Privacy Policy

1. Who we are

Paceform is operated by Nicklas Pedersen, enkeltmandsvirksomhed, CVR 46551125, Denmark (“Paceform”, “we”, “us”). We are the data controller for the personal data described in this policy.

Contact: nicklas@paceform.app

2. What data we collect and why

Account data

Email address — used for magic-link authentication and transactional emails (plan ready, trial ending). Legal basis: performance of contract (Art. 6(1)(b)).

Health and fitness data (special category)

Heart rate (average, maximum, and time in each training zone), activity history (distance, duration, pace, and session type), and estimated physiological anchors (your lactate-threshold and maximum heart rate, and threshold pace) — read from your connected intervals.icu account, which in turn receives your runs from your watch (Garmin, Coros, Wahoo, Polar, Suunto and others) after you explicitly connect. We also derive a training-load figure ourselves from these runs. We do not collect HRV, sleep, or body-battery data.

This data is used solely to generate personalised weekly training plans and coaching responses. Legal basis: explicit consent under Art. 9(2)(a) GDPR — collected as a dedicated consent step at signup, separate from these Terms. You may withdraw consent at any time in Settings, which will disable AI processing and offer account deletion.

Onboarding information

Goal race, target time, training history, injury flags, and comfortable paces — self-reported during onboarding. Used to generate your first training plan. Legal basis: performance of contract.

Usage and analytics

Anonymous product analytics via PostHog (EU Cloud, Frankfurt). Events include plan generation, chat usage, and feature interactions. No advertising use. Legal basis: legitimate interest in improving the product.

PostHog uses a randomly-generated identifier stored in your browser’s local storage to distinguish sessions. This identifier does not contain your name, email, or any other personal information, and is not shared with third parties for advertising purposes.

Billing

Subscription payments are processed by Paddle, who acts as Merchant of Record. Paceform does not receive or store your card details. Paddle receives your name and email address for billing purposes.

3. Sub-processors

We use the following sub-processors to operate the service:

Your health data is sent to Anthropic solely to generate your training plan and coaching responses. Anthropic processes this data under a Data Processing Addendum with EU Standard Contractual Clauses and does not use API data for model training.

4. How long we keep your data

• Raw activity data: deleted automatically after 12 months on a rolling basis
• Derived coaching journals (training patterns, zone history): retained for the life of your account to enable personalised coaching
• Account data: retained until you delete your account
• Billing records: retained as required by Danish accounting law (5 years)
• Deletion log (fact of deletion only, no personal data): retained for 12 months for accountability

5. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data — use “Delete account and all data” in Settings for immediate deletion, or email us
• Withdraw consent for health data processing at any time in Settings
• Data portability — request an export of your data
• Lodge a complaint with Datatilsynet (datatilsynet.dk) if you believe we have violated your rights

To exercise any right, email nicklas@paceform.app. We will respond within 30 days.

6. AI disclosure

Paceform uses artificial intelligence (Anthropic Claude) to generate training plans and coaching responses. You are always interacting with an AI, not a human coach. The AI coach does not give medical advice and is not a substitute for professional medical or physiotherapy guidance.

7. Connecting your watch (intervals.icu)

Paceform does not connect to your watch directly. You link your watch through intervals.icu, a third-party training platform, and authorise Paceform via OAuth to read your activities from your intervals.icu account and to write planned workouts and training zones back to it. We request only those permissions (activity read, calendar write, settings write) and never receive your intervals.icu or watch-account password.

We store only the OAuth tokens intervals.icu issues, held server-side in an access-restricted table that is never exposed to your browser. You can disconnect at any time in Settings, which stops all further data collection and deletes those stored tokens. How your watch brand (Garmin, Coros, and others) shares data with intervals.icu is governed by intervals.icu’s own privacy policy.

8. Data breaches

In the event of a personal data breach, Paceform will notify Datatilsynet (the Danish Data Protection Authority) within 72 hours as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, describing the nature of the breach and the steps we are taking to address it.

9. Changes to this policy

Material changes will be notified by email at least 14 days before taking effect. Continued use after that date constitutes acceptance.