Privacy Policy

Last updated: 4 November 2026

1. Data controller

  • Controller: Pedro Serra Comas, self-employed sole trader, operating the Spotfitr service
  • Tax ID (NIF): 43171443Y
  • Address: Carrer Ric 85, 07420 Sa Pobla, Balearic Islands, Spain
  • Privacy contact: hola@spotfitr.com

We have not appointed a Data Protection Officer because our activity does not fall within the mandatory cases of Article 37 GDPR or Article 34 of the Spanish Data Protection Act (LOPDGDD).

2. Scope and Spotfitr's role

Spotfitr is a tool used by trainers, studios and centres ("professionals") to manage their sessions and their clients' bookings. We therefore process data in two different roles:

  • As controller we process data of visitors to spotfitr.com, account data of professionals and clients (sign-up, login, security, service emails), Pro plan billing and messages you send us.
  • As processor (Art. 28 GDPR) we process, on behalf of each professional, the data of their clients that the professional manages in Spotfitr: sessions, bookings, attendance, waitlists, credits or class packs, recorded payments and notes. The professional or centre is the controller of that data and is responsible for informing its clients and handling their rights; we help them do so. If you contact us to exercise a right over such data, we will forward your request to the relevant professional.

Where a Spotfitr customer is a public authority or public body (for example, a town council managing municipal activities), that body is the controller of the data of people using its activities and Spotfitr acts as its processor under a specific data processing agreement. In that case, please also read the public body's privacy information.

3. Data we process

  • Account data: name, email address, password (stored only as a hash, never in plain text), language, role (professional or client) and, if you add one, your profile picture. For professionals, also the business name and logo, if they add them. If you sign in with Google, we store your Google account identifier and, if you had no picture, your Google profile picture.
  • Service data: sessions, bookings, attendance, cancellations, waitlists, credits or class packs, configured limits, the professional–client relationship and, if the professional records them, the payments received from their clients (amount, method, date and notes).
  • Billing data (Pro plan only): payment details, billing address and, if you provide it, your Tax ID are collected by Stripe on its payment page; we only store the Stripe customer ID, subscription status and invoices. We never see or store your full card number.
  • Notifications: notification preferences and, if you enable push notifications, the technical identifier of your browser or device (web push subscription or Apple token).
  • Google Calendar (optional): if you connect the integration, encrypted OAuth access tokens. We only create, update and delete Spotfitr events in your calendar (calendar.events scope); we do not read your other events.
  • Technical data: IP address, browser, device, access date and time, server logs and error logs.
  • Service usage statistics: the server records basic events (sign-up, login, sessions and bookings created or cancelled, subscription changes) linked to your account's internal identifier, with your role and plan (without your name or email).
  • Browser analytics data (only with your consent): page views, feature usage and, if you separately accept it, session recordings with form fields masked. If you are signed in, they are linked to your account's internal identifier, without your name or email.
  • Communications: messages you send us by email and your contact details.

We do not need health data. Spotfitr has no fields for health data. We ask professionals not to enter their clients' health information in notes or activity names; if they do, they do so under their own responsibility as controllers and must have an appropriate legal basis (Art. 9 GDPR).

4. Purposes and legal bases

  • Providing the service (account, sessions, bookings, invitations, waitlists and alerts): performance of a contract (Art. 6(1)(b) GDPR).
  • Sending service emails and alerts (email verification, password reset, confirmations, booking changes): performance of a contract (Art. 6(1)(b)).
  • Charging and invoicing the Pro plan: performance of a contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c)).
  • Security, abuse prevention and bug fixing (logs, error tracking): our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).
  • Service usage statistics recorded on the server: our legitimate interest in understanding how Spotfitr is used in order to maintain and improve it (Art. 6(1)(f)). You can object by emailing hola@spotfitr.com.
  • Browser analytics and session recording: your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw at any time from the cookie settings.
  • Google Calendar integration and push notifications: you enable them voluntarily; we process the data to provide that feature (Art. 6(1)(b)) and you can switch them off at any time in the settings or your browser.
  • Handling your enquiries and rights requests: legitimate interest and legal obligations (Art. 6(1)(f) and 6(1)(c)).

We do not send marketing communications. If we do so in the future, we will ask for your consent first where required (Art. 21 LSSI-CE) and every message will include an opt-out.

We do not make automated decisions with legal effects or carry out profiling with such effects.

5. Where data is hosted

The app and its database run on the operator's own infrastructure located in Spain. Traffic between your browser and the server is encrypted (HTTPS) and routed through Cloudflare, which provides DNS, the connection tunnel and attack protection.

We also keep a standby server at DigitalOcean, located in Frankfurt (Germany), which is used only if the main server fails.

6. Providers processing data on our behalf

We only share data with providers needed to run the service, under a data processing agreement:

  • Cloudflare, Inc. (USA, global network): DNS, tunnel and traffic protection.
  • DigitalOcean, LLC (USA; server in Frankfurt, Germany): standby server.
  • donDominio (Soluciones Corporativas IP, S.L., Spain): sending service emails and hosting the hola@spotfitr.com mailbox.
  • Stripe Payments Europe, Ltd. (Ireland): payment and management of Pro subscriptions. Stripe also acts as an independent controller for its own obligations (fraud prevention, financial regulation).
  • Cloudinary (Cloudinary Ltd., Israel, and Cloudinary Inc., USA): storage and delivery of the profile pictures and logos you upload.
  • PostHog (PostHog, Inc., with data hosted in the EU): service usage statistics and, only with your consent, browser analytics and session recording.
  • Sentry (Functional Software, Inc., USA): technical error tracking. Error reports include technical data and your account's internal identifier, but not your name or email address.
  • Google (Google LLC / Google Ireland Ltd.): Google sign-in and Google Calendar, only if you use them.
  • Apple (APNs push service) and your browser's push service (e.g. Google, Mozilla or Apple): delivery of push notifications, only if you enable them.

We do not sell your data or share it with third parties for their own purposes, except where required by law (e.g. tax authorities or courts).

7. International transfers

Some providers (Cloudflare, DigitalOcean, Cloudinary, Sentry, PostHog, Inc., Google and Apple) are based outside the European Economic Area or may process data outside it. Such transfers rely on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified, or the decision on Israel) or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

8. How long we keep data

  • Account and service data: while your account is active. If you close it, we delete the data within 30 days, except as set out below. Encrypted backups are overwritten within two months at most.
  • Data processed on behalf of a professional or public body: as instructed by them; at the end of the service it is returned or deleted under the processing agreement.
  • Invoices and accounting records: for the periods required by Spanish commercial and tax law (up to 6 years under Art. 30 of the Commercial Code, and the tax limitation period under Art. 66 of the General Tax Act).
  • Server logs and error logs: up to 90 days.
  • Analytics data: up to 12 months, or until you withdraw consent.
  • Email enquiries: as long as needed to handle them and then up to 12 months.

Where required by law, data is kept blocked (Art. 32 LOPDGDD), available only to courts and competent authorities during the limitation period for any liabilities.

9. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): encryption in transit (HTTPS), hashed passwords, encrypted third-party tokens, encrypted backups, system access restricted to the operator and error monitoring. If a personal data breach affects your data, we will act in accordance with Articles 33 and 34 GDPR.

10. Minors

Professionals must be adults. Clients may create their own account from the age of 14 (Art. 7 LOPDGDD). For children under 14, the account may only be created or authorised by a parent or legal guardian, or by the professional or body managing it with that authorisation.

11. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability (Arts. 15–22 GDPR), and withdraw any consent at any time, by emailing hola@spotfitr.com. We may ask for additional information to verify your identity. We will reply within one month, extendable by two further months for complex requests (Art. 12(3) GDPR). In your profile in the app you can view and correct much of your data and download a full copy in a structured format (JSON); to delete your account, email us.

If your data is managed by a professional or public body through Spotfitr, you can contact them directly; if you write to us, we will forward your request.

12. Complaints

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), the competent supervisory authority (Art. 77 GDPR). We would appreciate the chance to resolve it first.

13. Cookies

We use technical (necessary) cookies and similar technologies and, only with your consent, analytics cookies. Full details are in the Cookie Policy.

14. Changes to this policy

We may update this policy when the service, providers or law change. We will show the date of the latest update and, for significant changes, notify you by email or in the app before they apply.

This English version is a translation; in case of discrepancy, the Spanish version prevails.

Cookie preferences

We use essential cookies to keep the site running and, with your consent, analytics cookies to improve the product. You can accept them, reject them or choose by category. Cookie Policy