Privacy Policy

The controller of your personal data is:

This policy explains how we process personal data under the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD). For any privacy question or request, write to thebenchview2026@gmail.com.

• Account: name, email address and password (stored only in encrypted/hashed form by our authentication provider). If you sign in with Google, we receive your name, email and Google account identifier.
• Subscription and billing: plan, status and dates, Stripe customer and subscription identifiers, billing name and address, country, tax ID if you provide it, and invoices. Card or UPI details are handled by Stripe; we never receive them in full.
• Training and usage: courses unlocked, lesson and session progress, streaks, physical sessions completed, pages and content viewed (linked to an anonymous session identifier), and the language you use.
• Physical training profile: age range or declared age, level, goals, available equipment, and your answers to the health questionnaire and any discomfort or injury you declare (see section 5).
• AI coach: the questions you send and the lesson context needed to answer them.
• Communications: messages you send to support, and your newsletter subscription if you sign up.
• Technical data: IP address, the country derived from it, browser and device type, and server logs.
• Cookies and similar technologies: see our Cookie Policy.

• Providing the platform and your account (courses, progress, physical sessions, AI features, support): performance of our contract with you (Art. 6(1)(b) GDPR).
• Payments, invoices and accounting/tax records: contract and legal obligations under Spanish tax and commercial law (Art. 6(1)(b) and (c)).
• Showing regional prices (section 4): our legitimate interest in offering prices adapted to each country and preventing misuse, and steps taken at your request before subscribing (Art. 6(1)(f) and (b)).
• Personalised physical plans using health data (section 5): your explicit consent (Art. 9(2)(a)).
• Service emails (account, payments, invoices, important changes): contract. Newsletter: your consent; you can unsubscribe at any time from the link in each email.
• Audience statistics with Google Analytics: your consent (Art. 6(1)(a)).
• Usage analytics of the training tools (only when you are signed in): when you open the home physical training or the tactical courses we record which tool you opened, the page, roughly how long it stayed open in the foreground (counted in 30-second intervals while the tab is visible) and the sessions or modules you complete. We use it to understand which features are useful and to improve them. Legal basis: our legitimate interest in measuring and improving the service you use (Art. 6(1)(f)). It is linked to your account, kept for up to 24 months, never shared with advertisers, and uses no additional cookies or third-party tools. You can object at any time by writing to thebenchview2026@gmail.com.
• Emails about the platform (for example, important product news such as new tools) to people who registered or subscribed: our legitimate interest, as a commercial communication about our own similar services to existing users (Art. 21.2 of Spanish Law 34/2002, LSSI). Every such email includes a one-click unsubscribe link, and you can also object by writing to us.
• Security, fraud prevention and abuse prevention (for example, checking that the free trial is used once per person): our legitimate interest.
• Handling claims and defending our rights: our legitimate interest.

We do not sell your personal data and we do not use it for third-party advertising. We do not take decisions with legal or similarly significant effects about you based solely on automated processing.

Our prices depend on your country. To work it out, when you visit the website (and again at checkout) our server sends your IP address to an IP geolocation service — api.country.is and, as a fallback, ipapi.co — which returns only the country code. If our hosting provider supplies the country directly, no lookup is made.

• We keep only the resulting country code, in the tbv_country cookie (and how it was obtained, in tbv_country_src), so that the lookup is not repeated on every visit. We do not store your IP address for this purpose.
• At checkout the country is checked again on the server; it is also recorded with your subscription and invoice because it determines the price and the VAT treatment.
• Legal basis: legitimate interest and pre-contractual steps (see section 3). You can object by writing to us; in that case we cannot guarantee that the regional price for your country is shown.

To create safe personalised physical plans we ask for your age, a health questionnaire (PAR-Q) and any discomfort or injury you want to declare. This is health data, a special category of personal data.

• We only process it with your explicit consent, which you give when you complete the physical training setup. It is optional: without it, personalised physical plans are not available, but the rest of the platform is.
• It is used only to decide whether personalised plans are safe for you and to adapt them. We store the date and version of the safety disclaimer you accepted.
• Only a minimal summary (for example, whether recent discomfort was reported) is used by the AI features; your questionnaire answers are not sent to them.
• You can withdraw consent at any time by writing to thebenchview2026@gmail.com. We will then delete your health data, keeping only the record of the consent you gave as evidence.

Some features use AI models from OpenAI, accessed through Replit’s AI integrations service. Depending on the feature, the following may be sent to the model:

• AI coach (lesson questions): your question and the lesson context; a summary of your physical safety status so that answers stay safe.
• Daily coach messages: training streak, sessions completed, recent session history and coach relationship state.
• Physical session selection: age range, level, goal, session length, equipment and the list of eligible exercises.
• Translations: texts of the interface and content (not your personal data).

We do not include your name or email address in these requests; internal identifiers are used instead. If you use voice input, speech recognition is performed by your browser or device. Legal basis: contract. See our AI Policy.

We use the following service providers, which process data on our behalf (processors) or, where indicated, as independent controllers:

• Supabase — database, authentication and file storage.
• Replit — website and server hosting, and access to AI models.
• OpenAI — AI models (section 6).
• Stripe — payment processing, subscriptions and customer portal. Stripe also acts as an independent controller for fraud prevention and its legal obligations.
• Resend — sending account, invoice and newsletter emails.
• Google — Google Analytics (audience statistics), YouTube (embedded videos) and, if you choose it, Google sign-in.
• api.country.is and ipapi.co — IP geolocation to determine your country (section 4).
• jsDelivr — content delivery network that serves the icon font; like any web server, it receives your IP address.

We may also disclose data to the Spanish tax authorities, our tax adviser, banks, courts or other authorities when required by law.

Some of these providers (for example Replit, OpenAI, Resend, Google, Stripe and the geolocation services) are based in, or process data in, the United States or other countries outside the European Economic Area. Our database is hosted by Supabase in the United Kingdom. Where data is transferred outside the EEA, it is protected by a European Commission adequacy decision (such as those for the United Kingdom and for US companies certified under the EU-US Data Privacy Framework) or by the Commission’s Standard Contractual Clauses. You can ask us for more information at thebenchview2026@gmail.com.

• Account and training data: while your account exists. When you ask us to delete it, we delete or anonymise it within 30 days, except data we must keep by law.
• Invoices and billing records: for the periods required by Spanish tax and commercial law (generally 6 years).
• Health data: until you withdraw consent or delete your account.
• Usage statistics: up to 2 years.
• Newsletter: until you unsubscribe.
• Support messages: as long as needed to handle your request and any resulting claim.

You can request access to your data, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interest, and withdraw any consent at any time (without affecting earlier processing). Write to thebenchview2026@gmail.com from your account’s email address; we may ask you to confirm your identity and will reply within one month.

• All connections use HTTPS/TLS encryption.
• Passwords are stored only as secure hashes by our authentication provider.
• Payments are handled by Stripe, a PCI-DSS certified provider.
• Access to the database is restricted, and the administration tools are limited to the account owner.

The platform is intended for people aged 12 or over. If you are under 12, do not create an account.

• Ages 12–15: before we use health data for personalised physical training, we ask for the name and email of a parent or legal guardian and send them a confirmation email. Training stays blocked until they confirm on our page (Art. 8 GDPR and Art. 7 of the Spanish Organic Law 3/2018, LOPDGDD). If they refuse, we delete the health answers that had been entered.
• As evidence of the consent we keep the guardian's name and email and the dates of the request and of their answer, for as long as the account exists. The guardian can withdraw consent, or ask us to delete the minor's data, at any time by writing to thebenchview2026@gmail.com.
• Ages 16–17: you can consent to the use of your data yourself, but you need the permission of a parent or legal guardian to buy a subscription.
• Plans for users under 18 have reduced intensity; under-16s train only with bodyweight, in shorter sessions and with fewer jumps.

If we learn that we hold data of a child under 12, or of a user aged 12–15 without valid consent, we will delete it.

We will update this policy when our processing changes (for example, new providers). Significant changes will be announced on the website or by email. The date of the latest version is shown at the top of this page.