The Data Controller is:

Email: founders@keysessions.ai

For any request relating to the processing of personal data or the exercise of GDPR rights, you may contact the Data Controller at the email address indicated above.

This Privacy Policy applies to the processing of personal data carried out through keysessions.ai, including:

• browsing on the site and the web app;
• creation and management of the user account;
• authentication via magic link;
• use of the service;
• access to the free open beta;
• management of payments and subscriptions, where applicable;
• security, prevention of abuse, spam, bots, and fraud;
• operational communications and support;
• compliance with legal obligations and protection of the Data Controller's rights.

This Privacy Policy does not apply to third-party sites, services, or platforms accessible through external links or integrations, whose processing is governed by their respective privacy notices.

Depending on the use of the service, keysessions.ai may process the following categories of personal data.

3.1 Identification and account data

• email address;
• first and last name, where required;
• account identifier;
• account status;
• information relating to registration, access, and closure of the account.

3.2 Authentication data

Access to the service takes place via a magic link sent to the user's email address.

The Data Controller may process:

• email address;
• temporary tokens or technical identifiers;
• date and time of request and use of the magic link;
• technical logs relating to authentication.

keysessions.ai does not require a password, unless otherwise indicated within the service.

3.3 Billing and payment data

In the case of paid services, the following may be processed:

• first and last name or business name;
• billing address;
• city, postal code, province, state, and country;
• any tax data required by applicable law;
• payment, customer, transaction, plan, or subscription identifiers;
• payment status.

Complete payment card information is not processed directly by the Data Controller, but by the external payment service provider.

3.4 Technical and usage data

During use of the service, the following may be collected automatically:

• IP address;
• date and time of requests;
• URLs or paths visited;
• request method;
• response status code;
• information on browser, operating system, and device;
• technical data relating to sessions, errors, security, and performance;
• system and maintenance logs;
• aggregated and not directly identifying statistics on the use of the site and web app, where collected through analytics tools configured without tracking cookies or persistent identifiers.

3.5 Data contained in communications

When you contact the Data Controller, the following may be processed:

• email address;
• content of the communication;
• any attachments or information provided voluntarily by the user;
• technical metadata of the communication.

3.6 Training and athletic profile data

The service allows you to enter, generate, and save data relating to your athletic profile and training activity. In particular, the Data Controller may process:

• the athlete's age, weight, and height;
• FTP (Functional Threshold Power) and the date of the last FTP test;
• the athlete's level and weekly training hours available;
• bicycle configuration (discipline, setup) and bike-fit/biomechanics measurements, where provided, such as saddle height, saddle setback, drop, reach, and reference coordinates of the riding position;
• training mesocycles generated by the platform (season phase, physiological focus, load trajectory, progression curve);
• daily training sessions (power, cadence, duration, intensity-zone targets);
• session execution data (actual power, duration, TSS, RPE, athlete notes and feedback);
• readiness status and recovery parameters;
• gym strength sessions and their systemic impact;
• interactions with the AI coach (briefings, session analyses, questions and answers);
• the location manually indicated by the user or approximate location used exclusively for weather integration to contextualise training.

This data may include information relating to the health, physical condition, or physiological parameters of the user. Processing is carried out on the basis of the performance of the contract for the provision of the requested service pursuant to Art. 6(1)(b) GDPR and, where the data falls within special categories of data, on the basis of the user's explicit consent pursuant to Art. 9(2)(a) GDPR.

Failure to provide, or withdrawal of, explicit consent for the processing of such data may prevent the Data Controller from providing the core features of the service, including the generation of training plans, plan adaptation, and AI coach analyses.

The Data Controller processes personal data for the purposes indicated in the following table.

keysessions.ai uses a location manually entered by the user or, where applicable, approximate location, avoiding the collection of precise location data when not necessary. The service currently does not request access to the device's GPS location to generate weather data.

The Data Controller does not use the data for marketing, advertising profiling, or sending promotional communications, unless this is introduced in the future with an updated notice and, where necessary, the user's consent.

keysessions.ai uses the data provided by the user and the data generated during use of the service to create athletic profiles, generate training plans, adapt mesocycles, evaluate session execution, and provide analyses via the AI coach.

To provide AI-based features, the necessary data may be processed through external AI service providers indicated in section 7 of this Privacy Policy. In production, the Data Controller uses Google Gemini API for such features.

Such processing is intended solely for the provision of the service requested by the user and is not used for marketing, behavioural advertising, or commercial scoring purposes.

The service may produce automated recommendations relating to training, but such recommendations do not constitute decisions with legal effects on the user. The user remains responsible for critically evaluating the guidance received and for stopping physical activity or consulting a qualified professional in the event of doubts, symptoms, or medical conditions.

The Data Controller does not use the user's data to train general third-party AI models, except with the user's consent or another legal basis indicated in this Privacy Policy.

Providing the data necessary for registration, authentication, delivery of the service, and management of payments is necessary in order to use keysessions.ai.

Failure to provide such data may make it impossible to create an account, access the web app, or use specific features.

Providing further data, where requested as optional, is free and does not affect the use of the service, unless such data is necessary for a specific feature requested by the user.

To generate training plans, adapt sessions, and contextualise training with weather data, providing certain athletic data and the weather location indicated by the user may be necessary to use the core features of the service.

Processing is carried out using IT and electronic tools, according to logic consistent with the purposes indicated in this notice.

The Data Controller adopts technical and organisational measures appropriate to protect personal data from unauthorised access, disclosure, modification, loss, or destruction, taking into account the nature of the data, the context, the purposes of the processing, and the risks to data subjects.

Access to the data is limited to parties authorised by the Data Controller and to providers that process personal data on behalf of the Data Controller or as independent controllers, according to their respective role.

To provide the service, keysessions.ai uses technical and commercial providers. Such parties may act, as the case may be, as data processors, sub-processors, independent controllers, or separate controllers.

The Data Controller may also disclose personal data to:

• legal, tax, accounting, or technical advisors;
• public, judicial, or administrative authorities, when required by law;
• parties involved in corporate or organisational transactions, within the limits permitted by law;
• providers of security, maintenance, technical support, and infrastructure.

The Data Controller maintains, where necessary, data processing agreements pursuant to Art. 28 GDPR or other applicable privacy agreements.

Some providers used by keysessions.ai are based or have infrastructure outside the European Economic Area, in particular in the United States.

When this entails a transfer of personal data to third countries, the Data Controller adopts one of the tools provided by the GDPR, including, where applicable:

• adequacy decisions of the European Commission;
• valid certification of the provider under the EU-US Data Privacy Framework (DPF), where available;
• Standard Contractual Clauses (SCC) approved by the European Commission, included in the providers' DPAs;
• supplementary technical, contractual, and organisational measures, when necessary;
• other safeguards or derogations provided by Chapter V GDPR, in the permitted cases.

Vercel, Cloudflare, Stripe, Resend, and Google LLC are certified under the EU-US Data Privacy Framework at the time this notice was drafted, where the relevant service and processing fall within the scope of the applicable certification.

For AI features, keysessions.ai uses Google Gemini API in production. The Data Controller does not use DeepSeek in the production environment. Any change to the production AI provider may require an update to this notice.

As regards OpenWeatherMap, the provider is based in the United Kingdom. Where the processing entails a transfer of personal data to the United Kingdom, the Data Controller relies, where applicable and in force, on the European Commission adequacy decision or on other safeguards provided by the GDPR.

As regards the database (Neon), the main database is configured in a region located within the European Economic Area, currently Frankfurt, Germany (aws-eu-central-1), in order to limit non-EEA transfers of the main application data.

You may request further information on transfers by writing to the Data Controller.

keysessions.ai uses cookies and similar technologies for technical purposes strictly necessary for the operation of the service and, where indicated, aggregated measurement tools for the use of the site and web app.

In particular, the following are used:

• session cookies (Auth.js), necessary to maintain the session and enable user authentication;
• language preference cookie (ksn-locale), necessary to store the user's language choice among the available languages (English, Italian, Spanish, French);
• Cloudflare technical cookies (for example __cf_bm), necessary for the operation of the protection service against bots and malicious traffic;
• Vercel Web Analytics, used for aggregated statistics on the use of the site and web app, without tracking cookies, persistent identifiers, or advertising profiling;
• privacy/analytics notice display preference, where implemented, stored locally in the browser through localStorage and used exclusively to avoid showing the informational notice again after the user closes it.

No profiling, advertising tracking, or marketing cookies are used.

For strictly necessary technical cookies, prior consent is not required. For analytics tools that are aggregated and configured so as not to identify the user or track the user over time, the Data Controller provides information in this Privacy Policy.

Disabling technical cookies through the browser may prevent the correct operation of the web app.

You must not enter, upload, or share third-party personal data through keysessions.ai unless you have a suitable legal basis and have provided the information required by applicable law.

You remain responsible for the third-party personal data you decide to enter or process through the service.

keysessions.ai processes data relating to the physical condition and athletic performance of the user, including weight, power, physiological parameters, training data, readiness, recovery, athlete notes, and feedback. Such data may fall within health-related data pursuant to Art. 9 GDPR.

For such data, processing is based on the performance of the contract pursuant to Art. 6(1)(b) GDPR, as necessary to provide the service requested by the user, and on the user's explicit consent pursuant to Art. 9(2)(a) GDPR, where the processed data falls within special categories of data.

You may withdraw explicit consent at any time by contacting the Data Controller. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, but it may prevent continued use of the core features of the service.

The service is not intended for persons under 18 years of age. If the Data Controller becomes aware of personal data processed in violation of this limit, it will take reasonable measures to delete it or limit its processing.

Within the limits and under the conditions provided by the GDPR, you have the right to:

• obtain confirmation as to whether or not personal data concerning you is being processed;
• access your personal data;
• obtain the rectification of inaccurate data or the completion of incomplete data;
• obtain the erasure of personal data;
• obtain the restriction of processing;
• object to processing based on legitimate interest;
• receive the data in a structured, commonly used, and machine-readable format, where applicable;
• request the transmission of the data to another controller, where technically feasible and applicable;
• withdraw consent, where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

In Italy, the competent supervisory authority is the Garante per la protezione dei dati personali.

Requests relating to privacy rights may be sent to:

founders@keysessions.ai

The Data Controller will respond without undue delay and, in any case, within one month of receiving the request, subject to extension in the cases provided by the GDPR.

The Data Controller may request additional information to verify the user's identity, in compliance with the minimisation principle.

The exercise of rights is free of charge, except for manifestly unfounded, excessive, or repetitive requests, in the cases provided by applicable law.

The Data Controller adopts appropriate technical and organisational measures, including, where applicable:

• access control;
• authentication via temporary links;
• use of infrastructure providers with documented security measures;
• protection against bots, spam, and malicious traffic;
• technical logging and security monitoring;
• backups and maintenance procedures;
• limiting access to the data to authorised parties only.

No IT system can be considered absolutely secure. You must adopt appropriate measures to protect your device, email address, and account access.

In the event of a personal data breach, the Data Controller will assess the event and, where necessary, make the notifications to the supervisory authority and to data subjects in accordance with Articles 33 and 34 GDPR.

The Data Controller may modify this Privacy Policy to reflect regulatory, technical, organisational, or service changes.

Changes will be published on this page with an indication of the last modification date. When changes significantly affect users' rights or consent-based processing, the Data Controller will provide adequate communication and, where necessary, collect new consent.

Personal data: any information relating to an identified or identifiable natural person.

Data subject: the natural person to whom the personal data relates.

Processing: any operation performed on personal data, such as collection, recording, storage, consultation, use, disclosure, erasure, or destruction.

Data Controller: the party that determines the purposes and means of the processing.

Data processor: the party that processes personal data on behalf of the controller.

Service: the web app and features offered through keysessions.ai.

GDPR: Regulation (EU) 2016/679.