Privacy Policy

At 2trAIn we take your privacy seriously. This policy explains what data we collect, how we use it and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD).

1. Data controller

Name: 2trAIn
Address: Madrid, Spain
Contact email: contact@2trainapp.com

Data Protection Officer (DPO): In accordance with Art. 37 GDPR, we are not required to appoint a DPO as we do not carry out large-scale processing or systematically process special categories of data. For any privacy enquiries, please use the email above.

2. Data we collect

We currently collect only the data strictly necessary to manage the waitlist:

• Email address: to send you your invitation when your access wave opens.
• Name (optional): if you choose to provide it in the registration form.

We do not collect payment data, sensitive data or any other personal data at this stage.

Minimum age: The service is intended for users aged 14 and over (the digital consent age in Spain under Art. 7 LOPDGDD). If you are under 14, you must not register without the explicit consent of your parent or legal guardian.

3. Purpose and legal basis

We process your data for the following purposes:

• Waitlist management: to notify you when your beta access opens. Legal basis: your explicit consent when registering (Art. 6.1.a GDPR).
• Product communications: to send you relevant updates about the development of trAIn. Legal basis: your explicit consent (Art. 6.1.a GDPR).

You may withdraw your consent at any time by emailing contact@2trainapp.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Art. 7.3 GDPR).

4. Data retention

We will retain your email for as long as necessary to manage your beta access and, once you are in, for as long as your account remains active. If you choose to unsubscribe, we will delete your data within a maximum of 30 days.

5. Processors and international transfers

We do not share your data with third parties for commercial purposes. To operate the service we use the following data processors, with whom we have signed the contracts or standard contractual clauses (SCCs) required by Art. 28 GDPR:

• Vercel Inc. (USA) — Hosting and infrastructure: website and API hosting. The international transfer is covered by the Standard Contractual Clauses (SCCs) adopted by the European Commission. See Vercel's privacy policy.
• Resend (Plus Five Five, Inc., USA) — Transactional email provider: sending invitations and product communications. The international transfer is covered by the European Commission SCCs. See Resend's privacy policy.

6. Your rights

You have the right to:

• Access (Art. 15): know what data we hold about you.
• Rectification (Art. 16): correct inaccurate data.
• Erasure (Art. 17): request that we delete your data ("right to be forgotten").
• Objection (Art. 21): object to certain types of processing.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Restriction (Art. 18): request that we restrict processing in certain circumstances.
• Automated decisions (Art. 22): not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You have the right to request human intervention, express your point of view and contest the decision.

To exercise any of these rights, write to us at contact@2trainapp.com with the subject line "GDPR Rights". We will respond within one month (extendable by a further two months in complex cases, with prior notice).

To request immediate erasure of your data (Art. 17 GDPR) you can use this direct link: Request erasure of my data.

If you believe our processing of your data violates applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority of your country of residence within the EU.

7. Automated decisions and profiling

The 2trAIn application uses artificial intelligence systems to generate personalised training plans based on the data you provide (training history, fatigue level, goals). This processing constitutes profiling within the meaning of Art. 4.4 GDPR.

The recommendations generated are informational and advisory in nature; we do not make binding decisions with legal effects based solely on automated processing. At any time you may:

• Request human review of any generated recommendation.
• Express your view on the output.
• Contest or choose not to follow any AI-generated plan.

The legal basis for this processing is your explicit consent (Art. 6.1.a and Art. 22.2.c GDPR) given when you register and use the application.

8. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, including encryption in transit (HTTPS) and restricted access to data.

9. Cookies and third-party services

This site does not install tracking or third-party advertising cookies. Strictly necessary session cookies may be used for technical operation. Fonts are served from our own servers and do not generate data transfers to third parties.

10. Changes to this policy

We may update this policy to reflect changes to the service or applicable law. If the changes are significant, we will notify you by email at least 15 days in advance. The "last updated" date at the top of this document always indicates the current version.

11. Contact

For any privacy questions, write to us at contact@2trainapp.com. We will get back to you as soon as possible.