Privacy Policy

Important: This English version is provided for informational purposes only. In case of any discrepancy or interpretation issue, the French version (« Politique de confidentialité ») shall prevail.

The company SYNERGY PERFORMANCE, SAS (hereinafter “Synergy” or “we”) attaches particular importance to the protection of your personal data. This policy explains what data we collect, why, on what legal basis, with whom we share it, how long we keep it, and what your rights are.

This policy applies to all Synergy services: the website and web application accessible at synergyperformance.fr and its subdomains (including coach, athlete and coaching areas), and the Synergy Performance iOS/Android mobile application (hereinafter “the Services”).

It is drafted in accordance with Regulation (EU) 2016/679 (“GDPR”), the French Data Protection Act of January 6, 1978 (Law No. 78-17, as amended) and Directive 2002/58/EC (“ePrivacy”).

Synergy operates under two different statuses depending on the context of use.

2.1 Synergy as data controller

We are data controller (within the meaning of Article 4(7) of the GDPR) when we determine the purposes and means of processing. This is the case for:

• Coach accounts (account management, subscription, billing, support, marketing communication)
• Individual athlete accounts signing up without being invited by a coach (autonomous users, free or paid)
• Statistical analysis and technical measurements of the Services' operation

2.2 Synergy as data processor

We are data processor (within the meaning of Articles 4(8) and 28 of the GDPR) when we process data on behalf of a coach. This is the case for:

• Data of athletes invited by a coach on the platform (the coach's clients): assigned programs, performance tracking, assessments, progress photos, nutritional data entered as part of the coach's monitoring
• Payment data of a coach's clients when the coach connects to Synergy the Stripe or GoCardless account on which they collect payments (see section 3.8), including for clients who are not registered on Synergy

In this configuration, the coach is the data controller of their athletes' data; the coach defines the purpose and means of processing, and it is the coach who must inform their athletes, obtain their consent and respond to their requests to exercise rights. Synergy acts only under the coach's instructions, within the framework of a Data Processing Agreement (DPA) accepted by each coach upon signup.

2.3 Special case: athlete transitioning from solo use to being invited by a coach

If you initially created a solo account (Synergy controller) and are later invited by a coach:

• The data of your account (email, password, credentials, possible subscription) remains under Synergy's responsibility
• The data shared with your coach (programs you follow with them, assessments, progress photos, etc.) passes under the responsibility of that coach

You remain free to disaffiliate from a coach at any time from the application. The data processed by the coach may then be deleted upon request, according to the coach's own rules.

3.1 Identification data

• Last name, first name, username
• Email address
• Date of birth, gender
• Profile picture (optional)

3.2 Health and physical fitness data

⚠️ Sensitive data (GDPR Article 9): this data is collected only with your explicit consent given upon signup. You may withdraw this consent at any time from your account settings; in this case, your use of the Services will be limited because this data is at the core of our service.

• Weight, height, BMI
• Body measurements (waist, chest, hips, thighs, arms, etc.)
• Body fat percentage
• Health objectives (weight loss/gain, nutrition)
• Pregnancy/breastfeeding status (if entered)
• Body progress photos (optional)

3.3 Training data

• History of training sessions
• Exercises performed, sets, reps, loads, rest times
• Daily step and cardio goals
• Physical activity data imported from HealthKit / Health Connect (see section 4)

3.4 Nutritional data

• Nutritional objectives (calories, proteins, carbohydrates, fats)
• Daily food journal
• Recipes and meal plans created or used

3.5 Coaching data (if you are coached)

• Assessments and check-ins with your coach
• Responses to follow-up questionnaires
• Notes and comments left by your coach
• Membership in a team or club

3.6 Technical data

• IP address, browser type, language
• Device model, operating system, application version
• Login credentials (Google, Apple)
• Push notification token
• Date of last connection
• Connection logs (security logs)

3.7 Data collected for advertising purposes (marketing consent only)

If — and only if — you have accepted the “Marketing” category in the Axeptio consent banner, we transmit to Meta Platforms Ireland Limited, at the moment of your signup and key interactions (trial start, subscription):

• Your identifiers, always hashed (SHA-256, a one-way process): email address, phone number, first name, last name, date of birth and your account’s internal identifier. Meta never receives this information in clear text: it is hashed before any transmission, whether that transmission comes from our servers or from the Meta Pixel in your browser.
• Your technical data: your IP address, your User-Agent (browser and system), and the Meta _fbp and _fbc cookies set by the Meta Pixel (technical identifiers linked to Facebook/Instagram advertising attribution).

Meta matches the hashed fingerprints it receives against those of its own users (“advanced matching”) in order to attribute our advertising campaigns. This data is used solely to improve that attribution and refine our budget targeting; it gives neither us nor Meta access to any health data.

If you refuse marketing consent, none of this data is transmitted to Meta and your technical data (IP address, User-Agent, Meta cookies) is not retained in our databases. Your account data (email, phone number, first name, last name, date of birth) is of course still retained, but solely to operate the service — see the purposes described in section 5.

3.8 Payment data (if your coach connects their payment account)

When your coach connects to Synergy the Stripe or GoCardless account on which they collect payments from their clients, Synergy imports from that account, on the coach's behalf:

• Your payer identity: name and email address as recorded with the payment provider, as well as the technical identifiers assigned by that provider (customer, mandate)
• Your payment history: amount, currency, status (succeeded, failed, refunded…), date and description

Synergy collects neither card numbers nor bank details (IBAN): this information stays with Stripe or GoCardless. This data allows your coach to follow your payments in the same place as your coaching; Synergy takes no commission on them.

Your data comes from several sources:

• Your direct input in the application (profile forms, food journal, training sessions, etc.)
• Your coach (assigned programs, assessments, notes — if you are coached)
• Apple HealthKit (iOS) and Android Health Connect (Android), with your explicit authorization granted within the operating system. We may read in read-only mode certain physical activity data (steps, distance, heart rate, etc.) to display them in Synergy and enrich your tracking. Apple and Google remain the original controllers of this data in their own systems; Synergy stores a copy within its perimeter once imported. You may revoke this authorization at any time from your phone settings.
• Our technical processors (e.g., Stripe for payment history, RevenueCat for mobile subscriptions)
• Your coach's Stripe or GoCardless account, when the coach connects it to Synergy (payment data described in section 3.8)

6.1 With your coach

If you join a coach's team (by invitation), the coach will have access to the data necessary for coaching: programs you follow, performance, assessments, nutritional data entered as part of the monitoring. Any body progress photo you upload is also automatically visible to your coach; you may at any time delete it from your account settings or choose not to upload a photo if you do not wish to share it. The coach is in this case the data controller (see section 2.2). You may at any time disaffiliate from your coach from the application.

6.2 With our technical processors

The exhaustive list of processors appears in section 7. Each processor is bound to Synergy by a contract (DPA) guaranteeing a level of protection compliant with the GDPR.

6.3 Exceptional cases

Your data may also be shared:

• To respond to a legal obligation (judicial requisition, tax audit, etc.)
• To protect our rights or the security of other users
• In the event of merger, acquisition or transfer of assets (with prior notification to users)
• With your explicit consent for any other case

We never sell your personal data to third parties.

All processors listed below are bound to Synergy by a contract compliant with Article 28 of the GDPR. Transfers to companies located outside the European Union are framed by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

7.1 Hosting and infrastructure

7.2 Payments and subscriptions

When a coach connects their own Stripe or GoCardless account (see section 3.8), these providers are not Synergy's processors for this processing: they are the payment providers chosen by the coach, from which Synergy reads the data at the coach's request.

7.3 Authentication

7.4 Communication

7.5 Analytics and marketing

PostHog collection traffic is routed through a managed proxy relying on the infrastructure of Cloudflare, Inc., acting as a sub-processor of PostHog (governed by PostHog's Data Processing Agreement and Standard Contractual Clauses); this transit may occur on infrastructure located outside the European Union.

7.6 Security and monitoring

In the context of coaching, some coaches choose to import existing training files in Excel or Google Sheets format into Synergy to facilitate the migration of their programs to the platform.

To analyze the structure of these files (identification of columns, sessions, exercises, sets/reps), we use the OpenAI API service:

• Processor: OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, United States
• Data transmitted: content of the file imported by the coach (which may contain nominative training data concerning their athletes)
• Purpose: extraction of the file's structure for automatic conversion into Synergy programs
• Retention: 30 days on OpenAI's side (API retention policy), then deletion
• Transfers: United States, framed by the Standard Contractual Clauses
• Legal basis (Synergy side): performance of the contract with the coach (Synergy acts as a processor of the coach for this operation; OpenAI is a sub-processor authorized by the Synergy↔Coach DPA)

No other AI processing is performed on your data. In particular, we do not submit your health, nutrition or performance data to OpenAI or any other AI model to generate recommendations.

A coach may at any time choose not to use the AI import feature by simply not submitting any file.

9.1 Strictly necessary cookies (without consent)

These trackers are essential for the service to function and do not require your consent (legal basis: performance of the contract, legitimate interest or legal obligation). They do not go through the Axeptio CMP.

Affiliation cookies are only set if you arrive on the website through an affiliate's link (address containing ?via=). They only hold a referral identifier and are used neither for advertising nor for audience measurement.

9.2 Cookies subject to consent (managed by Axeptio)

The Axeptio CMP allows you to separately accept or refuse three categories:

You may modify your choices at any time via the “Manage my cookies” button at the bottom of each page. Withdrawal of consent is as simple as its acceptance.

Withdrawal of consent to analytics automatically triggers the deletion of measurement data associated with your account at PostHog (right to erasure, Art. 17 GDPR).

Some of our processors (DigitalOcean, Cloudflare, OpenAI, Resend, Expo, RevenueCat, Sentry, PromoteKit, as well as Meta and Google in part) are companies located in the United States.

These transfers are framed by the Standard Contractual Clauses (SCC) adopted by the European Commission (Implementing Decision (EU) 2021/914 of June 4, 2021), in accordance with Articles 44 to 49 of the GDPR.

In accordance with the Schrems II ruling of the CJEU (July 16, 2020, Case C-311/18), we have conducted an analysis of the supplementary measures offered by each of these providers (encryption in transit and at rest, access restrictions, transparency on authority requests, etc.) and consider them adequate in light of the nature of the data transferred.

In accordance with CNIL recommendations, we apply the following durations:

At the end of these durations, your data is definitively deleted or anonymized in an irreversible manner. Some data may be kept longer in anonymized form for statistical purposes, without allowing your identification.

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS 1.2+) and at rest for sensitive files
• Secure hashing of passwords (scrypt algorithm with unique salt)
• Role-based access control (athlete, coach, administrator)
• Authentication via secure httpOnly and SameSite sessions
• Signed URLs for accessing private files stored on Cloudflare R2
• Monitoring and logging of sensitive access and operations
• Encrypted regular backups
• Periodic internal security audits
• Team awareness of security best practices

In the event of a data breach likely to entail a risk to your rights and freedoms, you will be notified as soon as possible in accordance with Articles 33 and 34 of the GDPR, and the CNIL will be notified within 72 hours.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct your inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): request the deletion of your data, exercisable directly from the application settings or by email
• Right to restriction of processing: restrict the use of your data in certain cases
• Right to portability: receive your data in a structured, machine-readable format, or have it transmitted to another data controller
• Right to object: object to the processing of your data based on legitimate interest
• Right to withdraw your consent at any time, for processing based on consent (in particular health data). This withdrawal does not affect processing carried out before the withdrawal.
• Post-mortem directives: define directives regarding the retention, deletion or communication of your data after your death

How to exercise your rights? Send your request to our Data Protection Officer (DPO):

• Email: [email protected]
• Postal mail: SYNERGY PERFORMANCE — DPO, 60 rue François 1er, 75008 Paris, France

We undertake to respond within a maximum period of one month from receipt of your request (extendable by two months in case of a complex request, with reasoned notification).

If you believe that your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL):

• 3 Place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, France
• Phone: +33 1 53 73 22 22
• Website: https://www.cnil.fr

The Services are reserved for persons aged at least 15 years, in accordance with Article 7-1 of the French Data Protection Act.

If we become aware that an account belongs to a user under 15 years old without parental consent, we will take appropriate measures, which may include the suspension or deletion of the account and all associated data.

We may modify this privacy policy, in particular in case of regulatory changes, new services, or change of processors. In case of substantial modification, we will inform you by email and/or via the application at least 15 days before the entry into force, so that you can take note of the new terms.

For any question regarding this policy or your personal data:

• Data Protection Officer (DPO): Arnaud MARTINEZ
• Email: [email protected]
• Postal address: SYNERGY PERFORMANCE, 60 rue François 1er, 75008 Paris, France