Privacy policy

1. Data controller

The data controller is AXION FIT S.L. (hereinafter, 'AXION'), with registered address in Spain, reachable at hola@axion.com.es. AXION processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD).

2. Data we collect

Identity and contact data: name, surname, email address and, optionally, profile photo.

Training and performance data: workouts, sessions, progress metrics, personal records, measurements and any other information you or your coach enter into the platform.

Technical data: IP address, browser type, operating system, device identifiers and navigation logs, collected automatically to ensure security and proper functioning of the service.

Payment data: billing information is processed directly by our payment provider (Stripe) and is not stored on AXION servers.

3. Purpose and legal basis

Provision of the service (Art. 6.1.b GDPR — performance of a contract): creating and managing your account, enabling the coach–athlete relationship, delivering training plans, tracking progress and sending in-app notifications.

Legitimate interest (Art. 6.1.f GDPR): detecting fraud, ensuring platform security, performing anonymised analytics to improve the service, and sending transactional communications related to your account.

Legal obligation (Art. 6.1.c GDPR): keeping invoicing records and complying with applicable tax and accounting regulations.

Consent (Art. 6.1.a GDPR): sending commercial communications and newsletters. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Data retention

Your data is kept for as long as your account is active or as necessary to provide the service. Once you delete your account, personal data is erased within 30 days, except where retention is required by law (e.g., invoicing records, kept for 5 years under Spanish tax law).

5. Recipients and transfers

Your data is shared only with the service providers strictly necessary to operate the platform: Supabase (database and authentication, EU region), Stripe (payment processing) and Vercel (hosting, EU region). All providers act as data processors under written agreements that include the standard contractual clauses required by GDPR.

We never sell, rent or share your data with third parties for advertising purposes.

Within the platform, a coach can only access the data of the athletes who have explicitly accepted their coaching relationship. Athletes cannot access data belonging to other athletes.

6. Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access to the database is governed by Row Level Security (RLS) policies enforced at the database layer, so no application-level bug can inadvertently expose one user's data to another. We perform regular security audits and vulnerability assessments.

7. Your rights

Under GDPR and LOPDGDD you have the right to: (i) access your personal data; (ii) rectify inaccurate data; (iii) erase your data ('right to be forgotten'); (iv) restrict processing; (v) data portability in a machine-readable format; (vi) object to processing based on legitimate interest; and (vii) not be subject to solely automated decisions that produce significant legal effects.

You can exercise most of these rights directly from the Settings section of your account. For any other request, write to us at hola@axion.com.es. We will respond within 30 calendar days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Cookies

AXION uses strictly necessary cookies for authentication (session token) and security (CSRF token). No third-party advertising or tracking cookies are used. You can manage or delete cookies through your browser settings at any time.

9. Changes to this policy

We may update this policy to reflect changes in the law or our practices. When we make material changes, we will notify you by email and display a notice in the app at least 15 days before the changes take effect. The date of the last update is shown at the top of this document.

10. Contact

For any privacy-related question or to exercise your rights, contact our Data Protection team at hola@axion.com.es.