre-contractual steps, Article 6.1.b | Only objectively necessary data; optional data do not become mandatory through inclusion in the terms |
| Manage TrainingForever contracting, contractual support and payments | Article 6.1.b; specific accounting or tax obligations, Article 6.1.c | For contacts at a contracting company, legitimate interest in managing the professional relationship, Article 6.1.f, where they are not party to the contract |
| Record, monitor and analyse your health or fitness in features you request | Article 6.1.b where necessary for the contracted feature; Article 6.1.a for additional voluntary uses | Explicit consent under Article 9.2.a as the rule for this service; another exception requires specific assessment and information |
| Optional AI using your personal sports data, including health data | Consent under Article 6.1.a for this separate purpose | Explicit consent under Article 9.2.a if it uses or infers health information; prior information about provider, data and purpose |
| Send data to a chosen coach or club and enable optional access | Contract where access is necessary for the collaboration you have requested; consent for additional disclosures | Explicit authorisation of health data disclosure where Article 9.2.a is used; the recipient is identified |
| Import or export through an optional connection, including MCP | Consent, Article 6.1.a, for the optional connection and disclosure | Explicit consent if health data are included and that is the applicable exception; valid technical permission and compliance with source terms are also required |
| Voluntary participation in clubs, challenges or spaces visible to others | Contract for requested participation; consent to publish information or optionally extend visibility | Consent to publish health information or routes is not presumed. Publication is disabled by default and requires specific assessment and authorisation |
| Respond to enquiries without a prior contractual relationship | Pre-contractual steps or legitimate interest in responding to requests, according to their content | Legitimate interest does not permit unrestricted health data use; inclusion is avoided unless necessary and specifically authorised |
| Protect accounts and systems, investigate abuse and maintain necessary technical logs | Legitimate interest, Article 6.1.f, in security and integrity; Article 6.1.c where a specific obligation exists | Assessment of necessity and proportionality; sports and health content in logs is minimised |
| Send news or promotions | Consent, Article 6.1.a | Separate from registration and withdrawable in each communication; health data are not used for advertising targeting |
| Cookies, SDKs or optional measurement or advertising technologies | Consent, Article 6.1.a, and device rules | The Cookie Policy applies; they are not activated by accepting this policy |
| Usage statistics and technical improvement | Legitimate interest for minimum technical metrics without optional tracking; consent where required | Truly anonymous data are prioritised. Improvement does not authorise reuse of health data or identifiable conversations for new purposes |
| Address obligations and claims | Article 6.1.c for specific obligations; Article 6.1.f for establishing or defending claims | Only where necessary, Article 9.2.f for health data relating to a claim; this does not support keeping the whole history indefinitely |
For data managed by a coach or club, that controller is responsible for determining and informing you of the Article 6 and 9 bases. TrainingForever processes them under its instructions. Its contractual relationship with TrainingForever does not, by itself, constitute an exception permitting use of your health data.
6. Health data and freedom of choice
Before consent-based health processing is activated, the controller, purposes, data categories and, where applicable, the coach or club that will have access will be explained. Consent must be explicit and recorded.
Consent to sports monitoring does not automatically include AI use of health data, disclosure to an external MCP client, publication in a club or advertising. Each additional purpose requiring it has its own choice.
You can withdraw consent through the available privacy controls or by writing to [email protected]. Withdrawal does not affect previous lawful processing. We will stop the affected new processing and manage the appropriate erasure, restriction or statutory retention. If acting as processor, we will inform the controller of your request and cooperate in its execution.
Refusing an optional feature does not prevent use of the parts of the service that do not need it. If a particular feature necessarily depends on health data, it may be unavailable if you do not give or withdraw that consent. We will not use this to impose unnecessary purposes on you.
7. Coaches, clubs, groups and visibility
Access to your information must be limited to authorised people who need it for the sports service. Club membership does not automatically give all members access to your history, private messages, health data, payments or precise routes.
Organisation administrators may manage membership and access within their authority. Access to detailed sports data must serve a specific and lawful role. Before a publication or ranking visible to others, the data displayed and intended audience will be indicated. Optional participation or visibility may be disabled through the controls offered.
If you change coach or club, the new relationship must not automatically inherit access to the previous relationship's history. New access and its scope must be established. The previous controller may retain only data it must lawfully keep, under its own responsibility and with restricted access where appropriate.
8. AI assistant, analysis and actions
When you interact with the assistant, you will be informed that you are using artificial intelligence. It may interpret instructions, summarise data, explain metrics and propose or execute available actions, such as changes to sessions or planning, within the account's permissions and the feature's scope.
To produce a response, your message, part of the history, contextual references and queried tool outputs may be sent to the AI provider. Those outputs may include sports or health information even if you did not write it in the message. History may contain names or other identifiers: pseudonymising some fields does not automatically make the conversation anonymous.
Authorised providers, countries, retention, permitted use and safeguards are set out in Annex A. No provider will be enabled to process these data without completing its assessment and required safeguards. The platform must minimise data sent, limit access by role and avoid including secrets or information unrelated to the task.
Personal and health data, conversations and outputs obtained to provide the service are not used to train or fine-tune general models, create cross-customer knowledge bases or for advertising. Providers acting on TrainingForever's behalf must be subject to this limitation. Any different project would require its own legal assessment, prior information and the relevant authorisations; this policy does not authorise it.
AI outputs may be incorrect and generate sensitive inferences. They are used as sports support and must be capable of review and correction. They must not be used to make solely automated decisions about access to essential services, insurance, employment or other decisions with legal or similarly significant effects. Ordinary training recommendations do not, by themselves, constitute those decisions, but their actual impact must be assessed.
If processing subject to Article 22 GDPR were to be introduced, its lawfulness would be assessed before activation, information about logic, significance and consequences provided, and applicable rights guaranteed. A general clause or supposed human review that is merely formal is insufficient.
9. Integrations, watches and MCP clients
Connections are activated voluntarily with defined permissions. Before connection, the service, data imported or exported, direction and functions will be identified. Synchronisation may include both planned sessions sent to a compatible service and completed activities sent to TrainingForever, only where the specific connection allows it.
Technical authorisation from a device or external platform does not, by itself, replace consent required for other uses. Not every category from a device is imported merely by connecting it. Provider restrictions must also be respected, even where user consent exists.
If you connect TrainingForever to ChatGPT, Claude or another client through MCP, that client may receive data returned by tools and initiate actions you authorise. The client may keep them in its history and apply its own terms according to its plan and configuration. This flow differs from use of the provider of TrainingForever's integrated assistant.
Before an MCP client is enabled, information about its identity, permissions, data and purpose will be provided. A coach cannot consent on behalf of their athletes to a new disclosure of health data merely because they are their coach. The corresponding authorisation and, where the client acts on their behalf, the necessary contractual chain must exist. Third-party data may not be connected to external accounts lacking these safeguards.
Disconnecting revokes or disables authorisation in TrainingForever and stops the affected new exchanges. For Garmin, the erasure provisions in section 9.1 also apply. For other integrations, disconnection does not itself erase previously imported activities. Copies lawfully received by an external controller are managed under its obligations; you may request their erasure from that recipient. TrainingForever will assist within its remit and fulfil applicable obligations to notify recipients of erasure or rectification.
9.1. Garmin Connect Data
Access and authorisation. If you choose to connect your Garmin account, Trainingforever OÜ accesses fitness and activity data from Garmin Connect, including health data only if you authorise it, through Garmin's official APIs, directly or through Stridee, our synchronisation provider. We read or receive data only after the athlete who holds the account authorises access, and only within the categories and permissions granted and the APIs approved for the integration.
Purposes. We use this data exclusively to provide the TrainingForever features you request: importing, displaying and summarising activities, tracking your training and making it available to you and your authorised coach. If you authorise planned workouts to be sent to Garmin, we communicate only the workouts and data necessary for that transfer. Garmin's own processing is described in its Garmin Connect Privacy Policy.
Retention and disconnection. We store Garmin data securely and only while the connection remains active and the data is necessary for the authorised features, without prejudice to your ability to request earlier erasure. You can disconnect Garmin from your TrainingForever account's connection or integration settings, or revoke access from Garmin Connect. When you disconnect or we receive revocation from Garmin, we stop new exchanges and automatically initiate erasure of associated Garmin data, including derived outputs containing it, from TrainingForever and its processors: without undue delay and within a maximum of 30 days in active systems. Isolated backups are erased within a maximum of 90 days from that erasure; if Garmin requires a shorter period, the shorter period applies. Only the minimum portion required by a specific legal obligation will be retained, blocked and for the required period. General sports history periods do not permit this retention to be extended after disconnection.
No sale or advertising. We do not sell your Garmin data or use or share it for advertising, commercial targeting or audience creation.
Providers acting on our behalf. Stridee and the hosting, storage, communications and AI providers identified in Annex A may process this data solely to the extent necessary to operate the authorised features. When acting on our behalf, they are subject to documented instructions and contractual protection obligations: they do not use Garmin sports content for their own purposes, advertising or to train or improve their models. We do not enable a data flow if the required safeguards are missing.
AI transparency. Only if Garmin's applicable terms permit it and you give explicit, separate and revocable consent may the integrated assistant send necessary Garmin data, together with messages, context and tool outputs, to the OpenAI or Anthropic/Claude APIs to summarise activities, explain metrics or generate requested sports suggestions. You can withdraw this consent through privacy controls or by writing to [email protected]; that AI use will stop without preventing features that do not need it. Connecting Garmin or accepting the terms does not constitute consent to this use.
External MCP clients. We do not send Garmin data to an external MCP client without identifying the recipient, obtaining your specific authorisation and checking compatible safeguards for purpose limitation, no model training and erasure. If these cannot be guaranteed, that flow is not enabled. Authorisation for the integrated assistant does not itself cover these connections.
10. Recipients and providers
Data may be processed by:
We do not sell personal data or use health information, injuries, sensitive location or health device information for advertising targeting. We do not provide health histories to club sponsors or advertisers merely because you participate in an activity.
Where a provider acts as processor, the corresponding contract will be formalised and it may process data only according to instructions. Entities acting as independent controllers must provide their own information. Annex A specifies the authorised entities and functions.
11. Processing outside the European Economic Area
Locating a server in Europe does not exclude access from other countries for support, administration, AI or subcontracting. Annex A identifies the relevant storage and access countries.
An international transfer will occur only where there is a current adequacy decision covering the recipient and processing, or valid safeguards such as applicable standard contractual clauses, transfer assessment and necessary supplementary measures. Certification must be checked for the specific entity and service. Registration consent is not used as blanket authorisation for routine transfers and does not replace these safeguards.
You can request information and a copy of applicable safeguards by writing to the privacy contact. Trade secrets or other people's data may be protected without preventing you from knowing the essence of the safeguards.
12. How long data are retained
The following periods apply to TrainingForever's own processing. Where we act on behalf of a coach or club, their lawful instructions and DPA periods apply, without turning termination of their subscription into authorisation to reuse data.
If the source provider's authorisation imposes a shorter period or more limited use, that restriction will apply to the corresponding data. The general periods in this policy do not permit extending it.
| Information | Retention criterion and outcome |
|---|---|
| Account and profile | While the account is active and they are necessary. After a valid erasure or closure request, erasure from active systems within a maximum of 30 days, unless specific retention is justified |
| Direct service sports and health history | While you maintain the feature and it is necessary for your requested history; necessity is reviewed and erasure and withdrawal are addressed. It is not kept by default for new purposes |
| Integrated assistant conversations and outputs | Maximum 90 days from the last interaction in each conversation, unless you request earlier erasure. A session or plan you decide to save has its own retention cycle; it does not require retention of the entire chat |
| Data at the AI provider | The specific period for each service stated in Annex A, which may differ from TrainingForever's history |
| Integration tokens | While the connection is active; revoked or disabled on disconnection and erased from active systems, except the minimum record necessary to demonstrate revocation |
| Garmin Connect data | Specific rule in section 9.1: while the connection is active and the data is necessary for authorised features; on disconnection or receipt of revocation, automatic erasure of associated data and derived outputs containing it. Maximum periods of 30 days in active systems and 90 days from that erasure in isolated backups apply, or shorter contractual periods, subject to a specific legal obligation. |
| Ordinary technical logs | Up to 90 days, avoiding messages, health information and complete routes |
| Security logs | Up to 12 months; a specific investigation or claim may justify keeping specific evidence longer, with restricted access |
| Support enquiries | Up to 24 months from closure, unless a specific contractual or legal need exists. Unnecessary health attachments are erased sooner |
| Own invoices and accounting records | Generally, seven years from the end of the relevant financial year under Estonian accounting law; other documents or obligations may require a different calculation, which will be determined specifically |
| Evidence of acceptance, consent and withdrawal | While necessary to demonstrate processing and subsequently during the limitation period applicable to specific liabilities: Pending: plazo y criterio evidencias validado. Minimum evidence is kept, not the entire health history |
| Commercial communications | Until you withdraw consent or the purpose ends; a minimum suppression list may be maintained to respect unsubscribing |
| Backups | Erasure or overwriting within a maximum of 90 days from erasure from active systems; they remain isolated from ordinary use. A restoration must reapply erasures |
| Data subject to a specific claim or legal obligation | Only necessary data, with limited access and until the obligation or liability ends; then erased |
Erasure requests are answered within the periods in section 14, even if an isolated copy subsequently completes its technical cycle. If data must be blocked under applicable law, they will not be used to provide new features, develop models or carry out advertising.
Data fall outside the GDPR only if effectively anonymised, considering the reasonable risk of re-identification. Pseudonymised data, small-group aggregates and recognisable routes may remain personal data. Anonymisation also does not permit circumvention of the source provider's terms.
13. Security
TrainingForever must apply measures proportionate to data risks, including access controls by person and organisation, credential and token protection, encrypted communications, backup management, necessary logs and incident procedures. Staff access is limited to those who need it and are subject to confidentiality.
Exceptional support access to sports or health data must be justified, limited and recorded. Real health data are not freely reused in testing or demonstration environments. Contractual measures for processing on behalf of organisations are described in the DPA.
If a personal data breach makes communication to affected persons necessary, we will communicate without undue delay under the statutory terms. Where acting as processor, we will inform and assist the controller in meeting its own obligations.
14. Your rights and how to exercise them
You can request access, rectification, erasure, restriction, objection and, where statutory requirements are met, portability. You can also withdraw consent and exercise applicable rights concerning automated decisions.
Write to [email protected] from your account email address, stating what you need, or use the available privacy controls. We will verify your identity proportionately; a copy of your identity document is not routinely required. For data processed by a club or coach, you can contact them; we will help route the request.
We normally respond within one month of receipt. If the complexity or number of requests requires it, the period may be extended by up to two additional months, informing you within the first month and explaining why. Exercising rights is free except in exceptional cases provided by law. If a request cannot be granted, we will explain the reasons and complaint routes.
Objection to direct marketing is honoured without requiring justification. For other processing based on legitimate interest, we will assess the circumstances you indicate and cease unless the overriding legitimate grounds or need to establish or defend claims provided by law apply.
You can complain to the authority in the State of your habitual residence, work or place of the alleged infringement. In Spain, the Agencia Española de Protección de Datos; in Estonia, the Andmekaitse Inspektsioon. Registration of the company in Estonia does not, by itself, determine which authority acts as lead authority for all processing.
15. Minors
Contracts must be entered into by a person with sufficient capacity or the entity's authorised representative. Management of minor athletes is permitted only where there is a registration and information procedure appropriate to their age and country, with verification of representation and consent where necessary. Without that procedure, their enrolment will not be enabled.
The age for consenting to certain digital services does not automatically mean capacity to contract or authorisation for any health data processing. The controller must identify who can validly give each authorisation. Information will also be provided to the minor in an understandable manner according to their maturity.
Minors' profiles, routes and health data are not made public by default. The coach or club must limit access and cannot enter those data relying solely on its acceptance of TrainingForever's terms.
16. Necessary data, cookies and changes
Forms must identify mandatory data. Failure to provide them may prevent account creation or provision of the specific feature requiring them. Optional data and features will be identified as such.
The Cookie Policy explains device technologies and how to change your preferences. Accepting this policy does not activate optional technologies.
We will provide information about relevant changes before they apply, unless an obligation or incident justifies different action. Updating the policy does not retrospectively legitimise a use or renew consent. We will request a new choice where necessary.
Annex A. TrainingForever Register of Providers, Integrations and Transfers
Register version: TF-REG-2026-10-29-v2 Last updated: 29 October 2026 Operator: Trainingforever OÜ — Estonian registration 16941437 — contact: [email protected].
1. Scope and interpretation of the register
The register identifies platform providers, measurement tools and connected external services. Each entity's role depends on the operation: processing data on behalf of TrainingForever is different from determining its own purposes or providing an independent service to the athlete.
Where TrainingForever acts on behalf of a coach or club, the providers involved in that processing must also appear in Annex III to the DPA. Tools used for TrainingForever's own marketing and the athlete's independent services do not automatically become that coach's subprocessors.
The entities listed correspond to the relevant standard documentation and must be checked against the contract for each account. A European region for databases, functions or storage does not guarantee that all logs, support access, subcontractors or distribution points are within the EEA. Each provider's list of subprocessors must be reviewed for the services used and retained with the transfer assessment.
“SCCs” means the European Commission's standard contractual clauses for international transfers. Mention of SCCs or an adequacy decision identifies the mechanism to be checked for the particular data flow; it does not replace the contract, assessment or any necessary supplementary measures. Data Privacy Framework certification is not presumed for every entity in a group.
2. Technology and operational providers
| Legal entity and service | Function and role | Data required according to declared use | Storage and countries of access | Transfer safeguard | Retention and terms of use | Documentation |
|---|---|---|---|---|---|---|
| Supabase Pte. Ltd. — Supabase | Database and associated services used by the application. Processor or subprocessor for service data | Accounts, profiles, and sports and health data stored; necessary permissions and logs. The scope of Auth, Storage and functions must be inventoried | Main project in Ireland, declared by the operator. The documentation distinguishes support and affiliate operations, including Singapore and the USA; the project region does not exclude them | DPA and its transfer safeguards; verify the destinations of the services actually used, including affiliates and subprocessors | During the service and in accordance with retention instructions. The DPA provides for a 30-day recovery period after the contractual relationship ends; check per-user erasure, logs and backups according to the plan. | DPA; residency and transfers |
| Vercel Inc. — Vercel | Website/application hosting and backend/API execution. Processor or subprocessor for operations on behalf of the controller | IP address and request data, session data, communications processed by APIs and technical logs. The backend may handle the sports or health data required for the feature; their inclusion in logs is not presumed necessary | Backend/API in the EU/EEA, declared; country and region code pending. Content delivery, logs and support require separate assessment; processing may take place in the USA and other provider destinations | Applicable DPA and SCCs. Check the plan: the public DPA consulted states coverage for Pro and Enterprise; TrainingForever's plan has not been confirmed | According to the relationship, product and log and backup settings. A single retention period for all Vercel data has not been confirmed. | DPA; privacy |
| BunnyWay d.o.o. — Bunny Stream and Bunny Storage | Storage and delivery of videos, images, documents and other files; video playback. Processor or subprocessor for entrusted content | Content uploaded by coaches and athletes, metadata and technical data necessary for access and delivery. Files may contain personal or health data depending on their content | Main storage and replicas only in the EU/EEA, declared. Entity in Slovenia. Specific countries, CDN distribution, caches and remote access pending verification | Account DPA and safeguards required for any flow outside the EEA; absence of transfers cannot be inferred from the main storage location | Content remains according to the controller's instructions and erasure requests; validate erasure cycles, versions and caches. Automatic erasure based on age has not been confirmed. | Privacy; DPA in the account; subprocessors |
| Plus Five Five, Inc. — Resend | Sending transactional and commercial emails. Processor or subprocessor for sent content; distinct processing for its own account and operational purposes | Recipient email and name where included; access, recovery and invitations; notifications; invoices/payments; advertising; training sessions, activities and metrics. The latter may reveal health information | United States for content and logs according to standard documentation. A European sending region does not, by itself, change that storage | SCCs incorporated into the DPA, selecting the appropriate module. Any other mechanism requires verification of the entity and coverage | Standard documentation: messages and logs, 30 days on Free, Pro and Scale; backups, 7 days; remaining data after account termination, up to 90 days. Enterprise may vary. Verify the plan and suitability of health content. | DPA; location and retention |
| Stripe Payments Europe, Limited; Stripe Technology Europe, Limited where it provides regulated financial services — Stripe | Payments, subscriptions and invoicing used. Processor for operations on behalf of the customer and controller for its own purposes, depending on the service; use of the entire catalogue or Stripe Connect is not presumed | Necessary identification, contact, tax, transaction, subscription and payment data; full card details are provided to the provider according to the integration. Exclude health information from descriptions and metadata | Relevant European entities and international processing by the group and its providers, including the USA, depending on the service | DPA and transfer safeguards in the Stripe contract; distinguish operations as processor and as controller | As long as necessary for the service and the regulatory, accounting, fraud prevention and claims periods applicable to Stripe. Closing an account in TrainingForever does not automatically remove its own obligations. | DPA; processing roles; privacy |
| OpenAI Ireland Ltd. — OpenAI API, under standard EEA contracting | Inference for the integrated assistant through a direct API, with no intermediary declared. Processor or subprocessor for request content | Messages, context, history and tool outputs sent, including real athlete data, training sessions and metrics; health information where included in them | No special European residency or zero retention has been declared. Do not limit the flow to the EEA: review processing in the USA and countries in the service chain | OpenAI DPA and safeguards applicable to transfers and subprocessors | No model training by default, unless specifically opted into. Abuse logs: normally up to 30 days with exceptions; state, files, caches and other objects depend on the endpoint and configuration. Do not claim universal erasure after 30 days. | DPA; API data controls |
| Anthropic Ireland, Limited — Anthropic API / Claude, under standard EEA contracting | Inference for the integrated assistant through a direct API, with no intermediary declared. Processor or subprocessor for content | Messages, context, history and tool outputs sent, including real athlete data, training sessions and metrics; health information where included in them | No special European residency or zero retention agreement has been declared. Review the service's processing countries and subprocessors; do not assume processing exclusively in Ireland | Anthropic DPA with SCCs and applicable transfer documentation | The commercial policy consulted indicates ordinary deletion of inputs/outputs within 30 days, with exceptions for features, models, security, law and feedback. No training without express permission according to its commitments. | Commercial terms; DPA; commercial retention |
| Molina Studio, operator of Stridee — Stridee Developer Platform/API | Sending planned workouts and receiving activities and metrics. Processor for the entrusted flow; check the chain where TrainingForever itself acts as processor | Connection identifiers, authorisations and tokens, sessions and activities, and authorised metrics. Routes and wellbeing data only where included within the specific scope | Operator in Switzerland; published OVH SAS infrastructure in Switzerland and the EEA. Do not add hypothetical destinations as though they were active | Swiss adequacy and applicable contracts; assess any onward transfer beyond the published destinations | According to instructions and platform terms. Return request after termination: within 30 days; completion of erasure/return, up to 90 days according to its terms and backups. Request logs: 30 days. Reconcile with TrainingForever's DPA. | Operator; API terms; subprocessors; privacy |
The OpenAI, Anthropic, Google, Microsoft and Stripe entities listed must be checked against the account and accepted regional contract. Provider features that have not been purchased or enabled are not included merely because they appear on product pages.
3. Analytics, tag management, advertising and user experience
TrainingForever has declared use of the following four services also within the authenticated application. The declared scope of events sent is pages, screens, clicks and navigation. This does not make those events anonymous: the technologies may process IP addresses, technical identifiers, cookies, URLs, referrers and device data according to their operation and configuration. Actual traffic and the content of captured pages or links have not been verified.
| Entity and service | Function and role | Data and limits | Countries and safeguards | Retention | Information |
|---|---|---|---|---|---|
| Google Ireland Limited, according to the EEA contract — Google Analytics | Usage measurement. Processor for measurement operations on behalf of TrainingForever; review its own purposes and additional agreements if sharing or advertising features are used | Declared navigation events and technical service data. Exclude health data and identifying data or content not authorised for that product | Processing through Google's chain, potentially outside the EEA, including the USA; check the terms and transfer safeguards applicable to the property | Configured user/event period pending verification. A value of 2 or 14 months is not assigned by assumption. Aggregates and additional features have their own rules. | Google GDPR framework; retention; privacy |
| Google Ireland Limited, according to the EEA contract — Google Tag Manager | Tag management and deployment; distinguish the manager from each recipient activated through it | Container configuration, technical data and variables used in tags. Do not put health information, names or email addresses into the data layer by default | According to the service and tag destinations. The backend location does not determine where those tags receive data | The manager does not establish a single retention period for Analytics, Meta or Clarity. Inventory each tag, cookie, storage key and recipient. | Product information; data protection framework; privacy |
| Meta Platforms Ireland Limited, for the EEA service — Meta Pixel | Advertising measurement and attribution. Assess and apply the joint controllership limited to collection and transmission provided for in the relevant agreement, and Meta's subsequent processing; do not simply classify it as the coach's subprocessor | Declared page/screen events and interactions, together with the tag's technical data. Do not transmit information prohibited by its terms, including health information; also review URLs, titles and events that reveal it | Meta services and possible international transfers, including the USA, with the mechanism and terms actually applicable; verify its regional agreement | Periods specific to Meta's products, purposes and controls; specify event, cookie and audience settings. Do not automatically apply TrainingForever's log retention period. | Business Tools Terms; controller agreement; prohibited information |
| Microsoft Ireland Operations Limited and Microsoft Corporation, according to their functions — Microsoft Clarity | Behavioural analytics and enabled experience features. Microsoft states that it acts as controller | Declared navigation and interactions, together with technical service fields; review rendering, recordings, links and masking. Exclude confidential and health data from captures | Azure and possible service transfers, including processing by Microsoft Corporation in the USA; documentation describes SCCs between the Irish and US entities | The FAQ states ordinary administrator access to data for up to 30 days from recording. This is not a guarantee of erasure of all data for every Microsoft purpose. Review configuration and terms. | FAQ, roles and transfers; terms; Microsoft privacy |
Sports and health data entrusted by a coach or club are not authorised for these measurement or advertising purposes by acceptance of the DPA. The legal basis, information and each entity's role must be analysed for each flow. The essential aspects of any applicable joint controllership arrangement must be made available to data subjects.
4. Sports connections and external clients
#### 4.1. Declared connection map
The following connections are declared active. Stridee synchronisation is bidirectional across the service as a whole: workouts are sent, and activities and metrics are received. This does not establish that each brand allows both directions or all health categories. The scope must be limited to each connection's permissions and capabilities.
| Service and reference entity | Declared route | Information and direction | Role and limits | Service information |
|---|---|---|---|---|
| Garmin / entities responsible for Garmin Connect according to its policy and regional contract | Direct connection and also through Stridee | Workouts and authorised activities/metrics, according to the API and permissions used | Garmin is an independent controller for its own service; Stridee processes the flow on TrainingForever's behalf where that route is used. Access only after athlete authorisation and with approved APIs and permissions. Privacy section 9.1 applies: no sale or advertising, processors without own use or model training, and erasure on disconnection. Identify the entity and authorisations under the integration contract. | Garmin Connect; Stridee / Garmin |
| COROS Wearables, Inc. — COROS | Through Stridee | Data and sessions allowed by the authorised connection | Controller for its own service. Its policy identifies an entity in the USA and a European representative; this does not mean exclusively European storage. Verify the safeguards for the specific flow. | COROS privacy |
| Polar Electro Oy — Polar | Through Stridee | Data and sessions allowed by the authorised connection | Controller for its own service; retention and recipients according to its information, without assuming that the intermediary replaces those terms. | Polar privacy |
| Suunto Oy and entities identified in the applicable policy — Suunto | Through Stridee | Data and sessions allowed by the authorised connection | Controllers for their own service according to their policy. Do not automatically attribute the entire flow to Finland because Suunto Oy is based there. | Suunto privacy |
| Apple Salud / HealthKit — source of device data and permissions | Declared through Stridee; bridging component or application pending documentation | Authorised categories from the device; specify which application reads, transmits or writes each item of data | Mere use of HealthKit does not establish that TrainingForever sends those data to Apple or that Apple is its subprocessor. Identify the actual bridge operator and its recipients before finalising the flow. | HealthKit privacy |
| Strava Ireland Limited for the EEA service, according to contract — Strava | Direct connection | Activity data and other data authorised by the specific permissions and contract. Sending structured workouts to Strava is not presumed | Controller for its own service. Comply with current storage, display, analytics and AI restrictions; document the specific authorisation for the intended use. A Strava route through Stridee has not been confirmed. | API terms; API policy |
The source services' policies govern their own processing. TrainingForever must also provide information about its processing when importing or sending information and about its intermediaries. Disconnecting does not automatically erase all data already received by independent controllers; erasure and notification obligations apply according to each flow. For Garmin data held by TrainingForever or its processors, erasure on disconnection under section 9.1 of the Privacy Policy expressly applies.
#### 4.2. ChatGPT and Claude as user-selected MCP clients
| External service | Possible processing on connection | Role, location and retention | Condition for enabling |
|---|---|---|---|
| ChatGPT — OpenAI entity applicable to the external account | Receive MCP tool responses and request actions within the permissions granted | Depends on the external account's plan, contract, country and configuration. Standard contracting for TrainingForever's integrated API does not determine the history, training or residency of that ChatGPT account | Identify the recipient, data, tools, purpose and configuration; enable disclosure of health and third-party data only with the necessary legal basis and safeguards. |
| Claude — Anthropic entity applicable to the external account | Receive MCP tool responses and request authorised actions | Depends on the external account's plan, contract, country and configuration. Do not apply the integrated API's retention terms to the Claude interface | The same requirements for identification, permissions, data, purpose and safeguards, according to the actual flow. |
These connections are documented separately from the integrated API providers. They do not constitute blanket authorisation to export every athlete's information to any personal account belonging to a coach. Information about the specific plan and recipient must be provided on connection, with a link to its current policy.
5. Updates and enquiries about safeguards
The register will be updated when providers, purposes, countries, data or relevant terms change. Changes to subprocessors for the entrusted processing will also follow the DPA procedure and will not, by themselves, authorise new purposes.
You can request information about the recipients and safeguards applicable to your processing at [email protected]. For selected external services, the corresponding information will be provided on connection and their controllers' policies will also apply.
The list of European Commission adequacy decisions and its information on standard contractual clauses can be used to check safeguards; they do not replace assessment of the particular recipient and service.