Legal

Privacy Policy

Last updated: July 2026

At PontelasPilas (pontelaspilas.pro) we take our users' privacy very seriously. This document explains what data we collect, how we use it, and what rights you have over it, in accordance with the General Data Protection Regulation (GDPR / EU 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Antonio Gustavo Lozano Sánchez (PontelasPilas)
Tax ID (NIF): 23.803.102-B
Address: Cmno. de Gelibra s/n, 18690 Almuñécar, Granada, Spain
Email: hola@pontelaspilas.pro
Domain: pontelaspilas.pro

2. Data we collect

• Account Name, email address, and password (stored with bcrypt hashing).
• OAuth If you sign up with Google: name, email, and avatar provided by Google.
• Physical profile Biological sex, age, height, weight, training goal, available days, equipment, experience, and injuries (data you provide voluntarily).
• Workouts Log of sets, reps, and loads for each session you save in the app.
• Payment Processed entirely by Stripe. We do not store card data.
• Technical IP address and anonymous usage data for the correct operation of the service.

3. Purpose and legal basis

• Service provision (GDPR art. 6.1.b): AI plan generation, workout tracking, and account management.
• Legal obligation (art. 6.1.c): tax and accounting compliance arising from subscriptions.
• Legitimate interest (art. 6.1.f): service security and fraud prevention.

4. Data processors (third parties)

• Anthropic — AI generation of training plans. Your physical profile data is sent to create the plan. Anthropic's privacy policy.
• Stripe — Payment processing and subscription management. Stripe's privacy policy.
• Google — OAuth authentication (only if you choose "Continue with Google"). Google's privacy policy.
• Hetzner / Vultr — Server hosting within the EU.

We do not sell or share your personal data with third parties for commercial purposes.

5. Data retention

Your data is retained for as long as you have an active account. If you request account deletion, we delete your personal data within a maximum of 30 days, except where legally required to retain it (tax records: 5 years).

6. International transfers

Anthropic operates in the US. Transfers are carried out under the safeguards of GDPR art. 46 (standard contractual clauses). Stripe holds EU-U.S. Data Privacy Framework certification.

7. Your rights

You can exercise the following rights at any time by writing to hola@pontelaspilas.pro:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): delete your data.
• Portability: receive your data in a machine-readable format.
• Restriction and objection to processing under certain circumstances.

You may also file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Security

We apply appropriate technical and organizational measures: TLS encryption in transit, bcrypt-hashed passwords, role-restricted access, and an isolated database on a private server.

9. Changes to this policy

If we make substantial changes, we will notify you by email or via a notice in the app at least 7 days in advance.

10. Contact

For any privacy-related question: hola@pontelaspilas.pro