Privacy
Policy
Last updated: 25 May 2026 · Effective date: 25 May 2026
AirFlow Performance
1. Data Controller
The controller of your personal data is:
MBAM spółka z ograniczoną odpowiedzialnością
ul. Kowanowska 55, 64-600 Oborniki, Poland
KRS: 0001192551 · NIP: 6060121087 · REGON: 542637901
Contact e-mail: info@airflowperformance.pl
We have not appointed a Data Protection Officer (DPO). For any privacy-related matter, contact us at the e-mail above.
2. Scope
This policy applies to the AirFlow Performance mobile application (iOS and Android), the onboarding/account website at app.airflowperformance.pl, and related features (the "Service"). It explains what personal data we collect, why, on what legal basis, who we share it with, and your rights under the General Data Protection Regulation (GDPR / RODO).
3. What data we collect
Account and identity data — e-mail address, password (stored in hashed form by our authentication provider), user role (Player/Coach).
Profile data — first name, last name, date of birth, club/team (for football players), profile photo (avatar).
Health and fitness data (special category — Art. 9 GDPR) — BOLT measurements you record in the app; and, only if you choose to connect Whoop, physiological metrics imported from your Whoop account such as heart-rate variability (HRV), sleep, resting heart rate, respiratory rate, stress and workout data.
Communications and content — chat messages between Players and Coaches, coach notes, and files shared through the Service.
Payment data — subscription status, billing interval and customer identifiers. Card/payment details are processed directly by Stripe; we do not store full card numbers.
Technical and usage data — device push-notification tokens (for notifications), session cookies on the website (see Section 12), and basic logs needed for security and operation.
4. Health data and your explicit consent
4.1 Health and fitness data are special category data under Article 9 GDPR and receive additional protection.
4.2 BOLT measurements are core to the Service and are processed to provide it. Whoop integration is entirely optional — it is only activated when you deliberately connect your Whoop account, and we process the imported health metrics on the basis of your explicit consent (Art. 9(2)(a) GDPR).
4.3 You may withdraw consent at any time by disconnecting Whoop in the app (Settings) or by deleting your account. Withdrawal does not affect the lawfulness of processing before withdrawal.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account; provide the Service | Account, profile data | Performance of a contract — Art. 6(1)(b) |
| Record and display BOLT scores and readiness | BOLT, profile | Art. 6(1)(b); explicit consent for health data — Art. 9(2)(a) |
| Import and display Whoop health metrics (optional) | Whoop health data | Explicit consent — Art. 9(2)(a); Art. 6(1)(a) |
| Enable Coach–Player supervision, chat, file sharing | Communications, content | Art. 6(1)(b) |
| Process subscription payments | Payment, account | Art. 6(1)(b); legal obligation (accounting/tax) — Art. 6(1)(c) |
| Send push notifications | Push token | Art. 6(1)(b) and/or consent — Art. 6(1)(a) |
| Security, fraud prevention, service integrity | Technical, logs | Legitimate interests — Art. 6(1)(f) |
| Respond to your requests and exercise of rights | Contact, account | Art. 6(1)(c) / Art. 6(1)(f) |
6. Minors
The Service may be used by athletes of any age, including minors. Where a User is under 18, the Service is used under the supervision of a Coach and in consultation with the User's parent or legal guardian. The parent or legal guardian is informed in advance about what data is collected and how it is processed, and consents to this processing — including the processing of health data — in connection with the coaching relationship. A parent or legal guardian may withdraw consent at any time by contacting us at the e-mail above or by asking the Coach to delete the account.
7. Who we share data with (processors and recipients)
We share data only as needed to operate the Service. Our processors and recipients include:
- Supabase — database, authentication and file storage (hosting of profile, BOLT, chat and health data).
- Stripe — payment processing and subscription management.
- Google Firebase Cloud Messaging — delivery of push notifications.
- Whoop — source of optional health metrics you choose to import.
- Resend — sending transactional and onboarding e-mails (magic links, notifications); receives your e-mail address for this purpose.
- Hosting provider (Hetzner, Germany) — hosting of the onboarding/account website.
We use a third-party football-data API (TheSportsDB) solely to look up club, league and team names during onboarding. We retrieve reference data from it and do not send it any of your personal data, so it is not a recipient of your data.
Your Coach (and the operating organisation) is a recipient of the Player data described in the Terms of Service. We may also disclose data where required by law or to competent authorities.
8. International data transfers
Some processors may process data outside the European Economic Area (e.g. providers based in the United States). Where this occurs, transfers are safeguarded by mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) and/or an adequacy decision (e.g. the EU–US Data Privacy Framework where applicable). You may request more information about the safeguards in place.
9. Retention
We keep personal data only as long as necessary for the purposes above:
- Account and profile data — for the duration of your account; deleted (or anonymised) following account deletion.
- Health data (BOLT, Whoop) — until you disconnect Whoop, delete the data, or delete your account.
- Payment and accounting records — for the period required by Polish tax/accounting law (generally 5 years from the end of the relevant accounting year).
- Logs and security data — for a limited period proportionate to the security purpose.
When you delete your account, your authentication record and linked profile data are removed (deletion cascades across related records). Some data may be retained where required by law.
10. Your rights
Under the GDPR you have the right to: access your data; rectify inaccurate data; erase ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time (without affecting prior processing).
To exercise these rights, contact info@airflowperformance.pl. You also have the right to lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2, 00-193 Warszawa · uodo.gov.pl
11. Automated decision-making
The Service computes a readiness indicator (e.g. green/amber/red) from your measurements to support training decisions. This is decision-support information for you and your Coach and does not produce legal or similarly significant effects within the meaning of Article 22 GDPR. We do not carry out solely automated decision-making with such effects.
12. Cookies (website)
The onboarding/account website uses cookies that are strictly necessary to operate the Service — in particular session/authentication cookies (Supabase) and cookies set by Stripe during checkout. These are required to keep you signed in and to process payments. Where any non-essential cookies are used, we request your consent via the cookie banner. You can manage cookies through your browser settings.
13. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, role-based access and database Row-Level Security so that Players access only their own data and Coaches access only their assigned Players. No method of transmission or storage is completely secure; we continually work to protect your data.
14. Changes to this policy
We may update this policy from time to time. We will notify you of material changes (e.g. by e-mail or in-app) and update the "Last updated" date above.
15. Contact
MBAM sp. z o.o.
ul. Kowanowska 55, 64-600 Oborniki, Poland
E-mail: info@airflowperformance.pl