1. Who we are
Toro Coach is a product of Three Bulls Consulting Pty Ltd (ABN 98 700 307 991), registered in New South Wales, Australia. Three Bulls is a trading name of THREE BULLS CONSULTING PTY LTD. We operate the Toro Coach training platform at torocoach.com.
We are the data controller for personal data collected through this platform. This policy explains what personal data we collect, how we use it, the legal basis for each use, and your rights.
For privacy matters, contact us at info@torocoach.com.
2. Data we collect
- Account data: email address, name, and password (stored as a one-way hash; your password is never readable by us or any third party).
- Training data: activities, fitness metrics, training zones, and history synced from your Intervals.icu account via their API on your behalf.
- Profile data: sport preferences, training level, timezone, goals, and race calendar you provide within the app.
- Health and wellness data: HRV, resting heart rate, sleep, injury logs, and subjective wellbeing check-ins you choose to log.
- Billing data: subscription status processed via Stripe. We do not store card numbers or full payment details.
- Technical and usage data: IP address, device type, browser, operating system, page views, feature interactions, and error logs collected for security and product improvement.
- Communications: emails you send to our support address and any in-app feedback you submit.
3. How we use your data and our legal basis
- To provide and operate the Service: syncing, displaying, and analysing your training data, generating AI-assisted coaching insights, and managing your account.Legal basis: performance of contract.
- To process billing: handling subscription payments and sending billing-related emails.Legal basis: performance of contract.
- To communicate with you: sending product updates, onboarding emails, and service notifications. You can unsubscribe from marketing emails at any time.Legal basis: legitimate interest (service emails) / consent (marketing).
- To improve the platform: diagnosing bugs, analysing usage patterns, and developing new features using aggregated, anonymised data.Legal basis: legitimate interest.
- To ensure security: detecting fraud, abuse, and unauthorised access.Legal basis: legitimate interest.
We do not sell your personal data. We do not use your training or health data for advertising.
4. Third-party subprocessors
We share data only with the following processors, each bound by data processing agreements:
- Supabase: database hosting and authentication. Your account data, training data, and profile data are stored here.
- Vercel: application hosting and deployment. Serves the Toro Coach web application and processes request logs including IP addresses.
- Stripe: payment processing. Handles subscription billing. We do not store full card numbers or payment credentials.
- Resend: transactional email delivery. Used to send account, billing, and onboarding emails.
- Anthropic (Claude): AI coaching responses. When you use Toro AI features, relevant portions of your training data are sent to Anthropic's API to generate responses. Anthropic does not use data submitted via the API to train its models. We have also disabled user feedback reporting and usage metrics logging at the platform level, and have not enrolled in Anthropic's Development Partner Program, so no prompts, responses, or session data are submitted to Anthropic for training purposes. This applies to Pro AI and Elite AI tier subscribers. Anthropic's data use is governed by their privacy policy.
- Intervals.icu: training data source. We read your activity and fitness data via their API on your behalf. Data flows are read-only from their platform to ours.
- Mapbox: mapping and route visualisation. GPS route data from activities may be sent to Mapbox to render maps within the app.
- Google (Workspace / Gmail): internal business operations only. We use Google Workspace for team communication and operational email. User data is not shared with Google for advertising or analytics purposes.
- Cloudflare: DNS and network security for torocoach.com. All requests to the platform pass through Cloudflare's network, which processes IP addresses and request metadata to provide DNS resolution and DDoS protection. Cloudflare's data use is governed by their privacy policy.
Each processor operates under their own privacy policy for data they control. We do not authorise any subprocessor to use your data for their own purposes.
5. MCP (Model Context Protocol) and Claude integration
Toro Coach supports an optional MCP integration that allows you to connect your own Claude account (via Anthropic's Claude.ai or compatible clients) directly to your training data. When using this feature:
- Your Claude session is operated under your own Anthropic account, subject to Anthropic's terms and privacy policy. Toro Coach has no visibility into your Claude conversations.
- Toro Coach acts as a data source only, exposing structured training data to your Claude session via MCP tools. We do not control what you share with Claude or how Claude processes it.
- Responsibility for data shared within your Claude session lies with you as the account holder.
- Anthropic's API usage policies apply. Data sent via the API is not used by Anthropic to train its models.
6. Data retention
We retain your data for as long as your account is active. If you delete your account, your personal data is deleted or anonymised within 30 days, except where we are required to retain it by law (for example, billing records for tax purposes, retained for up to 7 years). Anonymised, aggregated usage data may be retained indefinitely for product analytics.
7. Your rights and how to exercise them
Depending on your jurisdiction, you have the right to:
- Access: request a copy of all personal data we hold about you.
- Correction: request that inaccurate or incomplete data be corrected.
- Deletion (right to be forgotten): request permanent deletion of your account and all associated personal data. You can also delete your account directly from Settings inside the app. We will complete deletion within 30 days and confirm by email. Some data may be retained where required by law (billing records) or retained in fully anonymised, non-identifiable form.
- Restriction: request that we limit how we process your data in certain circumstances.
- Portability: receive your personal data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
- Lodge a complaint: you have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been handled unlawfully.
To exercise any of these rights, email info@torocoach.com. We will respond within 30 days.
8. Cookies
We use the following categories of cookies:
- Essential cookies: session tokens set by Supabase, required for authentication and security. The Service cannot function without these. These expire on logout or session end.
- Functional cookies: store UI preferences such as language selection and sidebar state. Retained for up to 1 year.
- Analytics cookies: used by Vercel Analytics to understand page views and feature interactions. This data is aggregated and does not identify individual users. No third-party advertising or tracking cookies are used.
You can manage cookie preferences in your browser settings. Disabling essential cookies will prevent you from logging in. For more detail, see our Cookie Policy.
9. Automated decision-making
We do not make automated decisions about you that produce legal or similarly significant effects. AI-generated coaching insights within the app are recommendations only. They do not constitute automated decisions and are always subject to your own judgement and that of your coach.
10. Security and data breaches
We use industry-standard measures including encrypted connections (TLS), hashed passwords, row-level security on our database, and access controls limiting which systems can read your data. No system is completely secure; please use a strong, unique password for your account.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law.
11. Changes to this policy
We may update this policy from time to time. We will notify you by email before material changes take effect. The current version is always available at torocoach.com/privacy.
