Privacy policy
What we do with your data, why, for how long, and how to take it back. Drawn up under Regulation (EU) 2016/679 (GDPR) and French Act no. 78-17 of 6 January 1978 as amended.
1The essentials in seven points
- We process your data to build and adjust your training documents, and for nothing else.
- Your training data (heart rate, perceived effort, pain areas) is health data: it is processed only with your explicit consent, which you can withdraw at any time.
- All your data is hosted in the European Union.
- Your training profile (the intake questionnaire, filled in within your space) is saved only after your explicit consent, given at the start of the questionnaire. You can withdraw it from your space in one click.
- Your data is never sold, rented or traded, and is never used for advertising.
- No advertising cookies, no social-network trackers, no third-party measurement pixels.
- At any time you can obtain, correct, export or erase your data by writing to support@eleonis.com.
2Who is responsible for your data
The data controller is ELEONIS, entreprise individuelle (EI), based in France — support@eleonis.com.
No data protection officer has been appointed: the activity falls into none of the three cases where Article 37 GDPR makes it mandatory. Data requests are handled at the address above.
3The data we process
We collect only what building your plan needs. Nothing is bought from a third party. If you connect your Strava account, we receive your running and walking activities: they are used only to pre-fill the confirmation of your sessions.
| Category | Detail | Source |
|---|---|---|
| Identity and contact | First name, last name, date of birth, postal address, email address, country | You, when you create your account |
| Start answers | Goal, race date, level, recent race time where given, number of sessions per week, long-run day. No health data. | You, before paying for the Start package |
| Training profile | Answers to the intake questionnaire: height, availability and life constraints, running history and races, goal, watch and gear, benchmarks and training terrain, fuelling during exercise | You, in the athlete space, after your consent |
| Health profile | Questionnaire answers that concern health: weight, current pain, injuries and stress fracture, problems experienced in races (feeling faint, heatstroke, hypothermia, digestive issues), maximum heart rate and VO2max you declare, and, for fuelling during exercise, digestive issues, cramps, sweating and foods you don’t tolerate | You, in the athlete space, after your explicit consent |
| Notes | Free-text fields of the questionnaire, messages you send us | You |
| Training data | Sessions, durations, distances, paces, elevation, heart rate, variability, breathing, skin temperature, altitude, power where available | The watch exports and session files you sent us by email before 28 September 2026. We no longer ask for them: automatic analysis of watch data is not available yet. Your Strava activities, if you connect your account (duration, distance, elevation gain, pace, heart rate, laps, device). |
| Session feedback | Execution, perceived effort, legs, general form, pain areas and their intensity, comments | You, in the athlete space |
| Account | Email address, password hash, language, last login date. The password itself is never stored: only an irreversible hash is. | Created by you |
| Payment and subscription | Payment confirmation, amount, date, transaction and customer references, subscription status, due dates, cancellation request | Stripe |
| Order evidence | Date you accepted the terms of sale, and request for immediate performance if you ticked it | You, at the payment step |
| Invoicing | Billing name and address, statutory invoice details | You, when you create your account |
| Technical | Server logs: timestamp, page requested, response code, truncated IP address | Automatic |
| Invitation (free access) | The email address the invitation is reserved for, if any, and an internal note (name or context), visible to Eleonis only. | Eleonis, when the invitation is created |
We never ask for your login credentials to a third-party platform, nor, for now, for the data export from your watch. An export you have already sent us is yours: you can ask us to delete it at any time.
4Health data: the special regime
Heart rate, heart-rate variability, breathing and skin temperature measured by your watch, sleep where applicable, perceived effort, freshness, the pain areas you report and the intake questionnaire answers that concern your health are data concerning health within the meaning of Article 9 GDPR. They carry reinforced protection.
What their processing rests on
On your explicit consent, under Article 9(2)(a) GDPR. That consent is collected through a separate tick box, distinct from acceptance of the terms of sale: ticking the terms is not consent to health data, and the reverse is equally true.
It forms the first step of the intake questionnaire: until it is given, no answer is saved. It is timestamped, together with the version of the text you accepted.
What we do with it, and what we do not
- We use it to calibrate your paces and zones, dose the load, adapt sessions and write your documents.
- We never use it to make a diagnosis, to screen for a disease or a deficiency, to assess a medical risk, or for any advertising, insurance or selection purpose.
- It is accessible only to the publisher of Eleonis and to the providers listed below, each strictly within the limits of their function.
Withdrawing your consent
You can withdraw it at any time, with no justification: from your athlete space (“Consent” step of the questionnaire, “Withdraw my consent” button), or by a simple email to support@eleonis.com. From the space, your health-related answers are erased immediately. Withdrawal does not affect what was done before. In practice: we stop processing that data, we erase it or return it to you, and your plan still exists — but it is no longer adjusted on your data, and some services can no longer be provided. We then tell you what remains possible and what does not.
The questionnaire answers, its free-text fields and the comment field on session feedback may contain health information. For that reason, no answer is ever copied into an email, or written to a technical log: they stay in the database hosted in the European Union. When you submit your profile, we receive a simple notification, without any of your answers.
5Why we process it, and on what legal basis
| Purpose | Legal basis | Data involved |
|---|---|---|
| Building your plan from your training profile | Performance of the contract (Art. 6(1)(b)) | Training profile |
| Taking your health profile into account so as not to put you at risk, and knowing when to recommend that you seek a health professional’s opinion, without ever assessing that risk ourselves | Explicit consent (Art. 9(2)(a)) | Health profile |
| Keeping proof of a warning already confirmed (return after injury, pain; this confirmation is no longer requested), kept for 5 years, including after consent is withdrawn | Establishment, exercise or defence of legal claims (Art. 9(2)(f)) and legitimate interest (Art. 6(1)(f)) | Date, version and reason of the confirmation |
| Building, delivering and adjusting your documents | Performance of the contract (Art. 6(1)(b)) | All, except health data |
| Analysing your training data and session feedback | Explicit consent (Art. 9(2)(a)) | Health data |
| Running your account in the athlete space | Performance of the contract (Art. 6(1)(b)) | Account, plan, session feedback |
| Checking that you are of legal age, as our terms require, and adapting your references to your age | Performance of the contract (Art. 6(1)(b)) | Date of birth |
| Building the Start template plan from your Start answers | Performance of the contract (Art. 6(1)(b)) | Start answers |
| Taking payment, issuing the invoice, managing the Essential and Complete subscriptions and their cancellation | Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c)) | Payment and subscription, invoicing, order evidence |
| Answering your messages | Performance of the contract, or legitimate interest in replying (Art. 6(1)(b) and 6(1)(f)) | Identity, message content |
| Sending you the emails the service needs: account, payment, plan, reports, subscription reminders. No advice newsletter and no marketing | Performance of the contract (Art. 6(1)(b)) | First name, email, language |
| Securing the site and preventing abuse | Legitimate interest in protecting the service (Art. 6(1)(f)) | Technical logs |
| Measuring site audience in aggregate | Legitimate interest, with no cookie and no identifier (Art. 6(1)(f)) | Page views, language, country |
| Establishing or defending a legal claim | Legitimate interest (Art. 6(1)(f)) | Contract, invoicing, correspondence |
| Managing free access | Performance of the contract (Art. 6.1.b); for the invitation itself, legitimate interest (Art. 6.1.f) | Invitation, identity, email address |
Where we rely on legitimate interest, we have balanced that interest against your rights and chosen the least intrusive option. You can object at any time.
6Artificial intelligence
No artificial intelligence tool is used today. Plans are built by a program of fixed rules; Complete plans are reviewed by a person. If that changes, this page will be updated beforehand.
7Automated decisions and profiling
No decision producing legal effects or similarly significantly affecting you is taken solely on the basis of automated processing, within the meaning of Article 22 GDPR.
Our computations produce training proposals — paces, load, zones, sessions. For Start and Essential, they reach you without review, as the package you chose provides; for Complete, they are reviewed by a person. A training proposal is not a decision that significantly affects you: you remain free to follow it. You can ask for an explanation of any value, or contest a proposal, by writing to support@eleonis.com.
8Who else sees your data
Your data is never sold, rented, traded or passed on for advertising. It is accessible to the publisher of Eleonis and to the providers below, who act on our instructions as processors under Article 28 GDPR, each bound by a data processing agreement.
| Provider | What they do for us | Where processing happens | Contract |
|---|---|---|---|
| Vercel Inc. | Hosting of the website and the server functions | Paris (cdg1), UE | Data processing agreement |
| Supabase | Database: accounts, training profiles, subscriptions, plans, session feedback | UE (Francfort) | Data processing agreement |
| Resend | Sending confirmation and follow-up emails | UE / États-Unis (CCT) | Data processing agreement |
| Stripe Payments Europe, Ltd. | Card payment processing (Stripe is also an independent controller for its own legal obligations, in particular fraud prevention) | Irlande, UE | Data processing agreement |
| OVHcloud | Mailbox: receiving the emails you send us, and keeping the watch exports received before 28 September 2026 | France, UE |
Values received from Strava are not passed to any artificial intelligence tool and are not used for any statistics shared across several athletes.
Polar Electro Oy (Finland), if you connect your Polar account: we receive your sessions (date, sport, duration, distance, elevation gain, heart rate, laps) and, if you agree, your physical data (maximum and resting heart rate, weight, height, VO2max). Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given when you connect, which you can withdraw at any time by disconnecting Polar.
This data is suggested to you to validate your sessions and update your reference values. The Eleonis team that reviews your plan only sees it if you tick the sharing box. It is not sent to any artificial intelligence, not aggregated across athletes, and not used in emails.
WHOOP, Inc. (United States), if you connect your WHOOP account: we receive a summary of your sessions (date, sport, duration, distance, elevation gain, heart rate) and, if you agree, your recovery (score, heart rate variability, resting heart rate, sleep duration). Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by disconnecting WHOOP or unticking recovery. Your recovery is visible to you only: it is never passed to the Eleonis team that reviews your plan, nor to any artificial intelligence.
The following may also be recipients, strictly within their remit: our accountant for invoicing records, our counsel in the event of a dispute, and any public authority making a request under the conditions provided by law.
9Transfers outside the European Union
Storage of your data — requests, accounts, plans, session feedback — is located in the European Union.
Some providers are established in the United States or may access data from there for support operations. In that case the transfer is framed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) and, where the provider is certified under it, by the EU–US Data Privacy Framework. Additional measures — encryption in transit and at rest, minimising what is sent — complete that framework.
You can ask us for a copy of the safeguards applying to a given transfer by writing to support@eleonis.com.
10How long we keep it
| Data | Retention | Starting point |
|---|---|---|
| Request that went no further | 12 months | Form submission |
| Data of an athlete we work with | Duration of the support period, then 12 months | End of the plan |
| Health data | Erased or returned no later than 12 months after the end of the support period, or immediately on withdrawal of consent | End of support or withdrawal |
| Watch export and session files received by email | Like other training data: erased or returned no later than 12 months after the end of the support period, or immediately on withdrawal of consent | End of support or withdrawal |
| Activities received from Strava | 7 days at most; for those you use to confirm a session: the values you confirmed (duration, distance, elevation gain, pace, heart rate) stay in your log like your other sessions | Receipt of the activity; immediate deletion if you disconnect Strava or withdraw the authorisation |
| Data received from Polar | 7 days; the values you confirm (validated session, updated profile) are kept with your log or your profile | Receipt of the data; immediate deletion if you disconnect Polar |
| Data received from WHOOP | 7 days; the session values you confirm stay in your log | Receipt of the data; immediate deletion if you disconnect WHOOP |
| Training profile (questionnaire) | Duration of the support, then 12 months; answers that concern health follow the previous row | End of support |
| Athlete space account | Deleted 12 months after the last login, or at your request | Last login |
| Invoices and accounting records | 10 years | Close of the financial year (Art. L123-22 French Commercial Code) |
| Proof of consent (health, terms, immediate performance request) | 5 years | Collection of consent |
| Warning confirmation (return or pain), already recorded | 5 years, including after consent is withdrawn | Confirmation |
| Password reset link | One hour, then unusable. Single use. | Sending of the link |
| Technical logs | 12 months at most | Log entry |
| Unused invitation | Deleted 30 days after it expires | Expiry of the invitation (30 days after it is created) |
| Used invitation | Email address and note erased 30 days after its use; the dates and the linked account are kept as a record of the free access | Use of the invitation |
At the end of the period, data is erased or irreversibly anonymised. We only call it anonymisation when it really is: we know that a GPS track tied to a race date can be enough to re-identify a person, and we take that into account.
11Your rights, and how to exercise them
- Access
- Confirm whether we process data about you, and receive a copy of it.
- Rectification
- Have inaccurate data corrected or incomplete data completed.
- Erasure
- Have your data deleted, in particular when you withdraw consent or the purpose has been met.
- Restriction
- Ask us to freeze a processing operation while something is checked or contested.
- Objection
- Object to processing based on our legitimate interest, on grounds relating to your situation.
- Portability
- Receive your data in a structured, machine-readable format, or have us send it to another provider.
- Withdrawal of consent
- At any time, without justification, for health data.
- Post-mortem directives
- Set what happens to your data after your death, under Article 85 of the French Act of 6 January 1978.
One address for all of it: support@eleonis.com. We answer within one month, extendable by two months if the request is complex — in which case we tell you, and why. It is free, unless a request is manifestly unfounded or repetitive.
We may ask for something that lets us check the request really comes from you, and only where reasonable doubt exists.
12How we protect it
- Site and server functions served over HTTPS only, strict security headers, a content security policy that forbids any third-party script.
- Passwords never stored in clear: hashed with a slow key-derivation function and a per-account salt.
- Sessions held in a signed token, in a cookie unreadable by JavaScript and sent over HTTPS only.
- Database with row-level security, reachable through a single service key, never exposed to the browser.
- Access limited to the people who need it. Reading profiles is restricted to the administrator, with a password and a one-time code sent by email at each login (second factor), for a session of 12 hours at most.
- Encrypted backups, kept in the European Union.
No system is infallible. In the event of a data breach likely to create a risk to your rights, we notify the CNIL within 72 hours and, where the risk is high, we tell you directly — what happened, what we did, and what you can do.
13Cookies and audience measurement
This site sets no advertising cookie, no social-network tracker and no third-party measurement pixel. No consent banner is shown, because there is nothing to consent to.
| What is stored | Role | Duration |
|---|---|---|
| Athlete space session cookie | Keeps you signed in after login. Strictly necessary to the service, exempt from consent. | 30 days |
| Sign-in marker (eleonis_signed_in) | Tells the site you are signed in, to show “My space” and “Sign out”. Holds no data and grants no access. Strictly necessary, exempt from consent. | Same as the session; deleted when you sign out |
| Aggregate audience measurement | Counts visits by page, language and country, with no cookie and no identifier that could recognise you. | Nothing stored on your device |
| Language preference | Remembers the language you chose, stored in your browser only. | Until you clear it |
The site is not indexed by search engines until opening is decided, and carries no share button loading an external script. Fonts are served from our own server: no request is sent to a third party when a page loads.
14Audience measurement
We count page views and a few steps (opening the questionnaire, choosing a package, payment) to know what works on the site.
- No cookie, no identifier, no IP address stored: we cannot recognise you.
- Tools: Vercel Web Analytics (page views) and our Supabase database, hosted in the EU (steps).
- Retention: 25 months.
- You can opt out: Don’t count me.
15Minors
The service is for adults. We do not knowingly collect data about a minor. If you hold parental authority and find that a minor has sent us data, write to support@eleonis.com: it will be deleted without delay.
16Notice for United States residents
If you live in the United States, everything above applies to you in full. To remove any ambiguity:
- We do not sell your personal information and do not share it for cross-context behavioural advertising, as US state laws use those terms. We never have.
- We do not discriminate against anyone who exercises their rights.
- The categories of information collected, their purposes, their recipients and their retention periods are those described in the sections above.
- You can ask what information we hold, obtain a copy, have it corrected or have it deleted, by writing to support@eleonis.com.
- Your data is processed and stored in the European Union: by sending it to us, you accept processing outside the United States.
17Changes to this policy
This policy may change, in particular if we add a feature or change provider. The version in force is always the one published on this page, with its date. For a substantial change affecting health data, purposes or recipients, we email the people concerned before it takes effect, and collect consent again where needed.