Privacy Policy

Last updated: 9 September 2026

OSO Performance Technologies (“OSO”, “we”, “us”, or “our”) operates the OSO training platform, applications, and website (the “Service”). This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights and choices you have. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), OSO is the data controller of your personal data.

By using the Service you agree to this Policy and to our Terms of Service. When you create an account, you confirm you are at least 16 years old — or that a parent or legal guardian has consented on your behalf if you are 13 to 15, as set out in our Terms — and you provide your explicit consent to our processing and interpretation of your training and health-related data as described in Section 2 below.

1. Information we collect

Account information — your name, email address, and a securely hashed password when you create an account.
Training & activity data — the activity files you upload (such as .fit files) and the metrics we derive from them (duration, distance, power, speed, heart rate, cadence, pace, elevation, GPS routes and location, training load, and related analytics).
Health-related and biometric data — heart rate, heart-rate variability, resting heart rate, sleep, body mass and body composition, and similar wellness measures, where you provide them or connect a source that does. See Section 2.
Connected services — if you connect a third-party account (such as Garmin via SweatStack, Wahoo, Polar, Hammerhead, or Strava), we access the activity, wellness, and profile data you authorise, using access tokens that we store encrypted and that you can revoke at any time.
Profile & preferences — settings such as thresholds (e.g. FTP), zones, units, primary sport, goals, and dashboard layout.
Payment information — if you purchase a subscription, our payment processor collects and processes your payment details. We do not store your full payment-card number; we receive only limited information such as a transaction confirmation and billing status.
Communications — messages you send us (for example, support or contact-form messages) and records of them.
Technical & usage data — IP address, browser and device type, approximate location derived from IP, and log and diagnostic data, used to operate, secure, and troubleshoot the Service.
Local storage — a login token and interface preferences stored in your browser (see our Cookie Policy).

2. Health and sensitive data

Some of the data we process — such as heart rate, heart-rate variability, sleep, body mass, and precise location — is “special category” data concerning health under the GDPR and “sensitive personal information” under US state laws. We process it only to provide the analytics, insights, and features you ask for, and we process it on the basis of your explicit consent, which you give when you create an account and connect data sources. You can withdraw this consent at any time by disconnecting a source or deleting your account, which stops further processing. We do not use your health or sensitive data for advertising, and we do not sell it.

3. How we use your information

To provide, maintain, personalise, and secure the Service and your account.
To compute training metrics, zones, models, and analytics from your activities and wellness data.
To sync activities and wellness data from services you choose to connect, and to send structured workouts to devices at your request.
To communicate with you about your account, security, transactions, and important Service updates.
To send you product news, training tips, and offers by email where you have opted in — and only until you opt out. Every marketing email includes a one-click unsubscribe, and you can withdraw this consent at any time without affecting the core Service or account and transactional emails.
To provide customer support and respond to your requests.
To monitor, troubleshoot, prevent fraud and abuse, and protect the security and integrity of the Service.
To improve the Service and develop new features (using data in an aggregated or de-identified form wherever practicable).
To comply with legal obligations and enforce our Terms.

4. Legal bases for processing (EEA / UK)

Where the GDPR applies, we rely on the following legal bases:

Performance of a contract — to create your account and provide the core Service.
Explicit consent — to process your special-category health data, and to connect third-party services and send certain communications. You may withdraw consent at any time.
Legitimate interests — to secure, operate, troubleshoot, and improve the Service and to prevent abuse, provided these are not overridden by your rights.
Legal obligation — to comply with applicable laws and lawful requests.

5. How we share information

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only as follows:

With service providers / processors who host and operate the Service on our behalf (for example, cloud hosting and database, and transactional email), under contracts that require them to protect your data and use it only on our instructions.
With third-party services you connect, only as needed to provide the integration you request and only with data relevant to it.
With a payment processor, to take payment for subscriptions.
Where required by law or lawful request, or to protect the rights, safety, property, and security of OSO, our users, or the public, or to enforce our Terms.
In connection with a business transfer (merger, acquisition, financing, reorganisation, or sale of assets), subject to this Policy; we will notify you of any change of controller.
With your direction or consent, for any other purpose disclosed at the time.

6. Sub-processors

We use a small set of vetted sub-processors to run the Service, currently in the categories of cloud hosting and database, transactional email, marketing email and lifecycle messaging, payment processing, and the device and activity platforms you choose to connect. Each is bound by data-protection terms. We may update our sub-processors as the Service evolves; a current list is available on request at legal@trainoso.com.

7. International data transfers

We are based in the United States, and your data may be processed in the US and in other countries whose data-protection laws may differ from yours. Where we transfer personal data out of the EEA or UK, we rely on an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. You may request more information about these safeguards using the contact details below.

8. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where we must retain limited records to comply with legal, tax, accounting, or security obligations, to resolve disputes, or to enforce our agreements. Retention periods are determined by the purpose of processing, the sensitivity of the data, and applicable legal requirements.

9. Data security

Data security is a priority at every layer of the Service. We use industry-standard technical and organisational measures, including:

Encrypted connections (TLS/HTTPS) for all data in transit.
Passwords stored only as salted, hashed values — never in plain text.
Encryption of stored third-party access tokens.
Authenticated, access-controlled endpoints, so your data is accessible only to you.
The principle of least privilege for internal and third-party access.
Ongoing monitoring for, and prompt remediation of, security issues.

We continually review and strengthen these safeguards. That said, no method of transmission or storage is ever completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will act promptly and notify you and any regulator where required by law.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data: to access it and receive a copy; to correct inaccurate data; to delete it; to port it to another service; to restrict or object to certain processing; and to withdraw consent at any time (without affecting processing already carried out). You will not be discriminated against for exercising your rights.

To exercise any right, email legal@trainoso.com. We will verify your request (usually by confirming control of your account email) and respond within the time required by applicable law. You may use an authorised agent where the law allows. Many rights can also be exercised directly in the app — you can edit your profile, disconnect providers, and delete your training data or your entire account from Settings, with deletion taking effect immediately.

EEA / UK residents (GDPR)

In addition to the rights above, you have the right to lodge a complaint with your local supervisory or data-protection authority. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

California residents (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in Sections 1–2 (identifiers, customer records, internet/network activity, geolocation, and health/sensitive information), for the business purposes in Section 3, and disclosed them only to the service providers and parties in Section 5. We do not “sell” or “share” personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the past 12 months. You have the right to know, access, correct, and delete your personal information, and to limit the use of sensitive personal information (we already limit ours to providing the Service). To exercise these rights, contact us as above.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale, or such profiling. To exercise your rights, contact us as above; where a right of appeal is provided by law, you may appeal a decision by replying to our response.

11. Children and junior athletes

You must be at least 16 years old to create an account and use the Service on your own behalf.

Athletes aged 13 to 15. The Service is open to them where a parent or legal guardian has accepted our Terms on the athlete’s behalf and supervises the account. That parent or guardian is the account holder, and their consent covers the processing of the athlete’s training and health-related data described in this Policy, including heart rate, heart-rate variability, sleep and body mass. They may ask us to provide, correct, or permanently delete the account and everything in it at any time by writing to legal@trainoso.com.

Where local law sets a higher age. Some countries set a higher minimum age for consenting to online services on your own. Where the law that applies to you sets a higher age, that higher age applies instead, and a parent or guardian must consent until you reach it.

Under 13. The Service is not available to anyone under 13, with or without parental consent, and we do not knowingly collect personal data from anyone under 13. If you believe someone under 13 has provided us with data, contact us and we will close the account and delete the data.

12. Third-party services

If you connect a third-party account or use maps and routing, your use of those services is also governed by their own terms and privacy policies. We are not responsible for the privacy practices of third parties, and we encourage you to review their policies.

13. Do Not Track

We do not run advertising trackers or third-party analytics, and the Service does not respond differently to browser “Do Not Track” signals because we do not track you across other sites. See our Cookie Policy for what we store in your browser.

14. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date, and we will notify you of material changes directly where required (for example, by email or in-app notice).

15. Contact

Questions, requests, or complaints about this Policy or your data: legal@trainoso.com, OSO Performance Technologies (data controller).