As of: September 3, 2026
This privacy policy informs you about the nature, scope, and purpose of the processing of personal data within our website and the mobile application "Athlory".
The data controller within the meaning of the GDPR is:
Helge Busemann
Athlory
Saarlandstraße 1
25421 Pinneberg
Germany
Email: info@athlory.de
Our website offers an AI-powered chatbot that you can use anonymously to ask questions about Athlory. We process the messages you send, a randomly generated session ID stored in your browser, the page URL, the user agent, and a pseudonymised hash of your IP address (SHA-256 with a daily-rotating salt; the IP itself is not stored). The contents of the conversation are sent to Google Gemini (Google Ireland Limited / Google LLC, USA) to generate the response. If you leave your email address, we store it so we can contact you personally; the notification email to our team is sent via Sendinblue SAS (Brevo), France. Legal basis for operating the chatbot is our legitimate interest in efficient pre-sales support (Art. 6(1)(f) GDPR); the basis for storing and using your email in the lead flow is your consent (Art. 6(1)(a) GDPR). Anonymous conversations without an email are deleted after 90 days at the latest; lead data is kept until your enquiry has been handled and is then deleted in line with statutory retention periods. Data transfers to the USA are based on EU Standard Contractual Clauses.
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected (server log files): browser type and version, operating system used, referrer URL (the previously visited page), hostname of the accessing computer, time of the server request, and IP address.
The storage in log files is done to ensure the functionality of the website. Additionally, the data serves us to optimize the website and ensure the security of our information technology systems. The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.
The website is hosted by goneo Internet GmbH, Dresdener Straße 18, 32423 Minden, Germany, where the server log files are also created. Fonts and program libraries are delivered exclusively from this server. No external font services (e.g. Google Fonts) and no content delivery networks are used.
We store your choice in the cookie banner in your browser's local storage (localStorage) so that it is respected on later visits. If you use the AI chatbot, it stores a random session identifier and the history of your chat messages there. The legal basis for this is our legitimate interest pursuant to Art. 6(1)(f) GDPR. Cookies for analytics purposes (Google Analytics) are only set with your express consent (Art. 6(1)(a) GDPR). You can change your choice and withdraw any consent given at any time via “Privacy Settings” (also in the footer of every page).
On our website, you can sign up for our newsletter. For this purpose, we use the Mailchimp service provided by The Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Registration is done via a double opt-in procedure. The email address you enter is transmitted to Mailchimp in the USA for the purpose of newsletter delivery. This is done on the basis of your consent (Art. 6(1)(a) GDPR). Data security is ensured through EU standard contractual clauses. You can revoke your consent at any time by clicking on the unsubscribe link in each newsletter.
If you have consented to the “Statistics” category in the cookie banner, this website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without this consent, Google Analytics is not loaded and no data is transmitted to Google. After consent, Google Analytics sets cookies (_ga, _ga_<ID>) and transmits usage data such as the pages visited and device and browser information; for technical reasons your IP address is transmitted in the process. The data may be transferred to Google servers in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via “Privacy Settings”; after that, the site sends no further data to Google Analytics and the analytics cookies are deleted.
For the live statistics on the home page, the activation of individual page content, the AI chatbot, the newsletter sign-up, studio enquiries as well as sign-in and registration, the website uses our backend at Supabase (Supabase Inc.). When the home page is opened, requests are sent to this backend; for technical reasons your IP address and browser information are transmitted in the process. No cookies are set for this. The legal basis is our legitimate interest in the proper operation of the website (Art. 6(1)(f) GDPR); for the chatbot, newsletter and studio enquiries the respective sections apply in addition.
In the web dashboard for coaches and studios (only after sign-in), the profile contains a map for choosing the location. For this, your browser loads map tiles from tile.openstreetmap.org and determines the address of a saved or selected location via nominatim.openstreetmap.org (both operated by the OpenStreetMap Foundation, United Kingdom). If no location has been saved yet, the dashboard queries the service freeipapi.com to roughly pre-position the map based on your IP address. In the process, your IP address, browser information and the requested map sections or coordinates are transmitted to the respective provider. The legal basis is our legitimate interest in a usable location selection (Art. 6(1)(f) GDPR).
Within the App, we process the following data categories:
| Purpose | Legal Basis |
|---|---|
| Registration and authentication | Art. 6(1)(b) GDPR |
| Provision of app features | Art. 6(1)(b) GDPR |
| Personalized training and nutrition advice (AI) | Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent) |
| Communication (chat) | Art. 6(1)(b) GDPR |
| Sharing with coaches | Art. 6(1)(b) GDPR |
| Analysis and improvement of the App | Art. 6(1)(f) GDPR |
Service emails from the app. When you use Athlory, we send you emails that are part of using the service: reminders of due check-ins and health questionnaires (anamneses), invitations, contract documents and, for coaches, a weekly report. The emails are sent by Sendinblue SAS (Brevo), France, as a processor. For this purpose Brevo receives your email address, the subject and the content of the message, and stores delivery logs for one month. For technical reasons, Brevo adds a tracking pixel to every email. It is used to count how many emails have been opened. We have configured this counting so that it is not attributed to you personally; no profile of your reading behaviour is created. This counting cannot be switched off at Brevo. The legal basis for sending the emails is the performance of the user agreement (Art. 6(1)(b) GDPR). You can unsubscribe from reminder emails in the app or via the unsubscribe link in every email.
When you scan a barcode or search for a product in the app, the app queries the free product database Open Food Facts (Open Food Facts, association under French law, France) directly from your device to display nutrition facts and product information. For technical reasons the scanned barcode or search term, your device's IP address and an app identifier (user agent) are transmitted to Open Food Facts; no user account and no name are transmitted. The legal basis is the provision of the app function you requested (Art. 6(1)(b) GDPR). Open Food Facts privacy notice: world.openfoodfacts.org/privacy. License information for the product data is available in the imprint under "Data Sources & Licenses".
Wherever you talk to an AI system in the app (AI coach, AI support, website chat), this is labelled as AI; in the support chat you can see whether the AI or the support team is currently answering. AI-generated images (e.g. exercise and recipe images, AI-edited product photos) are generated with a machine-readable mark in the image file – older existing images are being updated step by step – and carry a discreet visible “AI” indicator in the app. AI-generated recipes, plans and analyses are suggestions that may contain errors and do not replace medical, nutritional or sports-medical advice.
If data is transferred to service providers outside the EU/EEA (e.g., USA), we ensure an adequate level of data protection by concluding EU standard contractual clauses.
We store your personal data only as long as necessary to achieve the respective purposes or as required by legal retention periods.
You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to withdraw consent at any time (Art. 7).
In the app: You can delete your Athlory account yourself at any time: in the Athlory app, open Settings via the profile picture at the top right and select "Delete Account". In the coach dashboard the same option is available in your profile under "Delete Account". After your confirmation, the account and the associated personal data are deleted.
Without access to the app: If you no longer have the app installed or can no longer sign in, send us an email to info@athlory.de with the subject "Delete account" and the email address of your Athlory account. We will then delete your Athlory account and the associated personal data. To protect against unauthorised deletion, verification of the account may be required before we process the request.
Deleted are your Athlory account and the personal data stored with it, unless a statutory retention obligation applies; the periods are listed above under "2. Storage Period". Independently of this, you can withdraw consent you have given (e.g. for cookies or the newsletter) at any time with effect for the future.
We reserve the right to adapt this policy. The current version can always be found on our website. Significant changes will be announced via email.
For questions about data protection, please contact us at info@athlory.de.
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.