PraxisOSPraxisOSBack to praxisos.io

Privacy notice

In force since 1 October 2026

This notice explains what happens to personal data when you use this website or join the early-access list, and what happens to the data a coaching business puts into PraxisOS. It is written to be read, not to be survived.

Who is responsible

PraxisOS is operated from Portugal by Martim Pais. For anything on this website and for the early-access list, we are the controller. You can reach us at mpais@praxisos.io. If you need our full postal details in order to make a formal request, ask by email and we will give them.

Two different roles, and the difference matters

For this website and the waitlist we decide what is collected and why, so we are the controller and this notice covers it in full.

For everything a coaching business records inside PraxisOS about its own clients (training and nutrition plans, injuries, measurements, photos, notes, invoices), the coaching business is the controller and we are only the processor. We act on their documented instructions. If you are a client of a coach who uses PraxisOS and you want to see, correct or delete your record, ask your coach: they hold the relationship and the decision. We will help them do it, and the product has the tools built in.

What this website collects

  • The early-access list. Your email address, the fact that it came from the landing form, the time you asked, and the time we invited you. That is the entire record: five fields, no name, no company, no profile.
  • Anti-abuse. Your IP address is used, in memory and only for the length of a one-minute window, to limit how often the waitlist form can be submitted. It is not written to our database.
  • If you create an account. Our authentication provider processes your email address, your name if you give one, and the technical events that make a login work.

We run no analytics product, no advertising pixels and no profiling. There is nothing here that follows you to another site.

Why, and on what legal basis

  • The early-access list: consent (Art. 6(1)(a)). You gave us an address so we could tell you when a cohort opens. You can withdraw at any time, and withdrawing is as easy as joining was.
  • Keeping the site working and unabused: legitimate interests (Art. 6(1)(f)). This covers rate limiting, bot checks and error logs.
  • Providing the product to a customer: contract (Art. 6(1)(b)).

Health data

A coaching record contains health data, which Art. 9 treats as a special category. We treat it that way in the engineering, not only in the paperwork: every read of a client record is access-logged, progress photos are never served from a public link but streamed through a proxy that authorises and logs in the same transaction and fails closed if it cannot, consents are frozen into evidence documents rather than stored as a ticked box, and erasure deletes the stored files, not just the database rows.

We do not use health data to train models, we do not sell it, and we do not use it for anything other than running the service for the coaching business that entered it.

Who else processes data

We use a small number of providers. Each one is bound by a data processing agreement, and none of them is permitted to use the data for their own purposes.

Supabase
The database, hosted in the European Union (eu-west-1, Ireland). Everything in the product record lives here.
Vercel
Hosting. The server functions that touch personal data are pinned to the EU region (Dublin) so they run beside the database; the static parts of the site are served from a global network.
Clerk
Accounts, sign-in and invitation emails. Clerk sets the session cookies described in the cookie notice.
Cloudflare
Object storage (R2) for uploaded files: portraits, documents and progress photos. Also the Turnstile challenge that protects the sign-up form.

Where any of these providers processes or stores data outside the European Economic Area, that transfer relies on the standard contractual clauses in the provider’s own data processing addendum. We will tell you which provider handles a given piece of data if you ask.

How long we keep it

  • The early-access list: until you ask to be removed, or until the early-access programme ends, whichever comes first. Removal deletes the entry; we keep no suppression copy of your address.
  • Product data: kept while the coaching business keeps its account. Deleting an organisation locks its team and its clients out of it at once. Once 30 days have passed since the deletion, a daily job starts erasing each of its clients’ records, a few each day, the way an erasure removes it: the record, what was recorded under it and its stored files are deleted, apart from what the next item keeps. The organisation’s other records, its team’s included, are kept. Otherwise a client’s record is removed only by an erasure, which the business’s owner runs, for example when the client asks: the erasure deletes the record, what was recorded under it and its stored files, apart from what the next item keeps.
  • What an erasure keeps. Proof of a consent that was given, and the signed document that records it, are kept after an erasure request. Art. 17(3)(e) permits this where the data is needed to establish or defend legal claims, and a signed waiver whose proof has been deleted is worth nothing to either side. An erasure also keeps the business’s records of payments, which it must hold for its accounting (Art. 17(3)⁠(b)), with the person’s name removed from them; the person’s name where they referred someone else to the business, on that other person’s record; and the log of who opened the record and who erased it.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable form. Where we rely on consent you can withdraw it at any time, and withdrawing does not affect what was lawful before.

Write to mpais@praxisos.io. To leave the early-access list specifically, use the removal link in the message we send you if it carries one, or just email us. Either way the entry is deleted.

If you think we have got it wrong, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live. We would rather you told us first.

Cookies

The cookie notice lists every cookie and every piece of local storage this site actually sets, what puts it there, and how long it lasts.

Changes

If this notice changes in a way that affects you, we will change the date at the top and, for anything material, tell the people it affects directly.