Privacy Policy

Effective date: 26 August 2026 · Provider: Trael, a partnership based in the United Kingdom, trading as Trael

This Privacy Policy explains how Trael ("we", "us"), the controller, processes your personal data when you use Trael. Trael is a partnership based in the United Kingdom, trading as Trael. We are based in the United Kingdom and comply with the UK GDPR and the Data Protection Act 2018. Questions, data-protection rights requests or data-protection complaints: privacy@trael.app.

Trael is registered with the Information Commissioner's Office (ICO), registration reference 00014709305.

Business transfers

If our business structure changes - for example, if the partnership incorporates as a limited company - your personal data will be transferred to the successor entity, which will become the data controller. The successor will be bound by this Privacy Policy, and your data will continue to be used only for the purposes described here. We will inform you of any change of controller, and this page will be updated with the new entity's details, including its ICO registration.

Special-category (health) data

Trael processes special-category health data - for example weight, height, injuries, medical conditions, pregnancy status, and eating-disorder history - and the audio of health-related voice conversations. We process this data only with your explicit consent (Article 9(2)(a) UK GDPR, alongside the contract basis described under Legal bases for processing), recorded with a version and timestamp when you complete the questionnaire and when you enable voice.

What we collect and why (data minimisation)

  • Account: email and name (to identify your account).
  • Questionnaire: age range, sex, height/weight/waist, goal, training setup, diet preferences, and health & safety flags - used solely to generate a safe, personalised plan and to drive our safety screening.
  • Progress: daily logs and weekly check-ins you choose to record.
  • Coaching: your text/voice messages to the AI coach and its replies.
  • Billing: subscription status and Stripe identifiers (we never see or store card numbers).

We do not sell your personal data, and we collect only what a safe plan needs.

Legal bases for processing

Under the UK GDPR, we rely on the following legal bases for each purpose:

  • Creating your account, keeping it secure and signing you in: performance of our contract with you (Article 6(1)(b)).
  • Generating your plan, running the text and voice coach, and adapting your plan at your weekly check-in: performance of our contract with you (Article 6(1)(b)).
  • Processing your health and fitness data for those purposes: performance of our contract with you (Article 6(1)(b)) together with your explicit consent (Article 9(2)(a)); both apply, and you can withdraw consent at any time as described under Your rights.
  • Taking payment and managing your subscription through Stripe: performance of our contract with you (Article 6(1)(b)), and our legal obligation to keep accounting and tax records (Article 6(1)(c)).
  • Sending transactional email (sign-up, password reset, and the workout reminder you opt into): performance of our contract with you (Article 6(1)(b)).
  • Keeping the fraud-prevention record after you leave: our legitimate interests (Article 6(1)(f)), as described under Fraud prevention after you leave.
  • Keeping the service secure and preventing abuse, including rate limiting and safety screening of coach conversations: our legitimate interests (Article 6(1)(f)).
  • Using feedback you send us to improve Trael, and running our creator programme: our legitimate interests (Article 6(1)(f)), as described in those sections.
  • Storing a creator referral code on your device when you follow a referral link: your consent (Article 6(1)(a)), as described under Creator referral links; operating the referral programme once a code is attached to your account: our legitimate interests (Article 6(1)(f)).
  • Complying with the law, including responding to rights requests and data-protection complaints: our legal obligations (Article 6(1)(c)).

Feedback you send us

If you use our feedback form, we collect the message you write, and - only if you choose to give them - your email address, your first name, and whether your experience so far has been good or not so good. We also record the answer you give to the question about sharing your feedback publicly.

We use feedback to understand what to improve in Trael. We may publish a quotation from your feedback on our website only if you chose that on the form: with your first name if you selected that option, or anonymously if you selected that one. If you chose to keep it private, we do not publish it. Email addresses are never published, whichever option you choose - we use yours only to reply to you.

If you are signed in when you send feedback, it is linked to your account, so it is included when you export your data. Feedback is kept while it remains relevant to improving the product. If you delete your account, your feedback is anonymised rather than deleted: the link to your account, your email address and your name are removed, and any permission to publish with your first name is downgraded to anonymous. For privacy questions or requests, contact privacy@trael.app.

Creator referral links

If you arrive at Trael through a creator's referral link, and you have accepted optional cookies, we store that creator's referral code on your device (a cookie and local storage entry named trael_ref) for up to 30 days, so the code can be applied when you sign up. If you decline optional cookies, nothing is stored, and you can still type a code yourself when you sign up. Once a code is attached to your account, it is kept as part of your account data. Creators receive only aggregate statistics about their code; they never receive your identity. Our lawful basis is your consent for the storage on your device, and our legitimate interests for operating the referral programme (see Legal bases for processing). The offer itself is described in our Referral Offer Terms.

If we approach you about promoting Trael

If we contact you about promoting Trael, we keep a record of that conversation. It holds your name, the social media handle and platform you use, roughly how many followers you had when we first spoke, the email address we write to, the email address of any Trael account we give you, how we came across you, how far the conversation has got, the dates involved, and our own written notes about it.

We keep this to run our creator programme, which is a legitimate interest of our business. We do not sell it, we do not use it to advertise to you, and we do not use it for anything else.

You have the same rights over this record as anyone else: you can ask us for a copy of it, ask us to correct it, or ask us to delete it. Our notes are part of it and are included in any copy we send you, word for word. If you hold a Trael account and you delete it, we delete this record at the same time. If you do not hold an account, email privacy@trael.app and we will deal with your request by hand within one month.

Where someone declines, or the conversation simply ends, we delete their record 12 months after that point.

If we give you complimentary access to Trael as a creator or prospective creator, the record of that access is linked to the Trael account it was given to and is deleted with that account, as described under Retention. You can object to our keeping any of these records by emailing privacy@trael.app (see Your right to object).

If you join our creator programme, we additionally process: your agreement-acceptance record (the agreement version you accepted, a document integrity hash, the name you typed, the state of the acceptance checkbox, the time, and session information such as the IP address and browser used); your VAT declaration and VAT number where you give one; your postal address; your UK bank payout details; remittance statements and payment records; and fraud and compliance review records. We keep these records for six years after the agreement ends, because tax and legal obligations require it. Bank details are held only for as long as we need them to pay you.

Processors we use

  • Supabase (EU region) - database, authentication and storage.
  • Mistral AI (EU) - generates plans and coach replies.
  • Self-hosted voice (EU) - speech-to-text and text-to-speech run on Trael's own servers in Falkenstein, Germany (hosted with Hetzner). Voice audio is transient: it is processed to produce a reply and is never stored by us; only a minute-count is kept to enforce the daily cap.
  • Stripe - payment processing (hosted Checkout / Customer Portal; card data never touches our servers).
  • Brevo (EU) - transactional email: account messages (e.g. sign-up and password-reset) and the daily workout-reminder email you opt into (sent only to your own account address; turn it off any time in Settings).

International transfers

Supabase (EU region), Mistral AI (France), our self-hosted voice servers (Hetzner, Germany) and Brevo (France) store and process your data in the United Kingdom or the European Economic Area, and transfers to the EEA are covered by UK adequacy regulations. Stripe may transfer personal data to the United States and elsewhere. Stripe is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge), and where that does not apply, transfers are protected by the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, as set out in Stripe's Data Processing Agreement. Where any other transfer outside the United Kingdom takes place, it is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

Fraud prevention after you leave

When someone pays for Trael, we keep a keyed cryptographic identifier derived from the email address on the payment - not the address itself - together with a payment-credential identifier supplied by Stripe (it identifies the payment method used, not the card number) and the date of the first payment. We keep this after you delete your account, and we use it for one purpose only: to stop the same person being treated as a brand-new customer again - for example to collect a second referral discount or a creator commission by deleting an account and rejoining, or after a payment has been refunded or disputed or fraud is suspected. Our lawful basis for keeping it is our legitimate interest in preventing repeat abuse of our referral programme and our billing.

The safeguards: the identifier is produced with a secret key that is held separately from the database and is never stored with it; without that key, the identifier cannot be turned back into your email address; and we never store your address, name or account details alongside it. We keep this record for six years from the end of your last paid subscription, subject to periodic review, and then delete it. If you object to this retention, email privacy@trael.app and we will consider your objection against the fraud-prevention purpose and reply within one month.

Retention

Your account and plan data are retained while your account is active and deleted when you delete your account (deletion cascades after any subscription is cancelled), with these exceptions, each described above: the fraud-prevention identifier is kept; feedback you sent is anonymised rather than deleted; and a creator-programme record is deleted at the same time as the account it belongs to. Voice audio is transient - it is transcribed, used to produce a reply, and discarded; it is never stored. Payment records are retained by Stripe as required by law.

Your rights

You have the right to access, rectify, erase, restrict, and port your data, and to withdraw consent. You can export or delete all your data at any time from Settings → Your data (and the Account screen). To exercise other rights, contact privacy@trael.app. You can also change your cookie choice at any time via Cookie settings in the footer or Settings.

Your right to object

Where we rely on our legitimate interests, you have the right to object to that processing. This includes the fraud-prevention record we keep after you leave, the creator-programme records described above, and our use of feedback to improve Trael. To object, email privacy@trael.app. We will consider your objection against the purpose in question and reply within one month. How we handle an objection to the fraud-prevention record is described under Fraud prevention after you leave. Where we process personal data for direct marketing, you may object at any time and we will stop using your personal data for that purpose.

Data-protection complaints

If you are unhappy with how Trael has handled your personal data, you can make a data-protection complaint to us at privacy@trael.app. You do not need to use legal language or quote data-protection legislation.

We will acknowledge receipt of your complaint within 30 days, investigate it appropriately without undue delay, keep you informed of progress where necessary, and tell you the outcome without undue delay once our investigation is complete. We may ask for information reasonably needed to investigate the complaint or, where someone complains on another person's behalf, evidence that they are authorised to act for that person.

If you remain dissatisfied, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local EU supervisory authority where applicable.