Privacy Policy

Welcome to Chava ("we," "our," or "us"), the company behind Atalanta, a fitness and wellness app. We are committed to protecting your privacy and ensuring that your personal information is handled securely. This Privacy Policy explains how we collect, use, share, and protect your information when you use our services.

By accessing or using Atalanta or any other services offered by Chava, you agree to the terms outlined in this Privacy Policy. This Privacy Policy applies to all users of Atalanta worldwide. However, if you are located in the European Economic Area (EEA), additional rights under the General Data Protection Regulation (GDPR) may apply to you. If you have any questions, please contact us at info@atalanta.run.

The Data Controller for Atalanta is Chava UG, registered in Germany under HRB 93143, with a registered address at Am Krienengarten 11, D-40489 Düsseldorf, Germany. References to "we," "us," and "our" in this policy refer to Chava UG.

To provide and improve our Services, we collect different types of personal data. The specific categories of data and their purposes are outlined below.

When you create an account, we add your email address to our newsletter list. The newsletter is sent a few times a year and contains articles about running and cycling training from our blog and news about Atalanta, such as new features.

You can unsubscribe at any time with one click on the link at the end of every newsletter, in the app's settings, or by writing to info@atalanta.run. After that you only receive the service messages your account needs. Unsubscribing does not affect the lawfulness of what was sent before.

To send emails we use Resend (Resend, Inc.). Resend stores your email address and whether you are subscribed, and records when a newsletter was delivered and when a link in it was clicked, so that we can see which topics our readers find useful. We do not use tracking pixels, so we do not know whether you opened an email. Resend acts on our instructions under a data processing agreement; see section 6 for transfers outside the EEA.

In your first days with a new account we send you up to three short emails about getting started: that your training plan is ready, that you can record a run with your phone without a running watch, and - once you have recorded your first run - how the sessions in your plan differ from one another. They contain no details of your activities.

The legal basis is our legitimate interest in helping you actually start using the plan you signed up for (Art. 6 (1) f GDPR, § 7 (3) UWG). You can object at any time, at no cost beyond your own transmission charges: every one of these emails names the address to write to, and most email programs also offer their own unsubscribe button for them.

An objection stops all of it. If you object, you receive neither these emails nor the newsletter afterwards - only the service messages your account needs, such as confirming your email address or resetting your password. Objecting does not affect the lawfulness of what was sent before.

If you sign up for the Atalanta 2 beta on our website, we keep your email address on a separate beta list in order to invite you to the beta personally. Signing up does not add your address to the newsletter list.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give with the checkbox in the form. You can withdraw it at any time by emailing info@atalanta.run, and we will then remove your address from the list. Withdrawal does not affect the lawfulness of processing before it. The list is stored with Resend (see section 3.6) and deleted once the beta ends.

We use OpenAI and Anthropic to analyze anonymized performance data to enhance your training experience. Anonymization means that any identifiers such as your name, email, or device information are removed before analysis. The data shared with these providers cannot be traced back to individual users.

• Providers: OpenAI, Anthropic
• Purpose: To provide insights and recommendations based on anonymized performance data.
• Legal Basis: Based on our legitimate interest in improving training recommendations and providing high-quality Services.

We retain personal data only as long as necessary to provide our Services or as required by applicable law. You may request data deletion at any time by contacting us at info@atalanta.run.

We do not sell your data. However, we may share your information with trusted third-party service providers essential to delivering our Services:

• Render: Application hosting and deployment infrastructure.
• Neon: Managed PostgreSQL database hosting with data stored securely.
• Firebase: Analytics to help us understand app usage and improve our Services.
• OpenAI: Enhancing training recommendations through anonymized data analysis.
• Anthropic: AI-powered data analysis and training recommendations using anonymized data.
• Resend: Email delivery for account messages, the newsletter and the beta list; stores email addresses, subscription status and delivery statistics. Messages are processed in the EU (Ireland).

If data is transferred outside the EEA, we ensure compliance through standard contractual clauses or other legally acceptable measures to protect your data.

To protect your information, we implement technical and organizational security measures, including SSL encryption for data transmission. While we strive to secure your data, no online service is completely secure. We regularly review and update our technical and organizational security measures to protect your data against unauthorized access, loss, or misuse.

You have the following rights regarding your personal data:

• Access: Request a copy of your data.
• Correction: Request corrections to any inaccurate data.
• Deletion: Request data deletion where it is no longer needed.
• Restriction and Objection: Limit or object to certain processing activities.
• Data Portability: Request that your data be transferred to another provider.
• Withdraw Consent: Withdraw consent where it serves as the basis for data processing.

To exercise these rights, please contact us at info@atalanta.run.

Our services are not intended for individuals under the age of 16. We do not knowingly collect data from anyone under this age. If we discover that we have inadvertently collected personal data from a user under 16, we will take immediate steps to delete this information.

We may update this Privacy Policy periodically to reflect changes in our practices or for legal or regulatory reasons. We will notify you of significant changes by updating the "Effective Date" at the top of this page. Your continued use of Atalanta after these changes signifies your acceptance of the revised policy.

We may use automated processes to analyze anonymized workout data for improving training recommendations and optimizing user experience. However, this analysis is solely for the purpose of enhancing our Services and does not involve any automated decision-making that would significantly affect your rights or lead to any legal consequences.

For questions about this Privacy Policy or Atalanta's data practices, please contact us at: