Effective date: 8 September 2026. This policy explains how ePic design s.r.o. (“we”, “us”), established in the Slovak Republic, processes personal data when you use Enduvio.
Enduvio is an endurance fueling planner. We process the data needed to create your account, store your athlete profile and plans, and operate the service. We do not sell your personal data. We use Meta (Facebook) advertising measurement tools as described below.
1. Controller
The data controller is ePic design s.r.o., Slovak Republic. For privacy requests, email contact@enduvio.com.
2. Data we collect
Account
Name, email address, a hashed password if you register with email, and a Google account identifier if you sign in with Google. We also store whether your athlete profile is complete, last sign-in time, and account timestamps.
Athlete profile
Information you provide such as sex, age, weight, height, preferred units, sports, training paces or FTP, weekly volume, recent race results, sweat rate and sodium, gut carbohydrate tolerance, heat acclimation, dietary notes, and optional heart-rate or VO2max values.
Plans and courses
Plan titles, sport and session type, start time, temperature and humidity, fueling targets, GPX tracks and waypoints, catalog race selection, aid-station details, stage-by-stage targets, and optional AI-generated coaching notes.
Feature requests
If you submit an idea in the app, we store your user id, email, and the message.
Technical data
Session cookies used to keep you signed in, short-lived rate-limit records that may include your IP address to prevent abuse, and advertising measurement signals described in Cookies and Processors (browser type / user agent, page URL, and conversion event identifiers sent to Meta).
3. How we use data and legal bases
We process personal data to:
- Create and authenticate your account (performance of a contract).
- Build, save, and display fueling plans from your profile and course data (contract).
- Generate optional plan notes with Google Gemini using profile physiology, session conditions, and stage data — not your name or email (contract / legitimate interest in operating the feature you request).
- Look up weather and map context for a course (contract).
- Review in-app feature requests and keep the service secure (legitimate interest).
- Measure and improve our advertising (for example Meta ads) using the Meta Pixel and Conversions API for events such as viewing our landing page, contacting us, and completing registration (legitimate interest in understanding ad performance).
- Comply with law and respond to your GDPR requests (legal obligation).
You choose what to put in your profile. Some fields are required to generate a plan; others are optional.
4. Cookies
We use essential Auth.js session cookies (JSON Web Tokens) so you stay signed in. These cookies are necessary for the service. We also load the Meta (Facebook) Pixel, which may set cookies or similar identifiers used for advertising measurement and attribution when you visit our marketing pages or complete tracked actions.
5. Processors and other services
We use service providers to run Enduvio:
- MongoDB Atlas — database hosting for accounts, profiles, plans, and related records.
- Hosting infrastructure (for example Vercel) — serving the application.
- Google — optional sign-in (OAuth) and optional Gemini notes.
- Open-Meteo — weather forecasts and archive data for a course.
- Nominatim (OpenStreetMap) and Photon (Komoot) — place names for weather context.
- OpenStreetMap map tiles — displayed in your browser when you view a course map.
- Meta Platforms (Facebook) — Pixel and Conversions API for ads measurement of selected events (page views of content we care about, contact actions, and completed registration).
These providers process data only as needed to provide their services. Gemini receives athlete physiology and plan context when notes are generated; it does not receive your email or name. Meta receives technical and event data for measurement as described above, not your athlete profile or fueling plans.
6. International transfers
Some providers may process data outside the European Economic Area (for example Google, Meta, or MongoDB Atlas). Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
7. Retention
We keep account, profile, and plan data while your account is active. Login tickets expire within about a minute. Rate-limit records expire after their window. Advertising measurement events are processed by Meta according to Meta’s retention practices. If you ask us to delete your account, we will erase or anonymize personal data unless we must keep a limited record to comply with law.
8. Your rights
If you are in the EU/EEA or another jurisdiction with similar rights, you may request access, correction, deletion, restriction, objection, or portability of your personal data, and you may withdraw consent where processing is based on consent. You may object to processing based on legitimate interest, including advertising measurement. Email contact@enduvio.com. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) or your local supervisory authority.
9. Account deletion
The app does not currently include a self-serve delete-account control. You can delete individual plans in the app. To erase your account and remaining personal data, email contact@enduvio.com from the address on the account.
10. Children
Enduvio is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes
We may update this policy when the product or the law changes. The effective date at the top will change. Material changes will be reflected on this page.
12. Contact
ePic design s.r.o., Slovak Republic. Email contact@enduvio.com. See also our Terms of Use.