Privacy Policy

We collect the following categories of personal data: Account information: Name, email address, profile picture (provided via Google, Apple, or Microsoft sign-in through Clerk). Training data: Workout sessions (planned and actual), training metrics (heart rate, pace, power, cadence), wellness reports, competition schedules, and injury records. Methodology data: Coaching philosophy, zone systems, periodization rules, communication style preferences, and other methodology documents you create. Integration data: If you connect a Strava account (or another supported platform), we read your activities from there to import them into FORMA. We do not send or share this data back or with anyone else. Payment information: Billing details for your FORMA subscription are processed by Stripe and are not stored on our servers. Integration credentials: Access tokens for connected services (e.g. Strava) are stored encrypted (AES-256-GCM) and used solely to sync your training data. Usage data: Pages visited, features used, error logs, and performance metrics.

We use your data to: Provide the core service: Generate AI-powered training plans, analyse sessions, and deliver coaching insights — all grounded in your methodology. Process AI requests: When you or your coach use FORMA's AI features (e.g. the coaching chat), the relevant training and methodology data is sent to Anthropic's Claude API to generate the response. Anthropic does not retain or use this data to train its models beyond that request. Sync integrations: Import your activities from Strava (if connected) into FORMA. Process payments: Handle FORMA subscription billing through Stripe. Improve the platform: Analyse usage patterns to improve features and fix issues. Communicate: Send transactional emails (session reports, account notifications) from our own mail servers.

Your data is stored on Neon PostgreSQL (serverless) with connections encrypted via TLS. The application runs on Azure Container Apps in European data centres. All data in transit is encrypted via HTTPS/TLS. Sensitive data at rest (integration tokens for services like Strava) is encrypted with AES-256-GCM using per-user derived keys (HKDF). File uploads (profile images, attachments) are stored in Azure Blob Storage with server-side encryption.

We use the following third-party services that may process your data: Clerk: Authentication and user management. Processes your name, email, and sign-in provider data. Privacy policy: clerk.com/legal/privacy. Anthropic: AI processing. When FORMA's AI features are used, the relevant training and methodology data is sent via the platform's API key to generate plans and analysis. Anthropic does not retain data from API requests. Privacy policy: anthropic.com/privacy. Stripe: Payment processing. Handles your FORMA subscription billing. Privacy policy: stripe.com/privacy. Email provider: Transactional email delivery (session reports, account notifications). Processes email addresses and message content. Sentry: Error monitoring. Collects technical error data and performance metrics. Privacy policy: sentry.io/privacy. Strava: Activity sync (read-only, only if you connect your account) — we import your workouts from Strava; nothing is sent back to Strava or shared with anyone else.

FORMA uses essential cookies for authentication (managed by Clerk) and session management. We do not use advertising or tracking cookies. Authentication cookies: Required for sign-in functionality. Cannot be disabled. Preference cookies: Store your language and theme preferences. Functional only.

As FORMA is based in Spain, we comply with the EU General Data Protection Regulation (GDPR). You have the right to: Access: Request a copy of all personal data we hold about you. Rectification: Correct inaccurate personal data. Erasure: Request deletion of your personal data ("right to be forgotten"). Portability: Receive your data in a structured, machine-readable format. Restriction: Request we limit how we process your data. Objection: Object to processing based on legitimate interests. Withdraw consent: Where processing is based on consent, you can withdraw at any time. To exercise any of these rights, contact us at privacy@formalabs.es. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

Active accounts: Data is retained for the duration of your subscription. Cancelled accounts: Your data remains accessible for 30 days after cancellation to allow for re-activation. After 30 days, personal data is deleted. Anonymised, aggregated data may be retained for analytics. API keys: Deleted immediately upon account deletion or when you remove the key. Payment records: Retained as required by Spanish tax law (minimum 5 years).

For privacy-related inquiries: Email: privacy@formalabs.es Data Protection Officer: privacy@formalabs.es FORMA Spain