Privacy
Privacy policy.
Version 2026-11-03.1 · Last updated 3 November 2026
The short version.
TRIARO collects what it needs to run your account, build your training plan and process your purchase. We never sell your data and never use it for advertising. Analytics runs only if you allow it. You can download or delete your data at any time from your account.
1. Who is responsible for your data
The controller is Ángel Porras Pardo, an individual trading as TRIARO (tax ID 06597422X), Calle Manzano 3, 28224 Pozuelo de Alarcón, Madrid, Spain. For anything about your data, contact support@triaro.app.
2. What we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Email address, first name, password (stored only as a hash by our authentication provider), sign-in times, email-confirmation status. | You, when you sign up. |
| Google sign-in (optional) | If you choose Continue with Google: your email address, name, Google account identifier and, if you have one, a profile picture link. | Google, at your request. |
| Starting Point assessment | Your age band, training background and consistency, current hours, swim, bike and run distances, frequency and confidence, bike and pool access, available days and session lengths, strength preference, preferred start, main concern, and race date if you have one. Plus the scores calculated from them. | You, in the assessment. |
| Training | Your generated plan and its history, optional per-day time limits, optional race name and location, the sessions you mark complete and the distance and time you log for them, and the sessions you add yourself (sport, date, duration, intensity and, if you enter them, distance, title and notes). The plan also stores the time zone of the browser used to build or change it (a region such as Europe/Madrid, used to work out which day it is for you) and your registration date (the date only, no time), copied into the plan so it knows when you started. | Generated for you, your own entries, and your browser's time zone setting. |
| Display preferences | Whether you read distances in kilometres or miles. It affects only how numbers are shown to you, never your training plan, and it is included in your data download. Also the language you read TRIARO in (English or Spanish), kept in your browser and, once you have an account, on your account; it affects only the language TRIARO is shown in. | Your own choice, or metric and English by default. |
| Purchase | Whether you hold the Race Plan or Full Access and when each began; the Stripe payment and checkout references, amount, currency, date and payment status, including any refund or dispute. | Stripe and our server, when you buy. |
| Agreements | Which version of the Terms and Privacy Policy you accepted, when, and in what context (sign-up, checkout, and your request for immediate access). | Recorded when you sign up and when you buy. |
| Emails | A record of which transactional emails were sent to you and when (not their content). | Our server. |
| Email preferences (optional) | Whether you asked for training tips and product updates by email; when, where in TRIARO and in which language you chose, and which version of the wording you saw; when you unsubscribed; and which campaign emails were sent to you and when. No IP address or device data is recorded for this. | Your own choice. |
| Support messages | What you write to us in Help & support (the type of message and the text), our replies, and when each was sent and read. | You, and our replies. |
| Analytics (only with consent) | Pages visited (without query strings), product events such as starting or completing the assessment, device and browser type, approximate location, and a random identifier stored in a cookie. | Google Analytics, in your browser. |
| Campaign (only with consent) | If you arrive from a link with campaign parameters (utm_source and similar), the first such campaign and landing page. | The link you clicked. |
| Technical and security | IP address and request data in our hosting and security providers' logs, and counters used to rate-limit sensitive actions. | Generated automatically. |
Card details are entered on Stripe's checkout page and never reach TRIARO. We do not buy data or combine your record with data from other sources.
3. Health information
TRIARO does not need medical information and does not ask for it. There is no field for injuries, conditions, medication or medical history. Please do not enter health information anywhere in TRIARO.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, and sign you in (including with Google) | Contract (art. 6(1)(b)) |
| Produce your Starting Point and save it to your account | Contract (art. 6(1)(b)) |
| Build, store and update your training plan | Contract (art. 6(1)(b)) |
| Take payment, grant the Race Plan or Full Access, and handle refunds and disputes | Contract (art. 6(1)(b)) |
| Send order confirmations and refund or dispute notices | Contract (art. 6(1)(b)) |
| Keep sales records for accounting and tax | Legal obligation (art. 6(1)(c)) |
| Keep a record of the terms you accepted | Legitimate interests in evidencing our agreement (art. 6(1)(f)), and legal obligation where it applies |
| Keep the service secure and prevent abuse | Legitimate interests (art. 6(1)(f)) |
| Answer your messages | Contract, or legitimate interests in replying (art. 6(1)(b) or (f)) |
| Analytics and campaign attribution | Your consent (art. 6(1)(a)), which you can withdraw at any time |
| Training tips and product updates by email, only if you asked for them | Your consent (art. 6(1)(a)), which you can withdraw at any time |
| Keep a record of your email consent and of addresses that unsubscribed, bounced or complained, so they are never emailed again | Legal obligation to prove consent and to respect your objection (art. 6(1)(c), art. 7(1) and art. 21 GDPR; art. 22 LSSI) |
Marketing email. We send training tips and product updates by email only if you tick the box for it in TRIARO. It is never needed to sign up, save your result or buy, and creating an account or buying does not count as asking. Every such email says who it is from and has a one-click unsubscribe that works without signing in; you can also change your choice in Email preferences. Emails about your account, orders and support replies are part of the service and are not marketing.
5. How your plan is produced
Your plan is produced by fixed rules written in advance, not by AI and not by a model that learns from you. The same answers always produce the same plan, and the reasoning is shown to you in the product and on the methodology page. It is a training suggestion, not a decision with legal or similarly significant effects on you. You can change your answers at any time.
6. Who processes your data
We use the following providers to run TRIARO. They process data on our instructions under data processing terms. We do not sell personal data or share it for anyone's advertising.
| Provider | What it does |
|---|---|
| Supabase | Authentication and the database holding your account, assessment, plan, purchase and agreement records. |
| Vercel | Hosts and serves the TRIARO web application. |
| Cloudflare | Domain name, DNS and network security for the TRIARO website. |
| Stripe | Processes payments, refunds and disputes. Stripe also acts as an independent controller for its own legal obligations, such as fraud prevention, under its own privacy policy. |
| Resend | Delivers transactional emails (account confirmation, password reset, order confirmation, refund or dispute notices, and notices that we replied to your support message) and, only if you asked for them, training tips and product updates. It tells us when an address bounces or reports an email as spam. |
| Google (Sign-In) | Confirms your identity if you choose Continue with Google. |
| Google (Analytics) | Measures how the site is used — only if you allow Analytics. |
Google sign-in. We ask Google only for basic sign-in information: your email address and basic profile. We do not request access to Gmail, Google Drive, Google Calendar or any other Google service, and we do not use Google sign-in tokens to access other Google services. You can remove TRIARO's access from your Google account settings at any time.
Google Analytics. Analytics loads only after you allow it. Advertising features, Google signals and ad personalisation are off. We never send Google your name, email, assessment answers, training data or payment details. Analytics data is kept for no longer than 14 months.
International transfers. Some of these providers, or their support teams, are outside the European Economic Area, mainly in the United States. Where that is the case, the transfer is protected by the European Commission's Standard Contractual Clauses or another safeguard recognised under the GDPR, such as the EU-US Data Privacy Framework.
We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.
7. How long we keep it
We keep your account and training data while your account exists. When you delete your account, your profile, assessment, plans, plan history, completed sessions, support messages, access records and agreement records are deleted straight away.
The record of a payment — amount, currency, date and payment references — is kept, without the link to your account, for as long as accounting and tax law requires (in Spain, generally up to six years). Stripe keeps its own payment records under its own obligations.
If you unsubscribe from marketing email, or an address bounces or reports a message as spam, we keep a one-way hash of that address (not the address itself) on a do-not-email list, even after your account is deleted, so we never email it again. Your consent history is deleted with your account.
Rate-limiting counters are short-lived. Analytics data is kept for up to 14 months. Provider backups are overwritten on their normal cycle.
8. Your rights
You can, at any time and free of charge:
- Access and download your data. A complete, machine-readable copy is available from your account.
- Correct it. Your answers and training inputs can be edited in the product. For anything else, contact support@triaro.app.
- Delete it. Permanent deletion is available from your account and takes effect immediately.
- Object or restrict. You can object to processing based on legitimate interests, or ask us to restrict processing while a question is resolved.
- Withdraw consent. Change your analytics choice at any time from "Cookie settings" at the bottom of any page, and stop marketing email with the unsubscribe link in any of them or in Email preferences.
- Complain. You can contact us, and you can complain to a data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or the authority where you live.
We reply within one month. If you write from outside your account, we may ask you to confirm your identity.
9. Security
Your data is private to your account, and the database itself prevents one account from reading another's records. Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never seen by TRIARO. Export and deletion require re-entering your password and are rate-limited.
If a breach affects your personal data and is likely to put you at high risk, we will tell you, and we will notify the supervisory authority where the law requires it.
10. Children
TRIARO is for adults aged 18 and over and is not directed at children. If you believe a child has created an account, tell us at support@triaro.app and we will delete it.
11. Changes to this policy
This policy carries a version and a date. If we change it in a way that materially affects you, we will tell you in the product or by email before the change takes effect.
TRIARO is an independent educational planning product and is not affiliated with, endorsed by, or connected to any race organizer or event brand.