Privacy Policy

The data controller for your personal data is Athlo.fit, domiciled in the Autonomous City of Buenos Aires, Argentine Republic.

For any inquiries related to the protection of your personal data, you can contact us at soporte@athlofit.com.ar.

This policy is framed within Law 25,326 on Personal Data Protection, its Regulatory Decree 1558/2001, and the provisions of the Agency for Access to Public Information (AAIP). Data processing is carried out with the consent of the data subject pursuant to Article 5 of Law 25,326.

We collect the following categories of data:

Registration data

• Full name, email address, and date of birth, which we request to verify the minimum age of 18.
• Profile picture (when registering via Google OAuth).

Physical profile data

• Weight, height, sex, training level, and fitness goals.
• Body composition and anthropometric measurements: tape measurements, skinfolds, body fat percentage, lean body mass, body mass index, estimated basal metabolic rate, and waist-to-hip and waist-to-height ratios.
• This data is voluntarily entered by the user and constitutes sensitive data under Law 25.326. It is used solely to calculate and display your metrics, and is not shared with third parties for commercial purposes.

Training data

• Training plans, routines, exercises, and session records, including any free-text notes you write in each session.

Billing data

• Subscribed plan, payment history, and subscription status. If you request an invoice, also your legal name, tax ID (CUIT/CUIL), tax status, and billing address.
• Payments are processed by Mercado Pago. Athlo.fit does not store credit or debit card data.

Technical data

• Session cookie for authentication (see section 7).

Data about people without an account

• Invitations: if a user invites someone, we store that person's email address in order to send the invitation and record whether it was accepted.
• Waitlist: if you leave your email on the waitlist, we store it along with the date you gave consent until you unsubscribe, which you can do from any of those emails.

Your personal data is processed for the following purposes:

• Service provision: managing your account, storing and processing your training data.
• Authentication: verifying your identity when logging in.
• Billing: processing payments and managing subscriptions.
• Service communications: sending notifications related to your account (terms changes, security updates).
• Service improvement: analyzing platform usage in an aggregated and anonymized manner to improve the experience.

The processing of your data is based on:

• Data subject consent (Article 5, Law 25,326): granted at the time of registration.
• Contractual performance: necessary for the provision of the contracted service.
• Legal obligations: retention of billing records in accordance with tax regulations.

Your data is stored in a PostgreSQL database hosted on Neon, located in the AWS sa-east-1 region (Sao Paulo, Brazil). Brazil has an adequate level of personal data protection according to international standards. The other providers listed in section 8 — Vercel, Resend, Sentry, Google and Mercado Pago — process data outside Argentina, including in the United States, under their own contractual data protection commitments.

We implement the following security measures:

• All connections use TLS encryption (HTTPS).
• Sessions are managed using JWT tokens with a 30-day expiration.
• Database access is restricted to platform services.
• We do not store plaintext passwords or credit card data.

Athlo.fit uses the following storage technologies:

Cookies

Local storage (localStorage)

• cookie_consent: stores your cookie consent preferences.
• athlo:last-user-id: stores the internal identifier of your last session on this device so the navigation does not render empty while the session resolves. It is not shared with anyone and is cleared on sign-out.

Analytics cookies (_ga and _ga_64KERJ91QB, from Google Analytics) are optional: they are not set — and Google's script is not even downloaded — until you accept them in the cookie banner, and they are only used on the public pages of the site. We do not use third-party analytics inside your account. Athlo.fit does not use marketing or advertising cookies.

Your data may be shared with the following third parties, exclusively for the indicated purposes:

• Google: authentication via OAuth (if the user chooses this registration method).
• Mercado Pago: payment processing and subscription management.
• Neon / AWS: database hosting.
• Vercel: application hosting, server logs, and performance and usage metrics (the latter only if you accept analytics in the cookie banner).
• Resend: delivery of platform emails — sign-in link, notifications, invitations and waitlist confirmation.
• Sentry: application error reporting. Reports include an internal user identifier so the problem can be diagnosed; contact details, credentials and request contents are stripped automatically before they are sent.
• Google Analytics (Google Ireland Limited / Google LLC): usage metrics for the public pages of the site, only if you accept analytics in the cookie banner. This involves an international transfer of data to the United States. We do not send your user identifier, your email, or your workout contents, and it is not active inside your account.

We do not sell, rent, or share your personal data for advertising or commercial purposes of third parties.

In accordance with Law 25,326, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Cancellation (Deletion): request the deletion of your personal data.
• Opposition: object to the processing of your data for certain purposes.

To exercise any of these rights, send an email to soporte@athlofit.com.ar indicating your name, the email associated with the account, and the right you wish to exercise. We will respond within 10 (ten) business days in accordance with Article 14 of Law 25,326.

The exercise of these rights is free of charge, unless the request is manifestly unfounded or excessive.

• Active account: data is retained while the account remains active.
• Post-deletion: deleting your account closes access immediately and anonymizes your identifying data. After 30 days, your personal data — including health data, training history, and sign-in credentials — is permanently deleted from our database.
• Billing records: invoices are retained in accordance with applicable tax obligations (Law 11,683 on Tax Procedure), detached from your account and stripped of your contact details.
• Technical records: expired email sign-in links are deleted daily, and the notification delivery log is retained for 12 months.

Athlo.fit is intended for people aged 18 and over. We do not intentionally collect data from minors. If we detect that a minor has provided data without parental authorization, we will proceed to delete it.

Athlo.fit may update this privacy policy at any time. Substantial changes will be notified by email at least 30 (thirty) days in advance. The date of the last update is indicated at the beginning of this document.

If you believe that the processing of your personal data violates your rights, you may file a claim with the Agency for Access to Public Information (AAIP):

• Address: Av. Pte. Gral. Julio A. Roca 710, Floor 2, Autonomous City of Buenos Aires.
• Website: www.argentina.gob.ar/aaip

For any inquiries about this privacy policy or the processing of your personal data:

• Email: soporte@athlofit.com.ar
• Legal domicile: Autonomous City of Buenos Aires, Argentine Republic.