Privacy Policy — PREVAIL Endurance

Last updated: 22 October 2026 · Version: 1.6

This English version is a translation of the French privacy policy, provided for convenience. The French version is the reference text and prevails in the event of any discrepancy.

1. Who is responsible for your data?

The data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is:

Identity: PREVAIL Endurance — Clément BOYER, sole trader (French micro-entreprise)
SIRET: 10756230800018, French National Business Register (RNE)
Registered office: 1 Avenue Alphand, 75116 Paris, France
Contact: contact@prevail-endurance.com

For any question about your personal data, write to this address. We reply within 30 days at most (Article 12 GDPR).

2. What data do we collect?

2.1 Data you provide directly

When you create your account and use PREVAIL, we collect:

Identification data: email address, first name
Self-reported sports data: sport, goal (e.g. 70.3, Ironman, marathon), target race date, level (beginner / intermediate / advanced / elite), weekly training time available
Optional physical data: age, height, weight (or range), available equipment
Physiological thresholds: FTP (cycling), CSS (swimming), VMA (maximal aerobic speed, running), maximum heart rate, custom zones
Personal records: times over various distances (5 km, 10 km, half marathon, marathon…)
Injuries and medical constraints: area, date of onset, current status (health data within the meaning of Article 9 GDPR — processed on the basis of explicit consent)
Daily check-ins: sleep quality, perceived fatigue, stress, pain (health data)
Messages exchanged with the AI coach: text content of your conversations, inferred preferences (length, tone, frequency)
Explicit feedback: thumbs up or down, notes left on recommendations

2.2 Data collected automatically

Completed training sessions: type, duration, intensity, rating of perceived exertion (RPE), status (completed / missed / rest)
Date and time you last opened the app, to know whether you have been away for several days
Session information: at each sign-in, the device identification sent by iOS (“user agent”) and the session expiry date, kept for the life of the session to detect fraudulent reuse; and, for each device, an Apple attestation key (App Attest) proving that requests really come from the PREVAIL app
AI coach usage: for each reply, the feature used, the model, the number of tokens and their cost, to cap the spending of each account

2.3 Data from the services you connect (with your consent)

If you link PREVAIL to one of these services, we receive the data below, through an authorisation (OAuth 2.0, or the iOS permission for Apple Health) that you can withdraw at any time:

Garmin Connect
- What we read: your activities (sport type, duration, distance, pace, power, cadence, heart rate, laps and intervals), your sleep duration, your heart rate variability (HRV) and your resting heart rate.
- What we write: only at your request, a session from your plan, sent to the calendar of your Garmin Connect account so that your watch guides you (blocks, durations, pace, power or heart rate targets). If your plan adapts, the session already sent is updated. PREVAIL does not create, modify or delete any recorded activity.
- How the connection works: today through SweatStack BV, our aggregator, which holds the authorisation for your Garmin account (section 4.1). Once our access to the Garmin Connect Developer Program is granted, it will also be possible to connect directly with Garmin, without an intermediary.
WHOOP: recovery (score, HRV, resting heart rate, blood oxygen saturation, skin temperature), sleep, strain, workouts and body measurements (height, weight, maximum heart rate). Read only.
Apple Health (HealthKit): heart rate, HRV, sleep and workouts, read on your iPhone and then sent to our server. Read only: PREVAIL writes nothing to Apple Health.
Strava: your activities (sport type, duration, distance, average and maximum power, average and maximum heart rate, pace, cadence, elevation gain, suffer score), your athlete profile (first name, last name, public profile photo, FTP and weight if provided) and activity metadata (name, description, private / public status, kilojoules, calories). The GPS track of an activity is read on demand to display its route, without being stored. Read only: PREVAIL never posts on your behalf (scopes read, activity:read_all, profile:read_all, no write scope).

These connections are optional: without them, PREVAIL works with the data you enter yourself. You can turn them off at any time in the app, under Réglages › Sources de données (Settings › Data sources), or from the service concerned (your Garmin Connect account, the WHOOP app, Settings › Health on your iPhone, https://www.strava.com/settings/apps for Strava).

2.4 Launch waiting list (public website)

On www.prevail.fr, even before an account exists, you can ask to be told the day the app is released on the App Store. In that case — and only in that case — we record:

Your email address, as you type it
The page the request comes from and its date
The language of that page (French or English), so that we write to you in the same language
The date the acknowledgement was sent, then that of the launch announcement, once each has gone out

Nothing else: no first name, no IP address, no browser identifier, no pages viewed. This address is used for two messages only: an acknowledgement of your sign-up, then the announcement on launch day. Both are sent from contact@prevail-endurance.com, through PREVAIL's Google Workspace email (section 4.1). It is never sold, never used for any other purpose, and never matched with a PREVAIL account you might create later.

The legal basis is your consent (Article 6(1)(a) GDPR): this entry exists only because you filled in this field under the sentence stating its purpose. To have it removed, reply “stop” to the email you received or write to contact@prevail-endurance.com: deletion is final, requires no justification, and does not affect any other processing.

2.5 Data we do NOT collect

Under the data minimisation principle:

❌ No continuous location data, and no GPS track stored on our servers
❌ No biometric identification data (fingerprint, facial recognition)
❌ No medical data beyond what coaching strictly requires (no diagnosis, no treatment)
❌ No data from your other apps or your browser, beyond the services you connect yourself (section 2.3)
❌ No audience measurement or behavioural analytics: PREVAIL embeds no third-party tracker (no Google Analytics or equivalent), and records neither the screens you open nor the buttons you tap
❌ No AI performance metrics tied to you: no latency, no error rate

3. Why do we collect this data?

Each piece of data has a specific purpose. Here is the detail, in line with the purpose limitation principle (Article 5(1)(b) GDPR).

Data	Purpose	Legal basis
Email + password	Signing in to the service	Performance of the contract (Art. 6(1)(b))
Sports profile + goals	Generating personalised training plans	Performance of the contract
Physiological thresholds + records	Calibrating training zones and paces	Performance of the contract
Daily check-ins (sleep, fatigue)	Adapting the plan in real time	Explicit consent (Art. 9(2)(a)) — health data
Injuries and constraints	Internal medical protocol + plan adaptation	Explicit consent — health data
AI coach messages	Contextual conversation + learning your preferences	Performance of the contract
Data from connected services (Garmin, WHOOP, Apple Health, Strava)	Measuring your load and recovery, adapting your sessions, informing the coach's replies	Explicit consent — health data
Sessions sent to your Garmin watch	Guiding you during the session	Performance of the contract, at your request
AI coach usage	Capping the spending of each account	Legitimate interest (Art. 6(1)(f))
Server technical logs	Security, detecting and fixing faults	Legitimate interest (Art. 6(1)(f))
Waiting list email address (public website)	Acknowledging your sign-up, then telling you on the day the app is released on the App Store	Consent (Art. 6(1)(a)) — can be withdrawn at any time

We do not process any data for targeted advertising, resale, or third-party commercial purposes.

4. Who do we share your data with?

4.1 Technical processors (Article 28 GDPR)

We use technical service providers bound by GDPR-compliant data processing agreements (DPAs):

Railway Corporation (hosting of the server and the PostgreSQL database) — data hosted in the European Union. DPA available.
Anthropic, PBC (provider of the coach's AI) — see section 4.2.
Google (Google Workspace) (PREVAIL's email) — delivers the emails sent to waiting list subscribers, from contact@prevail-endurance.com. Only the subscriber's address and the text of the message are passed on to it.
SweatStack BV (training data aggregator, with your explicit consent) — holds the authorisation for your Garmin account, sends us your sessions and measurements, and delivers to your watch the sessions you send to it. Can be revoked at any time from PREVAIL (Réglages › Sources de données) or from your Garmin account.

4.2 Processing by the coach's AI

To reply to you and to write the Cockpit readings (after a session, and on your form), PREVAIL sends Anthropic, PBC (the company behind Claude), from its server:

your messages to the coach;
a summary of your training data: sports profile, plan, recent sessions (including those received from Garmin or another connected service), sleep, HRV, resting heart rate, training load, reported injuries. This summary is only put together if you have given your consent to health data processing.

We add neither your name, nor your email address, nor your account identifier. Anthropic does not use this data to train its models, keeps it only for a limited period, then deletes it. Anthropic is based in the United States: these transfers are governed by the European Commission's standard contractual clauses (SCCs).

4.3 The services you connect

Garmin, WHOOP, Apple and Strava are not our processors: each remains responsible for the data in your account with them, under its own privacy policy. When you link one of them, PREVAIL becomes the controller of the data it sends us, within the limits of section 2.3.

4.4 No resale, no commercial sharing

We do not sell any data to third parties. We do not share any data for advertising or third-party marketing purposes. None of your data is used to train an artificial intelligence model, either by PREVAIL or by Anthropic. Our only revenue comes from user subscriptions.

5. Where is your data stored?

Main database: Railway (managed PostgreSQL), European Union region
Encryption at rest: AES-256
Encryption in transit: TLS 1.3
Backups: encrypted, daily, kept for 30 days at most
Access logs: kept for 90 days for security auditing

Data leaving the EU (data sent to Anthropic in the United States, waiting list emails delivered by Google) is transferred under the standard contractual clauses (SCCs) approved by the European Commission.

6. How long do we keep your data?

Category	Retention period
Active account	As long as the account exists
Performance and training data	Life of the account + 30 days after deletion (backups)
AI coach messages	Life of the account, with progressive compression (monthly summaries after 40 messages)
AI coach usage	Life of the account
Access and security logs	90 days
Sessions and measurements already imported, after disconnecting a source	Kept: disconnecting stops the import, it does not erase the history already built up — deleting the account takes precedence, as does an erasure request (section 7)
Billing data (if applicable)	10 years (legal tax obligation)
Inactive account (>24 months without sign-in)	Notification, then automatic deletion after 3 months without response
Waiting list email address	Until the launch message, then deleted within 30 days — or immediately on request

7. What are your rights?

Under Articles 15 to 22 GDPR, you have the following rights at all times:

7.1 Right of access (Art. 15)

Obtain a copy of all the data we hold about you, in a readable format. How: in the app, Réglages › Données et confidentialité › Exporter mes données (Settings › Data and privacy › Export my data), or a written request to contact@prevail-endurance.com.

7.2 Right to rectification (Art. 16)

Correct inaccurate or incomplete data. How: directly in Réglages › Profil sportif (Settings › Sports profile).

7.3 Right to erasure / right to be forgotten (Art. 17)

Ask for all your data to be deleted. How: Réglages › Compte et abonnement › Supprimer mon compte (Settings › Account and subscription › Delete my account). Full deletion within 30 days at most (backups purged within a further 30 days).

7.4 Right to restriction of processing (Art. 18)

Temporarily block the processing of certain data. How: write to contact@prevail-endurance.com, specifying the data concerned.

7.5 Right to data portability (Art. 20)

Receive your data in a structured format (JSON) to transfer it to another service. How: Réglages › Données et confidentialité › Exporter mes données (downloadable JSON file).

7.6 Right to object (Art. 21)

Object to processing on grounds relating to your particular situation. How: write to contact@prevail-endurance.com.

7.7 Right to withdraw consent

For processing based on consent (health data, connected services), you can withdraw your consent at any time, without affecting the lawfulness of past processing. How:

Disconnect Garmin or another service: Réglages › Sources de données (Settings › Data sources)
Withdraw your consent to health data processing: Réglages › Données et confidentialité › Mes données santé (Settings › Data and privacy › My health data), at any time. You can also write to contact@prevail-endurance.com (note: withdrawing it significantly limits coaching features; see section 9)

7.8 Right to lodge a complaint with the CNIL

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority:

https://www.cnil.fr/
CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

8. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction (Article 32 GDPR):

Encryption at rest (AES-256) and in transit (TLS 1.3); the access tokens for your connected accounts are also encrypted individually (AES-256-GCM)
Authentication by JWT with expiry + automatic refresh
Application isolation: every request is filtered by the authenticated user's identifier, so that each user can only access their own data
No sensitive API key exposed on the client side — all partner keys (Anthropic, SweatStack, Garmin, WHOOP, Strava) are stored in encrypted server environment variables
Regular security audits, and access logs kept for 90 days
In the event of a data breach, notification to the CNIL within 72 hours, and to the users concerned if the risk is high (Articles 33 and 34 GDPR)

9. Service limits without full consent

Some of PREVAIL's core features rely on processing health data (Article 9 GDPR) and require your explicit consent:

Without consent to health data processing: we cannot generate plans adapted to your sleep, fatigue or injuries. The app works in a reduced mode (static plans, no real-time adaptation).
Without a connected service: you enter your sessions and how you feel yourself, and sending sessions to your watch is not available.

You always keep full control and can withdraw your consent at any time.

10. Changes to this policy

This Privacy Policy may change. The version and the date of the last update appear at the top of this document: they are authoritative, and this page is permanently public.

A change that would extend the use of your health data would only take effect after a new explicit consent on your part, requested in the app. Without that consent, processing would remain as set out in the version you accepted.

The version history is kept and available on request.

11. Contact

For any question, complaint, exercise of your rights or request for information:

Email: contact@prevail-endurance.com
Post: PREVAIL Endurance — Clément BOYER (sole trader), 1 Avenue Alphand, 75116 Paris, France

Guaranteed response time: 30 days at most (Article 12(3) GDPR).