Privacy
PRIVACY POLICY.
VERSION 2026-09-19.2 · LAST UPDATED 19 September 2026
The short version.
TRIARO collects what it needs to run your account, build your training plan and process your purchase. We never sell your data and never use it for advertising. Analytics runs only if you allow it. You can download or delete your data at any time from your account.
1. Who is responsible for your data
The controller is Ángel Porras Pardo, an individual trading as TRIARO (tax ID 06597422X), Calle Manzano 3, 28224 Pozuelo de Alarcón, Madrid, Spain. For anything about your data, contact angelpor.business@gmail.com.
2. What we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Email address, first name, password (stored only as a hash by our authentication provider), sign-in times, email-confirmation status. | You, when you sign up. |
| Google sign-in (optional) | If you choose Continue with Google: your email address, name, Google account identifier and, if you have one, a profile picture link. | Google, at your request. |
| Starting Point assessment | Your age band, training background and consistency, current hours, swim, bike and run distances, frequency and confidence, bike and pool access, available days and session lengths, strength preference, preferred start, main concern, and race date if you have one. Plus the scores calculated from them. | You, in the assessment. |
| Training | Your generated plan and its history, optional per-day time limits, optional race name and location, and the sessions you mark complete. | Generated for you, and your own entries. |
| Purchase | Whether you hold Full Access and when it began; the Stripe payment and checkout references, amount, currency, date and payment status, including any refund or dispute. | Stripe and our server, when you buy. |
| Agreements | Which version of the Terms and Privacy Policy you accepted, when, and in what context (sign-up, checkout, and your request for immediate access). | Recorded when you sign up and when you buy. |
| Emails | A record of which transactional emails were sent to you and when (not their content). | Our server. |
| Analytics (only with consent) | Pages visited (without query strings), product events such as starting or completing the assessment, device and browser type, approximate location, and a random identifier stored in a cookie. | Google Analytics, in your browser. |
| Campaign (only with consent) | If you arrive from a link with campaign parameters (utm_source and similar), the first such campaign and landing page. | The link you clicked. |
| Technical and security | IP address and request data in our hosting and security providers' logs, and counters used to rate-limit sensitive actions. | Generated automatically. |
Card details are entered on Stripe's checkout page and never reach TRIARO. We do not buy data or combine your record with data from other sources.
3. Health information
TRIARO does not need medical information and does not ask for it. There is no field for injuries, conditions, medication or medical history. Please do not enter health information anywhere in TRIARO.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, and sign you in (including with Google) | Contract (art. 6(1)(b)) |
| Produce your Starting Point and save it to your account | Contract (art. 6(1)(b)) |
| Build, store and update your training plan | Contract (art. 6(1)(b)) |
| Take payment, grant Full Access, and handle refunds and disputes | Contract (art. 6(1)(b)) |
| Send order confirmations and refund or dispute notices | Contract (art. 6(1)(b)) |
| Keep sales records for accounting and tax | Legal obligation (art. 6(1)(c)) |
| Keep a record of the terms you accepted | Legitimate interests in evidencing our agreement (art. 6(1)(f)), and legal obligation where it applies |
| Keep the service secure and prevent abuse | Legitimate interests (art. 6(1)(f)) |
| Answer your messages | Contract, or legitimate interests in replying (art. 6(1)(b) or (f)) |
| Analytics and campaign attribution | Your consent (art. 6(1)(a)), which you can withdraw at any time |
We do not send marketing emails.
5. How your plan is produced
Your plan is produced by fixed rules written in advance, not by AI and not by a model that learns from you. The same answers always produce the same plan, and the reasoning is shown to you in the product and on the methodology page. It is a training suggestion, not a decision with legal or similarly significant effects on you. You can change your answers at any time.
6. Who processes your data
We use the following providers to run TRIARO. They process data on our instructions under data processing terms. We do not sell personal data or share it for anyone's advertising.
| Provider | What it does |
|---|---|
| Supabase | Authentication and the database holding your account, assessment, plan, purchase and agreement records. |
| Vercel | Hosts and serves the TRIARO web application. |
| Cloudflare | Domain name, DNS and network security for the TRIARO website. |
| Stripe | Processes payments, refunds and disputes. Stripe also acts as an independent controller for its own legal obligations, such as fraud prevention, under its own privacy policy. |
| Resend | Delivers transactional emails: account confirmation, password reset, order confirmation, and refund or dispute notices. |
| Google (Sign-In) | Confirms your identity if you choose Continue with Google. |
| Google (Analytics) | Measures how the site is used — only if you allow Analytics. |
Google sign-in. We ask Google only for basic sign-in information: your email address and basic profile. We do not request access to Gmail, Google Drive, Google Calendar or any other Google service, and we do not use Google sign-in tokens to access other Google services. You can remove TRIARO's access from your Google account settings at any time.
Google Analytics. Analytics loads only after you allow it. Advertising features, Google signals and ad personalisation are off. We never send Google your name, email, assessment answers, training data or payment details. Analytics data is kept for no longer than 14 months.
International transfers. Some of these providers, or their support teams, are outside the European Economic Area, mainly in the United States. Where that is the case, the transfer is protected by the European Commission's Standard Contractual Clauses or another safeguard recognised under the GDPR, such as the EU-US Data Privacy Framework.
We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.
7. How long we keep it
We keep your account and training data while your account exists. When you delete your account, your profile, assessment, plans, plan history, completed sessions, access records and agreement records are deleted straight away.
The record of a payment — amount, currency, date and payment references — is kept, without the link to your account, for as long as accounting and tax law requires (in Spain, generally up to six years). Stripe keeps its own payment records under its own obligations.
Rate-limiting counters are short-lived. Analytics data is kept for up to 14 months. Provider backups are overwritten on their normal cycle.
8. Your rights
You can, at any time and free of charge:
- Access and download your data. A complete, machine-readable copy is available from your account.
- Correct it. Your answers and training inputs can be edited in the product. For anything else, contact angelpor.business@gmail.com.
- Delete it. Permanent deletion is available from your account and takes effect immediately.
- Object or restrict. You can object to processing based on legitimate interests, or ask us to restrict processing while a question is resolved.
- Withdraw consent. Change your analytics choice at any time from "Cookie settings" at the bottom of any page.
- Complain. You can contact us, and you can complain to a data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or the authority where you live.
We reply within one month. If you write from outside your account, we may ask you to confirm your identity.
9. Security
Your data is private to your account, and the database itself prevents one account from reading another's records. Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never seen by TRIARO. Export and deletion require re-entering your password and are rate-limited.
If a breach affects your personal data and is likely to put you at high risk, we will tell you, and we will notify the supervisory authority where the law requires it.
10. Children
TRIARO is for adults aged 18 and over and is not directed at children. If you believe a child has created an account, tell us at angelpor.business@gmail.com and we will delete it.
11. Changes to this policy
This policy carries a version and a date. If we change it in a way that materially affects you, we will tell you in the product or by email before the change takes effect.
TRIARO is an independent educational planning product and is not affiliated with, endorsed by, or connected to any race organizer or event brand.