1. Who we are
Toro Coach is a product of Three Bulls Consulting Pty Ltd (ABN 98 700 307 991), registered in New South Wales, Australia. Three Bulls is a trading name of THREE BULLS CONSULTING PTY LTD. We operate the Toro Coach training platform at torocoach.com.
We are the data controller for personal data collected through this platform. This policy explains what personal data we collect, how we use it, the legal basis for each use, and your rights.
For privacy matters, contact us at info@torocoach.com.
2. Data we collect
- Account data: email address, name, and password (stored as a one-way hash; your password is never readable by us or any third party).
- Training data: activities, fitness metrics, training zones, and history synced from the third-party fitness platforms and devices you choose to connect (depending on the connectors available at the time), accessed via their APIs on your behalf.
- Profile data: sport preferences, training level, timezone, goals, and race calendar you provide within the app.
- Health and wellness data: HRV, resting heart rate, sleep, injury logs, and subjective wellbeing check-ins you choose to log.
- Billing data: subscription status processed via Stripe. We do not store card numbers or full payment details.
- Technical and usage data: IP address, device type, browser, operating system, page views, feature interactions, and error logs collected for security and product improvement.
- Communications: emails you send to our support address and any in-app feedback you submit.
3. How we use your data and our legal basis
- To provide and operate the Service: syncing, displaying, and analysing your training data, generating AI-assisted coaching insights, and managing your account.Legal basis: performance of contract.
- To process billing: handling subscription payments and sending billing-related emails.Legal basis: performance of contract.
- To communicate with you: sending product updates, onboarding emails, and service notifications. You can unsubscribe from marketing emails at any time.Legal basis: legitimate interest (service emails) / consent (marketing).
- To improve the platform: diagnosing bugs, analysing usage patterns, and developing new features using aggregated, anonymised data.Legal basis: legitimate interest.
- To ensure security: detecting fraud, abuse, and unauthorised access.Legal basis: legitimate interest.
We do not sell your personal data. We do not use your training or health data for advertising.
4. Third-party subprocessors
We share data only with the following processors, each bound by data processing agreements:
- Supabase: database hosting and authentication. Your account data, training data, and profile data are stored here.
- Vercel: application hosting and deployment. Serves the Toro Coach web application and processes request logs including IP addresses.
- Stripe: payment processing. Handles subscription billing. We do not store full card numbers or payment credentials.
- Resend: transactional email delivery. Used to send account, billing, and onboarding emails.
- OpenAI: AI coaching responses. When you use Toro Intelligence features, relevant portions of your training data are sent to OpenAI's API to generate responses. OpenAI does not use data submitted via its API to train its models by default. We have not opted in to share API data with OpenAI for model improvement, so no prompts, responses, or session data are submitted to OpenAI for training purposes. This applies to subscribers on the Coach plan and the Athlete Pro AI plan. OpenAI's data use is governed by their privacy policy.
- Connected fitness platforms: training data sources. Depending on the connectors available and the ones you choose to enable, we read your activity, fitness, and wellness data from those platforms via their APIs on your behalf. Each platform's own terms and privacy policy apply to the data it holds.
- Mapbox: mapping and route visualisation. GPS route data from activities may be sent to Mapbox to render maps within the app.
- Google (Workspace / Gmail): internal business operations only. We use Google Workspace for team communication and operational email. User data is not shared with Google for advertising or analytics purposes.
- Cloudflare: DNS and network security for torocoach.com. All requests to the platform pass through Cloudflare's network, which processes IP addresses and request metadata to provide DNS resolution and DDoS protection. Cloudflare's data use is governed by their privacy policy.
Each processor operates under their own privacy policy for data they control. We do not authorise any subprocessor to use your data for their own purposes.
5. MCP (Model Context Protocol) and AI assistant integration
Toro Coach supports an optional MCP integration that allows you to connect your own AI assistant account (such as ChatGPT or other MCP-compatible clients) directly to your training data. When using this feature:
- Your AI assistant session is operated under your own account with that provider, subject to the provider's terms and privacy policy. Toro Coach has no visibility into your conversations.
- Toro Coach acts as a data source only, exposing structured training data to your AI assistant session via MCP tools. We do not control what you share with the assistant or how the provider processes it.
- Responsibility for data shared within your AI assistant session lies with you as the account holder.
6. Data retention
We retain your data for as long as your account is active. If you delete your account, your personal data is deleted or anonymised within 30 days, except where we are required to retain it by law (for example, billing records for tax purposes, retained for up to 7 years). Anonymised, aggregated usage data may be retained indefinitely for product analytics.
7. Your rights and how to exercise them
Depending on your jurisdiction, you have the right to:
- Access: request a copy of all personal data we hold about you.
- Correction: request that inaccurate or incomplete data be corrected.
- Deletion (right to be forgotten): request permanent deletion of your account and all associated personal data. You can also delete your account directly from Settings inside the app. We will complete deletion within 30 days and confirm by email. Some data may be retained where required by law (billing records) or retained in fully anonymised, non-identifiable form.
- Restriction: request that we limit how we process your data in certain circumstances.
- Portability: receive your personal data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
- Lodge a complaint: you have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been handled unlawfully.
To exercise any of these rights, email info@torocoach.com. We will respond within 30 days.
8. Cookies
We use only the following categories of cookies:
- Essential cookies: session tokens set by Supabase, required for authentication and security. The Service cannot function without these. These expire on logout or session end.
- Functional cookies and local storage: your language selection (retained for up to 1 year) and interface preferences such as sidebar state, which are stored only in your browser.
Vercel Analytics and Speed Insights, which we use to understand page views and performance, do not set cookies. No third-party advertising or tracking cookies are used.
You can manage cookie preferences in your browser settings. Disabling essential cookies will prevent you from logging in. For more detail, see our Cookie Policy.
9. Automated decision-making
We do not make automated decisions about you that produce legal or similarly significant effects. AI-generated coaching insights within the app are recommendations only. They do not constitute automated decisions and are always subject to your own judgement and that of your coach.
10. Security and data breaches
We use industry-standard measures including encrypted connections (TLS), hashed passwords, row-level security on our database, and access controls limiting which systems can read your data. No system is completely secure; please use a strong, unique password for your account.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law.
11. Changes to this policy
We may update this policy from time to time. We will notify you by email before material changes take effect. The current version is always available at torocoach.com/privacy.