Privacy Policy

1 — Data controller

[LEGAL ENTITY NAME], registered under SIRET [NUMBER], with its registered office at [ADDRESS], Paris, France.

DPO / Privacy contact: privacy@fuelnode.fr

2 — Data we collect

2.1 Data provided by the User

• Account data: name, email, password (hashed), language preference
• Physical data: age, weight, height, sex
• Training data: sport, experience level, weekly hours, days, distance, location, phase, goal event
• Dietary data: GI sensitivity, caffeine tolerance, restrictions, preferences
• Delivery data: address or relay point preference
• Payment data: processed exclusively by Stripe

2.2 Automatically collected data

• Device and usage data: device type, OS, app version, session duration
• Location data: approximate location for delivery routing

2.3 Connected services (with consent)

• Apple Health / HealthKit: heart rate, HRV, sleep, steps, workouts
• Garmin Connect: training load, VO2max, HR zones, history, sleep

2.4 Data generated by the service

• AI-generated protocols: protocols, macro targets, product selections
• Feedback data: product ratings, GI feedback, race feedback

3 — Purposes and legal bases

• Contract performance (Art. 6(1)(b) GDPR): generating protocols, curating box contents, processing orders, managing subscriptions, delivering products, payments, customer support.
• Legitimate interest (Art. 6(1)(f) GDPR): improving algorithms, analysing aggregate usage, preventing fraud, service communications.
• Consent (Art. 6(1)(a) GDPR): accessing HealthKit/Garmin data, marketing communications, location data beyond delivery.

4 — Data sharing

4.1 Service providers

• Supabase Inc. (USA): database hosting and authentication — SCCs in place
• Anthropic Inc. (USA): AI protocol generation via Claude API — SCCs in place
• Stripe Inc. (USA): payment processing — PCI-DSS Level 1
• Mondial Relay (France): delivery logistics
• Vercel / Lovable: app hosting

Fuelnode does not sell, rent, or trade personal data to third parties for marketing purposes.

5 — International data transfers

Certain service providers are located in the United States (Supabase, Anthropic, Stripe). All transfers are secured by Standard Contractual Clauses (SCCs) adopted by the European Commission.

6 — Data retention

• Account data: duration of account + 3 years after deletion
• Protocol history: duration of subscription, deleted within 30 days of account deletion
• Payment records: 10 years (French legal requirement)
• Usage analytics: anonymised after 26 months
• HealthKit / Garmin data: not stored, used in real-time

7 — Your rights

• Right of access (Art. 15 GDPR)
• Right of rectification (Art. 16)
• Right of erasure (Art. 17) — "right to be forgotten"
• Right to restriction (Art. 18)
• Right to data portability (Art. 20) — JSON or CSV format
• Right to object (Art. 21)
• Right to withdraw consent

Contact: privacy@fuelnode.fr or via the app in Settings > My Data. Response within 30 days. Complaints may be lodged with the CNIL: www.cnil.fr.

8 — Data security

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Hashed passwords (bcrypt)
• Role-based access control
• No credit card data storage (Stripe)
• Pseudonymisation of athlete data sent to the AI engine

9 — Cookies

The Site uses only strictly necessary cookies for authentication, session management, and language preferences. No advertising or tracking cookies are used.

10 — Children

Fuelnode is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18.

12 — Changes to this policy

Fuelnode may update this Privacy Policy. Material changes will be communicated at least 15 days before taking effect. The current version is always available at fuelnode.fr/privacy.