Who processes your data
Brod is an application by Germán Ezequiel Laso Andino, trading as ProfBlu. He is the data controller for your account and for the platform that runs the application.
- Owner: Germán Ezequiel Laso Andino, sole trader (libero professionista).
- VAT number (Partita IVA): 04702090988.
- Italian tax code (codice fiscale): LSNGMN88S04Z600M.
- Professional activity not registered in the Italian Business Register (no REA number).
- Contact address: Via della Sega 1, 38080 Verdesina, Porte di Rendena (TN), Italia.
- Email for anything about your data: privacidad@profblu.com.
No data protection officer has been appointed: the law does not require one for an activity of this size. Write to the address above and the person responsible will answer.
Two different roles: your club and us
Brod is a coach's tool for their athletes. That splits responsibility in two, and it is worth saying plainly because it changes whom you ask for what:
- We are responsible for your account. Email, name, password, sessions, preferences, notifications: that is the ProfBlu identity you sign in with, and we process it as controller.
- Your club is responsible for your athlete profile and your training — the coach or organisation that registered you. It decides what it keeps about you, why and for how long, and it asks for your consent when consent is needed. We process that data on its behalf and following its instructions (Article 28 GDPR): we store it, show it to whoever the club authorises, and do nothing else with it. That arrangement is not left implied: it is written down and published in the data processing agreement, which your club accepts when it signs up.
In practice: you delete your account and download your data yourself, from the application; to have your club remove or correct your profile, talk to your coach. If we receive a request about data managed by your club, we pass it on.
What data we process
What follows comes from the application's code, not from a generic list. If it is not here, it is not stored.
About your account
- Email address, first and last name and, if you choose one, a username.
- Your password, never in plain text: it is stored as a hash (bcrypt). We cannot read or recover it, only check whether the one you type matches.
- If you sign in with Apple there is no password: we store that the provider is Apple and the identifier Apple returns, together with the email and name Apple sends us.
- Preferences: language, time zone and date, time and number formats.
- The date and time you accepted the terms of use.
- Whether the account is active and which role you hold in each organisation.
- For each open session, the device identification your phone sends (the "User-Agent" string) and when it was last used, so you can see and close sessions you do not recognise.
- The push notification identifier of each device on which you enabled notifications.
- If you came in through an invitation, the invitation itself: the email address it was sent to, who sent it, to which organisation, when it expires and whether it is still pending, was accepted, expired or was withdrawn. It exists before you have an account, because it is what creates one.
About your athlete profile, as your club fills it in
First and last name, email and phone if given, date of birth, sex, height and body weight, with the history of weigh-ins and the notes the coach writes; and your personal bests — the maximum per exercise — with date and notes.
Part of this is information about your body, which the law treats as a special category. That is why your club enters it — the club knows you and asks your permission — and why we use it for nothing but showing it to you and your coach. There is no diagnosis, no medical advice and no health calculation: Brod records what you train.
About your fees, if your gym keeps them in Brod
The gym has a screen, "Fees", where it notes what you owe it and what you have paid. For each charge we store whose name it is in — yours — and your email address, the amount, the due date, the status (pending, paid, waived or overdue) and when it was paid.
That is decided by your gym, which is the controller of that ledger just as it is of your profile. And the money does not go through Brod: inside the application there is no charging and no payment gateway to pay a fee; it is the gym that marks it by hand as paid or waived. We neither store nor see any card data, because there is no card.
About what you train
The plan your coach prepares (title, notes, technique cues per exercise), the time you said you would train, each session (status, rests, notes) and the set-by-set log: repetitions, weight, time, the note you write and the moment you finished it.
About the club
The name and logo your club signs the application with and the language it uses. And, if the club signed up by itself, its billing card: legal and trading name, country, tax identifier, tax regime, address, billing email address and — in Italy — the recipient code or the PEC address for electronic invoicing.
That is the organisation's data, not yours. It is worth saying that when the gym is a single person — a coach working on their own — that organisation data is also that person's data, and we treat it with the same care.
About the server and errors
As in any Internet service, the server logs each request — IP address, date and time, resource requested and device agent — to operate the service and detect abuse. When the server fails, it stores the error with its technical trace and, if a session was open, the identifier of the account that triggered it, so we can fix it. None of this is cross-referenced for commercial purposes.
What your phone stores, and what it does not
- Your session credentials are kept in the phone's own secure storage and never leave the device.
- What you log while training is also stored on the phone, so you can train without coverage, and is sent to the server when coverage returns.
- Calendar: only if you allow it, Brod writes the time you will train into your calendar. It writes that event; it does not read or copy the others.
- Face ID or fingerprint: only if you enable it, to get back in without typing. The system tells us "yes" or "no"; biometrics never reach the application or the server.
- Notifications: only if you accept them. We notify you when your coach publishes a new week. You can choose which alerts you receive in Profile → Notifications or turn them off in the system settings.
- Brod does not access your photos, camera, contacts or location, carries no analytics or advertising, and does not track you across apps. That is not a statement of intent: nothing in the code does it.
Why, and on what legal basis
- To provide the service — open your account, let you in, show you your plan, store what you train: what is necessary to perform what you accepted when using Brod.
- To process data about your body — weight, height, sex, date of birth, personal bests: with your explicit consent, which your club asks for when registering you and which you can withdraw at any time by talking to it or writing to us.
- To notify you — a new week, a notice about your account: with your permission, given when you accept notifications and withdrawn by turning them off. Emails about your account (invitation, password reset) are service emails, not marketing.
- To keep the service running — server logs, errors, abuse control, backups: on our legitimate interest in it working and being secure.
We do no profiling, no advertising, no automated decisions that affect you, and we neither sell nor share data for commercial purposes.
Where it is processed, and who else sees it
- Hetzner hosts the server in Nuremberg (Germany). Backups, encrypted, are kept in the same provider's object storage in the same region and retained for 35 days. All within the European Economic Area.
- IONOS delivers outgoing email (invitations, account notices) from its Spanish region.
- Expo (Expo, Inc., United States) relays push notifications: it receives your device identifier and the text of the alert to hand it to Apple or Google. It is the only piece of daily operation outside the EEA, and it runs under the safeguards of Chapter V GDPR (standard contractual clauses).
- Apple is involved if you sign in with Apple — to verify access — and as the store distributing the application. It processes that data under its own terms. If you prefer to avoid it, sign in with email and password. During TestFlight testing, Apple may share crash reports with us if you authorise it in TestFlight.
- Google will be involved in the same way once Brod is distributed through Google Play.
- Within your club, your coach and the people with permission see your profile and your training. Other athletes do not.
Brod's web pages — the landing page, these documents and the panel — serve their own typefaces from our server and load nothing from third parties: opening them sends your IP address to nobody — not to Google, not to anyone else.
There is nobody else.
For how long
As long as your account exists. When you decide to leave, you delete it yourself from the application: Profile → Delete my account. There is nobody to write to and nothing to wait for.
Deletion is immediate. This is what disappears: the email address, the name, the password, the open sessions and the notifications; everything that makes up the account you sign in with. And this is what stays, because we cannot delete it: what invoicing law obliges us to keep, and the record that you accepted the terms, with its date and version, which is the proof that that consent existed. Your copy in the backups, which are encrypted, disappears with their rotation, after 35 days.
There is one exception and we say it plainly: if you own a gym you cannot simply delete yourself. Your account holds up other people's data — your athletes, their profiles and their training — and deleting it would leave nobody answering for them. First you have to hand the gym over to someone else or close the gym; once the gym no longer depends on you, your account is deleted like any other.
Your profile and training data are kept by your club for as long as it decides; ask the club, or ask us and we will pass it on. When your club removes you, your profile is deactivated: you stop appearing and stop getting in, but it stays stored until its erasure is requested.
Your rights
You may exercise the rights the General Data Protection Regulation gives you: access (know what we hold), rectification (correct it), erasure (delete it), portability (receive it in a machine-readable format), objection (to what we do on legitimate interest), restriction (keep it without using it while something is resolved) and withdrawal of consent without affecting what was done before.
Access and portability no longer have to be requested: you download your data yourself from the application, in Profile → Download my data, in a format another machine can read; and a gym downloads its own from its panel. You change your account data yourself in Profile → Edit profile, and you delete the account yourself in Profile → Delete my account.
For everything else — correcting what you cannot change yourself, objecting, restricting, withdrawing a consent or asking anything — write to privacidad@profblu.com from your account email. We reply within the legal deadline, one month at most.
In any case you may complain to a supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in Spain, the Agencia Española de Protección de Datos (www.aepd.es); or the authority of the EU country where you live.
Minors
Brod is not directed at children under fourteen and we do not offer it to them directly. If a club registers a minor athlete, the club guarantees that it holds the authorisation of the person with parental responsibility or guardianship. If we detect a minor's account without that authorisation, we close it.
Security
Communications are encrypted (TLS), passwords are stored as hashes, credentials live in the phone's secure store, backups are encrypted, and access to data within the platform depends on each person's role in their club. If we detect a breach that affects you, we will tell you, and the supervisory authority within the 72 hours the law sets.
Changes
If we change what we do with data, we change this text and move the revision date. When the change is significant, we also notify account holders inside the application or by email.