Privacy Policy

1. Controller and contact

The controller responsible for processing personal data within the meaning of the GDPR is:

DRAIF Systems GmbH
Waldstraße 14
91091 Großenseebach
Germany
E-mail: dominik.reif@draif-systems.com
Telephone: +49 9135 5718940

You can contact us at this address for all data protection questions and to exercise your rights.

2. Scope and overview

This Privacy Policy applies to the website durolumo.com and the web app DUROLUMO (account, training planning, coach). It describes which data we process for which purpose and on which legal basis, to whom we disclose it, how long we keep it and what rights you have.

DUROLUMO is intended for adults (aged 18 or over). Because DUROLUMO creates a personal training plan, we also process health data (section 5). We ask for your explicit consent for this.

3. Hosting, servers and access data (Google Firebase, Google Cloud)

The website and the app run on Google Firebase and Google Cloud (Google; parent company Google LLC, USA). The website is delivered via Firebase Hosting, which serves the pages through a worldwide network of servers. Sign-in uses Firebase Authentication; we cannot choose the processing location of this service, and data may also be processed in the USA.

Your account and training data are stored in a database (Cloud Firestore) and file storage (Cloud Storage) in the Google Cloud region Frankfurt (europe-west3). The app’s main interface also runs in Frankfurt. Some server functions – including the Garmin connection, scheduled coach messages, preparation of session details and maintenance tasks – currently run in the region us-central1 (USA) and access the data in Frankfurt.

When you access the website and the app, access data is processed for technical reasons: IP address, date and time, requested address, referrer, browser and operating system. Server functions write logs for troubleshooting; e-mail addresses and phone numbers are partly shortened in them.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation) and, where you use the app, Art. 6(1)(b) GDPR.

4. Account, set-up and use of the app

When you create an account and use DUROLUMO, we process:

• Account data: name, username, e-mail address and password (login data is managed by Firebase Authentication), language and time zone
• Set-up information: date of birth (kept in the saved set-up draft; only the year of birth in your profile), gender, height, weight, resting and maximum heart rate, fitness level, sports, goals and races, weekly time, fixed appointments, availability, equipment and access to a gym or pool – fitness level, at least one sport and weekly time are required, everything else is optional
• Training data: planned and completed sessions, feedback (for example effort, how you feel, sleep quality), plan adaptations, messages to the coach and its replies
• Contract data: start and end of the trial, subscription status
• Your agreement: version, time, IP address and browser identifier (user agent) with which you completed the set-up, as evidence
• Reports you send us through the app (bug reports and feature requests, including images)

The purpose is to provide the app: creating and adapting your plan, the coach’s replies, managing trial and subscription. The legal basis is Art. 6(1)(b) GDPR; section 5 applies to the health data among them. When a new user registers, we receive an internal notification with display name and account ID, sent via Brevo (Art. 6(1)(f) GDPR, supporting new users).

5. Health data

For training planning we process health data within the meaning of Art. 9 GDPR: your voluntary notes on injuries, surgery, illness or complaints (free text in the set-up and messages to the coach), weight, heart rate and sleep information, feedback on how you feel and – if you connect Garmin – measurements such as heart rate, heart rate variability, sleep and stress (section 7). The AI identifies active complaints from your free text and chat so that the plan can take them into account.

The legal basis is your explicit consent under Art. 9(2)(a) GDPR. You give it in the set-up summary using a separate checkbox that is not pre-ticked (“I agree that DUROLUMO may use my training and health data to create and adapt my plan.”). Without this consent we cannot create a personal plan.

You can withdraw your consent at any time with effect for the future. There is currently no button for this in the app; please write to dominik.reif@draif-systems.com. After withdrawal we can no longer base the plan on your health data; we delete this data or your account, as you wish. Withdrawal does not affect the lawfulness of processing before the withdrawal.

6. AI processing (OpenAI)

Training plans, adaptations, explanations, daily and weekly messages and the coach’s replies are generated with language models from OpenAI (OpenAI, USA; accessed via the programming interface api.openai.com). For each task we transmit the necessary information to OpenAI:

• profile information such as first name, age, weight, gender, sports, goals, availability and time zone
• training data: plan, recently completed sessions with heart rate and load values, feedback
• health information: complaints, how you feel, sleep information and a recovery estimate calculated from Garmin values (heart rate variability, sleep, resting heart rate)
• in the coach chat (app and WhatsApp): your messages, the conversation of recent days, weather at your training location and your account profile without your account e-mail address; if you write an e-mail address into a message yourself, it is transmitted with that message
• for “Train together”: display names and planned sessions of your friends and the approximate distance between your locations
• for the gym feature (only for enabled accounts): uploaded class schedules and workout photos or texts for evaluation

We do not send any account ID or e-mail address in the interface’s technical identifier fields. We do not train our own AI models with your data. For quality assurance and troubleshooting we store logs of the AI calls (inputs and outputs) in our storage in Frankfurt; they are deleted together with your account.

The legal basis is Art. 6(1)(b) GDPR and, where health data is concerned, your consent under Art. 9(2)(a) GDPR (section 5). For transfers to the USA see section 16. Notes on handling AI content are in the Terms of Use.

7. Garmin Connect (optional)

If you connect your Garmin Connect account (Garmin), you sign in with Garmin and grant access there yourself. We then receive from Garmin your Garmin ID, your activities (with heart rate, zones, duration, distance and other measurements; with your permission also retroactively) and daily values such as steps, resting heart rate, stress, sleep, heart rate variability and – if your device records them – weight, body fat, oxygen saturation, respiration and blood pressure. From the start point of an activity we derive an approximate training location for weather notes. We send planned sessions to your Garmin calendar.

During the trial or a subscription you can disconnect in the settings, otherwise by writing to dominik.reif@draif-systems.com; you can also revoke access in your Garmin account at any time. Disconnecting in the app does not revoke access at Garmin; data that Garmin still sends afterwards can currently still be assigned to your account and stored by our system. To stop the data flow, please also revoke access in your Garmin account. Data already imported remains in your account until you ask us to delete it or your account. The legal basis is Art. 6(1)(b) GDPR and, for health values, your consent under Art. 9(2)(a) GDPR.

8. WhatsApp (optional)

If you enter your mobile number in the set-up or in the settings and connect WhatsApp, the coach sends you messages via Meta’s WhatsApp Business Platform (parent company Meta Platforms, Inc., USA), for example the daily morning message and the Sunday review, and you can write to it there. We process your phone number, your WhatsApp ID, the content of the messages and the delivery status; your text messages are transmitted to OpenAI as in the app chat (section 6). We do not process images or voice messages.

Connecting is voluntary. During the trial or a subscription you can end it in the settings, otherwise at any time by writing to dominik.reif@draif-systems.com. The legal basis is your consent (Art. 6(1)(a) GDPR and, where you write about health topics, Art. 9(2)(a) GDPR). Meta also processes the data as the operator of WhatsApp; WhatsApp’s terms apply to this.

9. E-mails (Brevo, Firebase)

We send e-mails via Brevo (Sendinblue SAS, France): the notice that your plan is ready (if WhatsApp is not connected), activation after a waiting period and the reminder about three days before the trial ends. For this we transmit your e-mail address and first name to Brevo. The legal basis is Art. 6(1)(b) GDPR. Password reset e-mails are sent by Firebase Authentication (Google).

We only send promotional e-mails with your separate consent (Art. 6(1)(a) GDPR).

If you previously joined the waiting list on the website, your e-mail address and the information you gave there (for example first name, goal, sports, year of birth, campaign data) are stored with Brevo so that we can inform you about access (Art. 6(1)(b) GDPR). You can unsubscribe at any time by writing to dominik.reif@draif-systems.com.

10. Payment (Stripe)

You take out the subscription on an order page of the payment service provider Stripe. During the first order process we create a customer account with Stripe and transmit your e-mail address, your name (if stored) and your account ID. You enter your payment details directly with Stripe; we do not receive them in full, but a customer ID, the subscription status, the billing period and invoices. Subscription management (customer portal) also takes place at Stripe.

The legal basis is Art. 6(1)(b) GDPR. We keep invoice and accounting data in accordance with statutory commercial and tax retention obligations (Art. 6(1)(c) GDPR).

If you cancel with the button “Cancel contracts here” (page /kuendigen/), we store your cancellation with the details from the confirmation page (type of cancellation and reason if given, name, account e-mail address, contract, time, address for the confirmation) and the date and time of receipt. We match it to your account by the e-mail address, carry out the cancellation at Stripe and send the confirmation via Brevo; if the confirmation goes to a different address, your account address receives a notice. No login is needed; we do not store your IP address for this. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 312k(4) German Civil Code and Art. 6(1)(b) GDPR. For the storage period see section 17.

11. Friends, running meetups and Hall of Fame

If you use the social features, we process your username, friendships, shared sessions, reactions and comments, as well as meetups with time and meeting point. You control what friends see with the privacy switches. Public meetups are visible on durolumo.com/community without login. Anyone who signs up for a meetup as a guest provides name and e-mail address; only the person who created the meetup sees them. We convert meeting-point addresses into coordinates using the Nominatim service (OpenStreetMap Foundation, United Kingdom). In the Hall of Fame you can save race results and photos; the AI creates a race report (section 6).

The legal basis is Art. 6(1)(b) GDPR, for guest sign-ups Art. 6(1)(b) GDPR towards the guest.

12. Maps, location search, weather and videos

Your browser loads maps on the event and community pages directly from OpenStreetMap or CARTO; the map’s style file comes from unpkg. If you search for a place or postcode, your browser sends the search text to Nominatim (OpenStreetMap). These services receive your IP address and the requested area. Background images in the app are loaded by your browser from Unsplash (images.unsplash.com); Unsplash receives your IP address.

For weather notes our servers retrieve weather data from Open-Meteo and only transmit coordinates (your saved location or the training location derived from Garmin), without name or account ID.

Exercise videos in sessions are embedded from YouTube (Google); when loading or playing them, Google receives your IP address and may set cookies. On event pages your browser first only loads the preview image from YouTube (i.ytimg.com, with your IP address); the video itself only loads after a click via youtube-nocookie.com.

The legal basis is Art. 6(1)(b) GDPR where you use the feature in the app, otherwise Art. 6(1)(f) GDPR (legitimate interest in maps, location search and videos).

13. Public tools (running shoe advisor, blood test demo)

Your input in the running shoe advisor and in the blood test demo (lab values as text or PDF) is transmitted to OpenAI for evaluation (section 6) and is not stored by us in an account. To prevent abuse we limit the number of requests per IP address. The legal basis is Art. 6(1)(b) GDPR (your request) and, for lab values, your consent under Art. 9(2)(a) GDPR, which you give in the demo.

14. Analytics, marketing and error analysis

On your first visit to durolumo.com a banner asks for your consent. You can choose “Decline”, “Accept all” or decide per category under “Settings”. Declining is as easy as accepting, and you can use the website fully without consent. We do not show the banner on the sign-in page or in the signed-in area of the app, so it does not cover the controls; if you have not decided there, you are treated as if you had declined.

Without consent: anonymous measurement

Without your consent we count page views and the events of our pages (for example a click on a main button, a sign-up form being shown, registration started or completed) anonymously with PostHog (PostHog Inc., servers in the EU). Nothing is stored in your browser for this: no cookie, no entry in local storage, no identifier; the PostHog library is not even loaded. Only your stored choice in the consent banner (“durolumo_consent”) is read, nothing else. Your browser sends the event directly to PostHog, with the address of the page (shortened to the path and campaign parameters “utm_*”, without click identifiers such as gclid or fbclid), referrer, browser language, time zone and a rough device type (mobile or desktop). With the request, PostHog technically receives your IP address and the browser identification (user agent). PostHog forms a hash from them on its servers that changes daily; it can therefore recognise you at most within one day, not across several days and not across devices. There is no session recording, no automatic capture of clicks and text, and no link to your account. The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR); for the measurement itself nothing is stored in or read from your device; reading your banner choice is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). You can object to this processing (Art. 21 GDPR) by e-mail to dominik.reif@draif-systems.com.

We also record technical errors without consent with Sentry (Functional Software, Inc., ingestion in the EU): error reports and performance data, with your IP address and technical details of browser and page, without session recording and without storage in your browser. The legal basis is Art. 6(1)(f) GDPR (stability and security of the service). Errors in server functions also go to Sentry servers in the EU, partly with your account ID.

Only with your consent

Two categories, selectable individually. The legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR.

• Extended statistics: PostHog with recognition across several visits, automatic capture of clicks and session recordings (input in form fields is masked, displayed content is visible – in the app this can include training and health information); after registration or login, PostHog links the browser identifier with your account ID (not with e-mail or name), the registration date and campaign data. Google Analytics 4 (Google): measuring page views and registrations; Google stores identifiers in your browser and receives usage data including your IP address. Sentry Session Replay: when an error occurs and in 5 % of sessions, the session is recorded; text and media are masked. We also store the campaign data (UTM) of your first visit in your browser.
• Marketing: Google Ads (Google): measuring whether clicks on ads lead to registrations, and audience lists. Meta Pixel (Meta): measuring the effect of ads on Facebook and Instagram, with the address of the page viewed and events such as registration or starting an order. The pixel is not active on individual knowledge articles under /wissen/, even with consent.

Without the respective consent, the scripts of these services are not loaded and no requests are sent to them. For Google we use Google Consent Mode v2 in the “Basic” variant: until you choose, nothing is transmitted to Google, not even the consent status.

Withdrawal: Under “Cookie settings” at the bottom of every page you can change or withdraw your choice at any time; this is as easy as giving it. On withdrawal we delete the cookies and entries of the category concerned, stop the services and reload the page; afterwards only the anonymous measurement runs. The lawfulness of processing carried out until withdrawal is not affected. We store your choice with time and version only in your browser (entry “durolumo_consent”); there is not yet a server-side record as proof. Individual cookies that a third party sets on its own domain (for example “test_cookie” from doubleclick.net, which according to Google expires after 15 minutes) cannot be deleted by us from this website.

For sign-ups to the former waiting list, our server also sent an event to Meta (Conversions API), with the e-mail address converted into a checksum (SHA-256), IP address, browser identifier and, where present, the Meta identifiers from the browser, and to PostHog. This transmission does not depend on the banner.

15. Cookies and browser storage

Always, without consent: For the website and the app to work we store entries in your browser’s storage, for example your login (Firebase), language, set-up drafts, dismissed notices, the place you searched for and your choice in the consent banner. Where these entries are strictly necessary for the service you requested, no consent is required (§ 25(2) no. 2 TDDDG). If you open the site with the parameter “_internal=1”, this applies without your consent only in the memory of the open page, so that your own visits stay out of our figures; an entry in local storage (“durolumo_internal_user”) is written and read only with “Extended statistics”. The anonymous measurement under section 14 needs no entry.

Only with consent: With “Extended statistics”, PostHog, Google Analytics and Sentry set or use their own cookies and identifiers (for example ph_*, _ga, _ga_*, sentryReplaySession), and we store the campaign data of your first visit (“durolumo_utm_params”) and session notes; with “Marketing”, Google Ads and Meta set or use identifiers such as _gcl_*, _fbp and _fbc. According to Google, the Google Analytics cookies (_ga, _ga_*) last 2 years and _gcl_au 90 days; _fbp lasts 90 days and the PostHog cookie 365 days; entries in local storage remain until deleted, entries in session storage until the tab is closed. On every page view we delete identifiers of categories for which there is no consent; for this the page reads the names (not the values) of existing cookies and storage entries.

You can additionally block or delete cookies in your browser at any time; the app may then work only to a limited extent.

16. Recipients and transfers to third countries

Recipients are the services named in this policy. Where they process data on our behalf, they are processors (Art. 28 GDPR). We do not sell data.

• Google (Firebase, Google Cloud, Analytics, Ads, YouTube) – Google group, parent company Google LLC, USA
• OpenAI (AI) – USA
• Meta (WhatsApp, Pixel, Conversions API) – Meta group, parent company Meta Platforms, Inc., USA
• Stripe (payment) – Stripe group, parent company Stripe, Inc., USA
• Brevo (e-mail) – Sendinblue SAS, France
• PostHog (analytics) – PostHog Inc., USA, data stored in the EU
• Sentry (error analysis) – Functional Software, Inc., USA
• Garmin (only if you connect) – Garmin group
• OpenStreetMap Foundation (Nominatim, maps) – United Kingdom; also the map, image and file services CARTO, Unsplash and unpkg and the weather service Open-Meteo

Where providers are based in or process data in the USA, data may be transferred to the USA; for the United Kingdom there is an adequacy decision of the EU Commission (Art. 45 GDPR). For the USA there is an adequacy decision on the EU-US Data Privacy Framework, which only applies to companies certified under it (list: dataprivacyframework.gov); for other recipients, EU standard contractual clauses in particular come into consideration (Art. 46(2)(c) GDPR). We have not yet finally checked and documented which basis actually applies to each provider; we will add it here. You can obtain information on the current status from dominik.reif@draif-systems.com.

17. Storage period and deletion

We store your account, training and health data as long as your account exists. The account remains after the trial or subscription ends until you ask for it to be deleted. There is currently no button for this in the app; please write to dominik.reif@draif-systems.com. We then delete the account with the associated data (database, files, logs of AI calls, WhatsApp mapping and messages, friendships); meetups you created are currently not deleted automatically – please delete them yourself beforehand or tell us about them. The Garmin connection data (access keys, mapping to your Garmin ID, inbound logs and unmatched Garmin data) are also currently not deleted automatically – please revoke access in your Garmin account first and mention the Garmin connection in your deletion request; a 30-day period is provided during which you can still cancel the deletion, and on request we delete immediately. You can obtain a copy of your data the same way.

Exceptions are data we must keep for legal reasons, in particular invoice and accounting data (§ 257 German Commercial Code, § 147 German Fiscal Code); we delete it when the period expires. Your customer account with Stripe is currently not deleted automatically when your DUROLUMO account is deleted; you can ask us to have it deleted there unless a retention obligation prevents this.

We keep cancellations (section 10) as proof until the regular limitation period has expired, i.e. three years from the end of the year in which they were received (§§ 195, 199 German Civil Code); they are then deleted automatically. This also applies if you have your account deleted earlier (Art. 17(3)(e) GDPR).

The services in section 14 store data according to their own settings. We delete waiting-list entries at Brevo when you unsubscribe.

18. No automated individual decision-making

Your training plan and its adaptations are created automatically with the help of AI. This is not a decision within the meaning of Art. 22 GDPR: the plan is a recommendation that has no legal effect on you and does not similarly significantly affect you; you decide yourself whether and how you train and can change or skip sessions at any time. We do not create profiles in order to refuse you services or terms.

19. Your rights

You have the right to

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons.

To exercise your rights, a message to dominik.reif@draif-systems.com is sufficient.

20. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence or place of work. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

21. Data security and obligation to provide data

Transmission between your device and our servers is encrypted with TLS. Providing your data is not required by law or contract. For an account we need name, username, e-mail address and password; without the training information and the consent under section 5 we cannot create a personal plan.

22. Changes to this policy

We update this Privacy Policy when our processing or the legal situation changes. The version published here applies. German version (binding): Datenschutzerklärung.