Privacy Policy
CatchLab is a product of AartsProCyclingSupport, a registered Dutch sole proprietorship (ZZP) operating under Dutch law. This policy explains what data we collect, why, and how we handle it.
1. Who we are
Data controller:
- Company: AartsProCyclingSupport
- Chamber of Commerce (KVK): 88070808
- Email: gilles@aarts-pcs.nl
- Country: The Netherlands
2. What data we collect
We collect the minimum data necessary to operate CatchLab:
- Account data: Email address and hashed password for coach login
- Club data: Club name, logo, primary colour for branding
- Athlete data: Athlete names and, optionally, third-party platform credentials (athlete ID and API key for intervals.icu or TrainingPeaks)
- Device data: A random device identifier generated locally, used for license management
- Session metadata: Session names and export timestamps for license validation purposes
We do not store raw Peach telemetry files, FIT files, or heart rate data on our servers. All performance data is processed locally on the coach's device.
3. How we use your data
- To authenticate coaches and validate licenses
- To display club branding in the desktop application
- To push FIT files to athlete accounts on connected training platforms
- To manage and verify active device sessions
We do not use your data for advertising, profiling, or any purpose beyond operating CatchLab.
4. Legal basis (GDPR)
We process personal data on the following legal bases:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the CatchLab service under our license agreement
- Legitimate interest (Art. 6(1)(f)): Device identification for license protection
- Consent (Art. 6(1)(a)): Where you voluntarily provide athlete credentials for third-party platform integration
5. Data storage and security
- Account and athlete data is stored in Supabase, hosted in the EU (Frankfurt, Germany)
- Athlete platform credentials (API keys) are encrypted at rest
- All data transmission uses TLS encryption
- We do not store payment data — no financial information passes through CatchLab
6. Third-party services
CatchLab integrates with the following third-party services. Data is only sent to these services when you explicitly use the relevant feature:
- Supabase (supabase.com) — database and authentication, EU-hosted
- Vercel (vercel.com) — hosting for our license server and website
- intervals.icu — when you push sessions to an athlete's account
- TrainingPeaks — when you push sessions to an athlete's account
We have data processing agreements in place with Supabase and Vercel. For intervals.icu and TrainingPeaks, data is sent only at your explicit instruction.
7. Data retention
- Account data is retained for the duration of your license
- Athlete data is retained until you delete it from the application
- Session logs used for license validation are retained for 90 days
- On account closure, all personal data is deleted within 30 days
8. Your rights (GDPR)
As a data subject under GDPR you have the right to:
- Access: Request a copy of the data we hold about you
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing based on legitimate interest
- Restriction: Request that we restrict processing of your data
To exercise any of these rights, email gilles@aarts-pcs.nl. We will respond within 30 days.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
9. Cookies
The CatchLab desktop application does not use cookies. The catchlab.app website uses no tracking cookies or analytics. The only cookies used are those strictly necessary for authentication on admin.catchlab.app.
10. Children
CatchLab is intended for use by coaches and club administrators. We do not knowingly collect data from persons under 16 years of age. If you believe a minor has provided us with personal data, please contact us immediately.
11. Changes to this policy
We may update this policy as the product evolves. Material changes will be communicated by email to registered coaches. The date at the top of this page reflects the most recent update.
12. Contact
For any privacy-related questions or requests:
- Email: gilles@aarts-pcs.nl
- Company: AartsProCyclingSupport, The Netherlands