Privacy policy

1. Data controller and processor

The data controller is AXION FIT S.L. (hereinafter, 'AXION'), with registered address in Spain, reachable at hola@axion.com.es. AXION processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD).

AXION is the controller of your own account, of billing, of security logs and of usage analytics. For the data of a coach's clients (workouts, measurements, health data, messages), the coach is the controller and AXION acts as processor on the coach's behalf under article 28 GDPR.

2. Data we collect

Identity and contact data: name, surname, email address and, optionally, profile photo.

Training and performance data: workouts, sessions, progress metrics, personal records, measurements and any other information you or your coach enter into the platform.

Health data: weight, height, body fat, heart rate, injuries, ailments, body progress photos, meal records and daily feelings. They are a special category of data (article 9 GDPR). We only process them with your explicit consent, which we ask for separately from these documents and which you can withdraw at any time from your profile. Withdrawing it deletes your biometrics, injuries, progress photos and self-reports; your account and your training history stay.

Schedule, message and payment data: bookings for sessions and classes, messages between the coach and their clients, and the payments the coach records to keep track of them. AXION does not process those payments; it only stores the record the coach enters.

Data sent to Axion AI: when a coach uses Axion AI, the text of the request and the information needed for the task are sent to the AI providers listed in section 5. That can include a client's training data, goals, injuries and the files the coach attaches (for example a PDF or a photo of a workout).

Spot reservation data: if you reserve a spot from the website, we store your name, your email, the plan you choose and the approximate size of your business (clients and coaches) to contact you about the beta.

Technical data: IP address, browser type, operating system, device identifiers and navigation logs, collected automatically to ensure security and proper functioning of the service.

Usage data (only if you accept analytics cookies): pages viewed, taps, scroll depth and recordings of your navigation in which all text, inputs and images are masked, so what you write or the photos you see are not recorded. The live workout screen is not recorded.

Payment data: billing information is processed directly by our payment provider (Stripe) and is not stored on AXION servers.

3. Purpose and legal basis

Provision of the service (Art. 6.1.b GDPR, performance of a contract): creating and managing your account, enabling the coach-athlete relationship, delivering training plans, preparing proposals with Axion AI, tracking progress and sending in-app notifications.

Legitimate interest (Art. 6.1.f GDPR): detecting fraud, ensuring platform security and sending transactional communications related to your account.

Legal obligation (Art. 6.1.c GDPR): keeping invoicing records and complying with applicable tax and accounting regulations.

Consent (Art. 6.1.a GDPR and art. 22.2 of the Spanish LSSI): analytics, session recording and advertising cookies, and commercial communications and newsletters. Explicit consent (Art. 9.2.a GDPR) for health data. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Data retention

Your data is kept for as long as your account is active or as necessary to provide the service. Once you delete your account, personal data is erased within 30 days, except where retention is required by law (e.g., invoicing records, kept for 5 years under Spanish tax law).

5. Recipients and transfers

Your data is shared only with the service providers needed to operate the platform: Supabase (database, authentication and file storage, EU region); Vercel (hosting); Stripe (payment processing); Resend (transactional emails); Cloudflare (bot protection on forms); Google (Google Analytics and Google Ads measurement, with your consent, and Gemini AI models); PostHog (product analytics, EU region, with your consent); and, as fallback AI providers for some tasks, Anthropic and Groq. These providers act as data processors under data processing agreements.

Some of these providers may process data outside the European Economic Area, mainly in the United States. In that case the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or on standard contractual clauses.

We never sell your data. Advertising cookies are only used if you accept them.

Within the platform, a coach can only access the data of the athletes who have explicitly accepted their coaching relationship. Athletes cannot access data belonging to other athletes.

6. Artificial intelligence

Axion AI is an artificial intelligence assistant for coaches. It prepares drafts and proposals (programs, diets, messages, analyses); the coach reviews and approves them before they reach a client. AXION does not take decisions with legal or similarly significant effects on you using solely automated means.

To produce an answer, the data described in section 2 is sent to the AI providers listed in section 5, which return the result. Do not enter in Axion AI more information than the task needs.

7. Security

Data is encrypted at rest and in transit (TLS). Access to the database is governed by Row Level Security (RLS) policies enforced at the database layer, so each user can only reach the data they are entitled to. We review the security of the platform periodically and fix the vulnerabilities we find. No system is completely secure; if a breach affects your data we will notify you and the authority as the law requires.

8. Your rights

Under GDPR and LOPDGDD you have the right to: (i) access your personal data; (ii) rectify inaccurate data; (iii) erase your data ('right to be forgotten'); (iv) restrict processing; (v) data portability in a machine-readable format; (vi) object to processing based on legitimate interest; and (vii) not be subject to solely automated decisions that produce significant legal effects.

You can exercise most of these rights directly from your profile: download all your data, withdraw the health data consent and delete your account. For any other request, write to us at hola@axion.com.es. We will respond within 30 calendar days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Cookies

Strictly necessary cookies (session, security and the cookie that remembers your cookie choice, axion_consent, kept for 365 days) are always active.

Analytics cookies (Google Analytics: _ga, _gid; PostHog: ph_*_posthog), including the masked navigation recordings, and marketing cookies (Google Ads) are only set if you accept them in the cookie banner. You can change or withdraw your choice at any time with the 'Cookie settings' link in the footer of our website. You can also manage or delete cookies in your browser.

10. Changes to this policy

We may update this policy to reflect changes in the law or our practices. When we make material changes, we will notify you by email and display a notice in the app at least 15 days before the changes take effect. The date of the last update is shown at the top of this document.

11. Contact

For any privacy-related question or to exercise your rights, contact our Data Protection team at hola@axion.com.es.