Privacy policy
Last updated 20 October 2026
This explains what personal data AbanteOS uses, why, and your rights. In short: we use your data only to run AbanteOS. We don’t sell it, show ads, use trackers or analytics, or train AI on it.
Who we are
AbanteOS is a trading name of Abante Performance & Fitness Ltd, company no. 15116722, registered in England and Wales. Registered office: Suite 5 IDB House, 70 Savile Street East, Sheffield, S4 7UQ, United Kingdom.
Privacy questions and requests: info@abanteperformance.com
Coaches, clients and us
- Coach accounts, billing, sign-in and support: we decide how this data is used (we are the controller).
- What a coach keeps about their clients (programmes, workout logs, check-ins, progress, photos, nutrition, habits, messages, notes, invoices): the coach is the controller and we process it for them, under our Data Processing Agreement. If you’re a client, your coach’s own privacy notice applies too, and they are your first contact for this data.
- Your login, devices and settings as a client: we are the controller.
What we collect
- Account details: name, email, password (stored hashed), photo, time zone.
- Coaching data you or your coach add: training, results, body measurements, progress photos, nutrition, habits, form and check-in answers (these can include injuries or medical history), call bookings, messages, voice notes and files.
- Payments: plan and invoice history. Card details are held by Stripe, not us.
- Coach email lists: contacts, consent records, email opens and clicks.
- Technical: IP address and browser details in server logs, and short-lived hashed IP counters to stop abuse (kept up to a day).
- Phone apps, if you allow notifications: a device token.
- Connected services you choose to link, such as a calendar.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and the features you use | Contract |
| Billing, tax and accounting records | Contract; legal obligation |
| Keeping AbanteOS secure, stopping abuse and fixing faults | Legitimate interests |
| Service emails (sign-in, reminders, important changes) | Contract; legitimate interests |
| Marketing email from a coach | Your consent (never pre-ticked; unsubscribe any time) |
| Health information | Your explicit consent, recorded in AbanteOS |
Health information
Training, body and nutrition data can be health data, which the law protects more closely. Before a coach can use yours, AbanteOS asks for your explicit consent (a box you tick yourself) and records when you gave it and which version of this policy applied.
You can withdraw it at any time in Settings › Privacy & data. Your coach is told, and AbanteOS stops collecting new body measurements, food logs, form answers and health-app data. Workouts, habits and messages carry on. What’s already saved isn’t deleted automatically: you can download it, ask your coach to delete it, or delete your account.
Who we share it with
Only the services below, which run parts of AbanteOS for us under contracts that protect your data. Your coach sees what you share with them. We never sell data.
| Service | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Paris). Supabase Inc., USA |
| Cloudflare | Hosting, server code and the bot check on sign-in (Turnstile) | Global network. Cloudflare Inc., USA |
| Stripe | AbanteOS plan billing, and client payments for coaches who connect Stripe (When you pay or get paid through Stripe) | Stripe Payments UK Ltd and Stripe group, incl. USA |
| Resend | Sending email (account, reminder and coach emails) | EU sending region (Ireland). Resend Inc., USA |
| 8x8 (Jitsi Meet) | Video calls on meet.jit.si (Only when you join a call that uses a Jitsi link) | 8x8 Inc., USA |
| YouTube exercise videos, and Google sign-in or calendar linking if you choose them (When a video loads, or you choose Google) | Google LLC, USA / Google Ireland Ltd | |
| Vimeo and Loom | Course videos a coach adds (Only when such a video loads) | USA |
| Open Food Facts | Food search and barcodes. We send only the search words or barcode (Food logging) | France |
We may also share data if the law requires it, or with a buyer if the business is sold (you’d be told first).
International transfers
Our database is in the EU (Paris). Some services above are based in, or reach data from, the USA or elsewhere. Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Your account: until you delete it. Deletion happens 14 days after you ask (you can cancel in that time).
- Coaching records: while the coach keeps them, or until your account is deleted.
- Coach marketing emails: 2 years. Reminder emails: 180 days.
- Payment events: 400 days. Records tax law requires: as long as it requires.
- Abuse-prevention counters: 1 day. Finished push notifications: 30 days.
- Backups and our providers’ logs keep data for a short time after deletion, then it’s gone.
Security
Data is encrypted in transit, access is limited by strict per-account rules in the database, and passwords are never stored in plain text. If a breach puts you at risk, we will tell you and the ICO as the law requires.
Your rights
You can ask to access, correct, delete or move your data, and object to or restrict how it’s used. You can download your data and delete your account yourself in Settings. Otherwise email info@abanteperformance.com; we reply within one month. For data your coach controls, we’ll pass your request to them and help them answer.
Age
You must be 16 or over to use AbanteOS, and 18 or over to open a coach account.
Complaints
Please contact us first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113. If you live in the EU, you can also contact your local data protection authority.
Changes
We’ll update this page when things change, and email you about important changes.