Privacy Policy

This policy explains what 8stations.ai collects, why, who we share it with, and the rights you have wherever you live. It applies under the EU and UK General Data Protection Regulation (GDPR) and other applicable data-protection laws, including those in the USA, Canada, Australia, Brazil, the Middle East and Asia.

1. Who is the controller

The data controller is [operator legal name], [registered address], [company / IČO no.]. Contact for any privacy matter: team@8stations.ai.

2. What we collect

• Account & identity: name, email, and login method (email or Google).
• HYROX & athlete data: the races you import (results, splits, rankings), and the athlete profile, goals and training feedback you provide.
• Training data: generated plans, logged workouts, distances, times and your feedback.
• Billing: subscription status and the card/billing details you enter, which are processed and stored by Stripe. We do not store full card numbers.
• Technical & usage: device/browser data, IP, and product analytics events (only if you consent to analytics cookies).
• Communications: messages and lead/coaching enquiries you send us.

3. Why we use it & legal basis

• To provide the service (import & analyse races, generate AI reports and plans, run your subscription): performance of our contract.
• Analytics & product improvement: your consent (cookie banner) and our legitimate interest in improving the product.
• Security, fraud prevention & legal compliance: legitimate interest and legal obligation.

We never sell your personal data.

4. Billing

When you subscribe, your card and billing details are collected and processed by Stripe, and your chosen plan is charged immediately at checkout. There is no free trial. We do not store full card numbers. Stripe holds your payment data under its own privacy terms.

5. Who we share it with (processors)

We use a small set of trusted providers, each only to deliver their function:

• Supabase: database, authentication and storage (EU region).
• Anthropic: the AI that generates your analysis, plans and chat replies.
• Stripe: subscription payments and billing.
• hyresult.com: public HYROX results we read to import your races and compute field benchmarks.
• PostHog & Google Analytics: usage analytics (only with your consent).
• Resend: transactional and notification emails.

6. AI processing

AI features send your race and athlete data to our AI provider (Anthropic) to generate reports, predictions, plans and coaching replies. Our AI provider processes this data to return your result and, under its commercial terms, does not use it to train its models. AI output may be inaccurate. See our Terms for the full disclaimer.

7. International transfers

We operate globally, so your data may be processed in the EU, the United States and elsewhere depending on the provider. Where data leaves your region, transfers are protected by appropriate safeguards such as Standard Contractual Clauses, an adequacy decision, or an equivalent legal mechanism recognised under your local law.

8. How long we keep it

We keep your data for as long as your account is active. When you delete your account, your personal data is deleted, except where we must retain limited records to meet legal obligations (e.g. billing/tax records).

9. Cookies

We use essential cookies to run the service, and analytics cookies only with your consent. Manage your choice via the cookie banner or see our Cookie Policy.

10. Your rights

Wherever you live, you can access, correct or export your data with one-click export and account deletion in Settings, withdraw analytics consent at any time via the cookie banner, and email team@8stations.ai to exercise any right described below. We do not charge you for exercising your rights and we will not treat you differently for doing so.

11. Your rights by region

EU/EEA & UK

Under the GDPR you have the right to access, rectification, erasure, data portability, restriction of processing, and to object to certain processing. You may withdraw consent at any time and lodge a complaint with your local supervisory authority (in the Czech Republic, the Úřad pro ochranu osobních údajů, uoou.gov.cz; in the UK, the Information Commissioner's Office, ico.org.uk).

California & other US states

Under the CCPA/CPRA and similar state laws you have the right to know what we collect, to delete it, and to correct it, as well as the right to opt out of the "sale" or "sharing" of your personal information, although we do not sell your data. We will not discriminate against you for exercising these rights, and we honour Global Privacy Control (GPC) signals as an opt-out request.

Canada

Under PIPEDA you have the right to access your personal information and to challenge its accuracy, and to withdraw consent subject to legal or contractual limits.

Australia

Under the Privacy Act and the Australian Privacy Principles (APPs) you have the right to access and correct your personal information and to complain about how it is handled.

Brazil

Under the LGPD you have the right to confirmation of processing, access, correction, anonymisation or deletion, data portability, and information about the parties we share data with.

Other regions

If you are in the UAE or elsewhere in the Middle East or Asia, or in any other region, the data-protection rights available under your local law apply to you. You can exercise any of them by emailing team@8stations.ai.

12. Children

8stations.ai is a training service for adults aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, contact us and we will delete it.

13. Changes

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you. Your continued use of the service after an update means you accept the revised policy.

14. Contact

Questions about your data? Email team@8stations.ai or contact us.