Back to Home

Privacy Policy

Last updated: 17 September 2026 · Version 2026-09-17

Introduction

AAMAAS Coaching is committed to protecting your privacy. This privacy policy explains how we collect, use, and protect your personal information when you use the website, book a session, or use the training portal.

What your coach can see

Your coach sees everything the system holds about you: planned and completed sessions, the comments the two of you write to each other, day form and your optional wellness log (alcohol, perceived sleep quality, stress, travel, illness and muscle soreness, if you have turned it on) – and blood donation, if you have separately turned that on under Settings – injury and illness periods your coach logs directly, activities and watch-measured health data (resting heart rate, HRV and sleep) pulled from intervals.icu, the position track (GPS) and elevation profile for a completed outdoor session – fetched directly from intervals.icu when you or your coach opens the session, without us storing it, see the separate point under "Connecting to intervals.icu" – the routes you have drawn in the route planner — including the starting point, which is often where you live — your bookings and what you have paid, plus date of birth and gender if you have filled them in yourself in your profile in the portal. The coach also keeps internal notes about you that you do not see yourself. No other person has access to that content – see "Data processors and other recipients" below for who runs the system itself.

What information do we collect?

When you use our contact form, we collect the following information:

  • Name – to address you personally
  • Email address – to respond to your inquiry
  • Phone number (optional) – for alternative contact
  • Message content – to understand your inquiry

The contact form is not stored in our database. Your message is forwarded as an email – see "Data processors and other recipients" below for where it actually ends up.

The chat assistant on the website

If you use the chat on the public pages, what you write and the assistant's replies are stored for 30 days, together with which page you started on, your chosen language and an email address if you send a message through the chat. This is used to answer you and to improve the service, and only Nikolai can read the conversations. The messages are processed by Anthropic, which provides the AI model behind the assistant. Please don't share health details or other sensitive information in the chat. The conversation is deleted automatically after 30 days, and you can ask for it to be deleted sooner by emailing kontakt@aamaascoaching.no.

Information collected when booking

When you book a session, the following is stored in order to carry out and follow up on the agreement:

  • Name, email address and phone number
  • Which session you booked, the time, location and price
  • Any message you write yourself in the booking form
  • Whether the session has taken place and been invoiced, including any invoice reference and internal note
  • Timestamp, IP address and browser information for the consents you give — stored as documentation that consent was actually given
  • A log of which confirmation and reminder emails were sent to you, when, and whether the send succeeded
  • A unique token in your cancellation link, which lets you cancel the booking without logging in

Information in the training portal

If you have been given access to the training portal, the following is also stored:

  • Training plans and session descriptions your coach has created for you
  • Completed sessions, self-reported perceived exertion (RPE), and duration or distance you have entered yourself
  • Day form, plus alcohol intake, perceived sleep quality, stress, travel, illness and muscle soreness (all 1–5), if you have turned on the optional logging feature — see the separate point below
  • The comment thread between you and your coach. It currently cannot be deleted from the portal, regardless of who wrote it
  • Injury and illness periods you or your coach have registered
  • Vacation and restriction notes, and competitions you have entered
  • Your coach's internal info panel about you — unlike the private notes on your customer record, you can read this yourself
  • Date of birth and gender, if you have filled them in yourself in your profile
  • Manual per-split measurements you or your coach record on a completed session — for example lactate values and treadmill speed — tagged with who recorded them
  • Routes you draw in the route planner: the points you place on the map, the line calculated between them, total distance, elevation gain if you ask for it to be calculated, plus the name and sport you give the route. The points are location data — if you start a route from home, the starting point shows roughly where you live

Your login account

If you are given access to the training portal, a login account is created for you with our sign-in provider, Supabase Auth. You can set a password, or sign in with a one-time link sent by email. Such a link IS a login — never share it. If it goes astray, get in touch immediately.

Connecting to intervals.icu

If the connection between the training portal and intervals.icu has been set up for you, the following applies:

  • Your API key is stored encrypted (AES-256-GCM) with us, with the encryption key held only in our server environment — never in the database or in the code
  • A theft of the key itself from the intervals.icu side does not give access to anything of ours, but it does give write, and in all likelihood delete, access to your intervals.icu account, since the key functions as a login there
  • We fetch activity data: sport, time, duration, distance, speed, power, heart rate, elevation gain and – when you open a completed session – position data (GPS track), see the separate point below. We also fetch daily health measurements from your watch: resting heart rate, HRV (heart rate variability) and sleep duration, whenever your intervals.icu account has them
  • We additionally store the entire original response from intervals.icu for each activity, not just the selected measurements above. It may contain a free-text activity title and description, device names, and potentially location data, depending on what you have entered or enabled there
  • You can withdraw the key at intervals.icu yourself at any time, independently of us
  • Of the daily health response from intervals.icu we store only the three measurements above — resting heart rate, HRV and sleep time. The rest is discarded on import. Health responses fetched before this change were stored in full; these are being deleted.
  • If you open a completed session with a GPS track in the portal, we fetch the position track and elevation data for that specific session directly from intervals.icu, to display them in a map and an elevation profile. The track is fetched fresh every time you open the session, and is not stored by us — it only lives temporarily in your browser while the page is open. Your coach can see the same map, for your own sessions, the same as the rest of your training data

Calendar subscription

The portal gives you a personal calendar address for your training plan. The address contains a secret token — a bearer credential in the URL, in the same way a password is. Anyone who gets the address can see your training plan. You can rotate it to a new address under settings at any time. If you subscribe to the address in a calendar app (Apple, Google, Outlook or similar), that provider fetches and stores your training plan itself.

Training and test data

Test results, training data and session notes may qualify as health information. The same applies to measurements from your watch or heart-rate strap, fetched via intervals.icu — resting heart rate, HRV and sleep duration are among the clearest examples. Such information is a special category of personal data under Article 9 of the GDPR, and is therefore processed only on the basis of your explicit consent. You give that consent when booking, or at your first login to the training portal if your coach has invited you directly. It is necessary in order to deliver follow-up, reports and progress measurement. You may withdraw it at any time.

Optional logging – day form and wellness

Optional logging is separate from the mandatory consent above, and requires its own, freely given consent that is not pre-ticked. Under this consent you can log your day form, plus six daily measures — alcohol intake, perceived sleep quality, stress, travel, illness and muscle soreness — each on a 1–5 scale. Alcohol and illness are special category data under GDPR Article 9. Under Settings you can separately, additionally, turn on logging of blood donation (yes/no per day) — this too is a special category of personal data, and the field is off by default until you turn it on yourself. Your coach sees what you log here, the same as the rest of your training data — see "What your coach can see" at the top of this page. The portal works fully without it — calendar, session details, comments, booking and everything else is unaffected. You can turn it off at any time under settings in the portal. Turning it off deletes every value you have already logged under this consent — day form, the six wellness measures and blood donation — immediately. They are not merely hidden.

Legal basis for processing

Processing rests on different bases depending on what the information is used for:

  • Performance of the contract (Art. 6(1)(b)) for booking, contact details and carrying out the session
  • Explicit consent (Art. 9(2)(a)) for training and test data, given when booking or at first login to the portal
  • Freely given consent (Art. 6(1)(a)) for the optional logging (day form, sleep quality, stress, travel and muscle soreness), and additionally explicit consent (Art. 9(2)(a)) for alcohol, illness and — if you have separately turned it on under Settings — blood donation, within that same optional log, since those are special category data. Separate from the consent above and with no bearing on the rest of the service
  • Legal obligation (Art. 6(1)(c)) for accounting and invoicing records

How do we use your information?

We use your information to:

  • Respond to inquiries and questions
  • Deliver coaching services you have requested
  • Improve our services and website

How do we protect your data?

We take data security seriously and implement appropriate technical and organizational measures to protect your personal information against unauthorized access, modification, disclosure, or destruction.

Concrete security measures

Some technical measures, specifically:

  • Row-level security (RLS) is enabled in the database for every single table holding information about you — access is governed by who you are, not by the interface
  • Your intervals.icu key is encrypted (AES-256-GCM) with a key that exists only in our server environment, never in the database, the code, or a log
  • Your coach has the broadest access of anyone, see "What your coach can see" at the top of the page — this is deliberate, since AAMAAS Coaching is a one-person business where the coach follows you up directly

Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access – you can request a copy of the information we hold about you
  • Right to rectification – you can request that inaccurate information be corrected
  • Right to erasure – you can request that your information be deleted
  • Right to restriction – you can request restricted processing
  • Right to data portability – you can request to have your data transferred
  • Right to object – you can object to certain types of processing

How long information is kept

Information is not kept longer than necessary. Deletion happens largely manually, on request to your coach — with one exception noted below:

  • Bookings and invoicing information are kept for five years after the end of the financial year, as required by the Norwegian Bookkeeping Act. If you request full deletion of your customer relationship, your booking history is therefore retained for this period — but the name, email, phone number and notes on your customer record are anonymised instead of deleted
  • Training and portal data (plans, comments, day form, the wellness log, activities and watch-measured health data fetched via intervals.icu, routes you have drawn, and more) is kept until you request deletion, or by default for up to three years after your last session — this is a policy, not an automated job in the system
  • Contact details on your customer record are deleted or anonymised on request, unless they form part of accounting records as noted above
  • Enquiries via the contact form on the homepage exist only as email, not in our database, and are deleted or kept according to normal email practice once answered
  • The consent log (what you consented to, when, and from which IP address and browser) remains linked to your customer record and booking history even after your customer relationship ends and your customer record is anonymised. It does not itself contain your name or email — only the timestamp, consent type, IP address and browser information — which is exactly what makes it proof of who consented to what
  • IP addresses and other identifiers tied to rate limiting on login, booking and the chat assistant are automatically deleted by a job that runs every hour, at most a day after they were stored
  • Conversations with the chat assistant are deleted automatically by the same hourly job 30 days after the conversation started

Requesting deletion

There is no self-service deletion in the portal — you ask your coach directly, for example by email:

  • Contact details and training/portal data are deleted or anonymised
  • Bookings and invoicing records are kept for five years as described above. Your customer record is anonymised rather than deleted, so that your booking history (accounting records) survives without still being tied to your name
  • The consent log is retained as documentation and remains linked to your anonymised customer record — it does not itself contain your name or email, only the timestamp, consent type, IP address and browser information, see the retention point above
  • We normally respond within 30 days

Data processors and other recipients

I use a few providers that process information on my behalf, and a few third parties that receive information in other ways. Not everything is within the EU/EEA, and not everything is covered by a confirmed data processing agreement — see the reservation below the list:

  • Supabase — database for bookings, customer information and the training portal
  • Vercel — hosting for the website, the booking system and the portal. Function logs may contain technical details such as error messages, routes and ids for troubleshooting — never the content of notes, comments or messages. Vercel also produces cookie-free, aggregated visitor statistics for the public pages (Vercel Web Analytics). The admin panel and the training portal are not counted, and addresses are recorded without query parameters, so booking links and codes are never included
  • Resend — sending confirmations and reminders by email. Resend is a US company
  • intervals.icu — if you connect the portal to intervals.icu, we send your API key there and fetch your activities back, see the separate point above
  • Your calendar provider (Apple, Google, Outlook or similar) — if you subscribe to a calendar feed, that provider fetches and stores your training plan
  • The contact form on the homepage forwards your message to an email account with Google (Gmail), in addition to Resend handling the actual sending
  • If you use the route planner in the portal, there are two separate data flows to Mapbox: (1) Your browser sends the map view you are looking at and your IP address directly to Mapbox, every time the map is shown – this happens whether you draw the route manually or have us calculate it. (2) When the route is calculated, or you ask us to calculate elevation, OUR SERVER – not your browser – sends the actual coordinates to Mapbox: your waypoints in routed mode, and for an elevation calculation up to 100 points along the whole route, also for a manually drawn route. In this second case it is the server's IP address Mapbox sees, not your own. Mapbox is a US company. If you open a completed session with a GPS track, the same as (1) applies: your browser sends the map view and your IP address to Mapbox while the map is shown – but neither the track nor the elevation data is sent to Mapbox in this case. The elevation profile for a completed session is built from your watch's own measurements, not from a Mapbox terrain estimate
  • Anthropic: the AI model behind the chat on the public pages (the website's AI agent). What you write in the chat, and the agent's earlier replies in the same conversation, are sent to Anthropic to produce an answer. Anthropic is a US company

Supabase and Vercel state that data for this project is stored within the EU/EEA. Resend, intervals.icu, Mapbox, Google and Anthropic are international companies, and a full confirmation of the transfer basis for each of them had not been completed at the time this text was written. Your information is never sold, and is not shared with anyone for marketing purposes.

Withdrawing consent to training and test data

You may withdraw your consent to the processing of training and test data at any time by sending an email. That stops further follow-up with reports and progress measurement. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. If you also want your information deleted, see "Requesting deletion" above — that does not happen automatically just because you withdraw consent.

Cookies and local storage

The website does not use cookies. Your language preference is stored locally in your browser (localStorage), not in a cookie. If you log in to the admin panel or the training portal, a login session is likewise stored locally in your browser (localStorage) so you stay signed in. The browser security setup is nonetheless prepared for certain third-party tools we may enable later — this is not a permanent guarantee that no third-party script will ever run.

Contact Us

If you have questions about this privacy policy or wish to exercise your rights, please contact us.

Email: kontakt@aamaascoaching.no