Privacy Policy

AtletaClub is a platform used by sports coaching businesses to manage athletes, plans, payments, race calendars and communication. This policy explains what we do with the personal data that goes through it.

One distinction matters, because it changes who you should contact: the coaching business decides which athletes to register and what information to record about them. AtletaClub provides the tool and processes that data following the coaching business instructions. Under the Brazilian General Data Protection Law (LGPD), the coaching business acts as the controller of its athletes data, and AtletaClub acts as the processor.

For the coaching business own data, and for the operation of the platform itself, we are the controller.

We are based in Brazil and this policy is governed by Brazilian law. The Portuguese version is the original; this translation is provided for convenience.

We only collect what the platform needs in order to work. Specifically:

Account and access

• Name and email of anyone who creates an account, whether a coaching business or an athlete.
• Password, always stored as a cryptographic hash. We have no access to your password in plain text, and nobody here can read it.
• Role on the platform (coaching business or athlete) and which coaching business the account belongs to.

Athlete data, provided by the coaching business or by the athlete

• Date of birth and experience level.
• Status within the coaching business: active, paused or cancelled.
• Training and performance references, when used: threshold power, threshold, maximum and resting heart rate, and threshold pace.
• Planned workouts and completed workout records, with date and activity metrics.
• Messages exchanged in the chat between athlete and coaching business.
• A testimonial, if the athlete chooses to write one. It only appears on the public page after the coaching business approves it.

Payments

• Amounts, dates, and the status of charges and subscriptions.
• Card data never touches our servers. Payments are processed by Stripe, which receives card details directly from your browser. We only store identifiers returned by Stripe, so we know which payment belongs to which charge.

Technical data

• A session cookie, required to keep you signed in. It is a strictly necessary, httpOnly cookie that page JavaScript cannot read. We do not use advertising or cross-site tracking cookies.
• Server access logs, used to diagnose failures and detect abuse.

The platform lets you connect accounts from external services, by your own choice. None of this happens automatically: every connection requires you to authorize it on the service own screen.

Garmin

If you connect your Garmin account, we start receiving from Garmin the activity and health data you authorized, such as completed workouts, duration, distance, heart rate and other activity metrics.

• We use this data exclusively to show your progress to you and to your coaching business inside the platform.
• We do not sell Garmin data, we do not use it for advertising, and we do not share it with third parties beyond what is necessary to operate the service.
• You can disconnect your Garmin account at any time from your dashboard. On disconnection, we delete the access token and the data we received from Garmin.
• If Garmin informs us that you revoked authorization, we treat it as a disconnection and delete the data the same way.

Other training services

The same applies to Intervals.icu, Strava and TrainingPeaks: we only receive data if you connect, we use it only for the service, and disconnecting removes both the access and the corresponding data.

Instagram

A coaching business may connect its own Instagram account to display recent posts on its public page. This involves the business account, not athlete accounts, and we only read the posts and the username of the connected profile.

In every case, credentials for these services are stored encrypted in our database, never in plain text.

• To provide the platform: authenticate your access, show your plan, your workouts, your charges and your conversation with the coaching business.
• To process payments and keep the billing history.
• To send operational notices related to the service, such as payment confirmation.
• To keep the platform secure: detect unauthorized access, abuse and failures.
• To comply with legal obligations, including retention of tax records.

We do not sell personal data. We do not use athlete or coaching business data for advertising, ours or anyone else.

We share data only with those necessary for the service to work, and only what each purpose strictly requires:

• Your coaching business. If you are an athlete, the business you are linked to can see your account, training, billing data and the messages exchanged with it. That is the purpose of the service.
• Stripe. Payment processing.
• Railway. Application and database hosting.
• Cloudflare. Domain routing and attack protection.
• Garmin, Intervals.icu, Strava, TrainingPeaks and Meta. Only when you connect one of these accounts, and only what the integration needs to work.
• Public authorities, when required by law or court order.

• Performance of a contract, for everything required to deliver the service you signed up for.
• Consent, for integrations with external services, which only happen if you authorize them and which you can revoke at any time.
• Compliance with legal obligations, for tax and payment records.
• Legitimate interest, for platform security and fraud prevention.

Brazilian data protection law gives you, among others, the right to confirm that we process your data, access it, correct it, request anonymization or deletion, request portability, know who we share it with, and withdraw consent.

If you are an athlete, the fastest path is to talk to your coaching business, which controls your registration. If you prefer, or if you get no response, write to privacidade@atletaclub.com.br and we will forward or handle it directly, as appropriate.

If you are a coaching business, use the same address. We respond within 15 days.

• While your account exists, we keep the data needed for the service to work.
• When you disconnect an integration, the data received from it and the stored credentials are deleted.
• When an account is closed, we delete or anonymize personal data, except what the law requires us to keep, such as tax records of payments.
• Technical access logs are kept for the period required by the Brazilian Internet Civil Framework.

To request deletion of your account and your data, write to privacidade@atletaclub.com.br.

• All traffic between you and the platform is encrypted in transit (HTTPS).
• Passwords are stored as hashes, never in plain text.
• Credentials for connected services, such as Garmin and Instagram, are encrypted at rest in the database.
• Each coaching business can only see its own data. Isolation between businesses is enforced at the data layer, not only in the interface.

No system is immune. If a security incident occurs that may pose relevant risk to you, we will notify you and the Brazilian data protection authority, as required by law.

Our infrastructure and that of our providers may be located outside Brazil. This means your data may be transferred to and stored in other countries. We do this with providers that offer protection guarantees compatible with Brazilian law.

The platform is not intended for children under 13. Between 13 and 18, registration must be made with the consent and supervision of parents or guardians, through the coaching business. If we identify a child registered without appropriate consent, we will delete the data.

We may update this text. When a change is significant, we will announce it through the service channels before it takes effect. The date at the top always reflects the last revision.

Privacy questions, requests about your data, or anything else in this policy: privacidade@atletaclub.com.br.