This Privacy Policy explains how Trael, a partnership established in England ("we", "us"), the controller, processes your personal data when you use Trael. We are based in the UK/EU and comply with the UK GDPR and EU GDPR. Questions or requests: privacy@trael.app.
Trael is registered with the Information Commissioner's Office (ICO), registration reference 00014709305.
Business transfers
If our business structure changes - for example, if the partnership incorporates as a limited company - your personal data will be transferred to the successor entity, which will become the data controller. The successor will be bound by this Privacy Policy, and your data will continue to be used only for the purposes described here. We will inform you of any change of controller, and this page will be updated with the new entity's details, including its ICO registration.
Special-category (health) data
Trael processes special-category health data - for example weight, height, injuries, medical conditions, pregnancy status, and eating-disorder history - and the audio of health-related voice conversations. We process this data only with your explicit consent (our lawful basis under Article 9 UK/EU GDPR), recorded with a version and timestamp when you complete the questionnaire and when you enable voice.
What we collect and why (data minimisation)
- Account: email and name (to identify your account).
- Questionnaire: age range, sex, height/weight/waist, goal, training setup, diet preferences, and health & safety flags - used solely to generate a safe, personalised plan and to drive our safety screening.
- Progress: daily logs and weekly check-ins you choose to record.
- Coaching: your text/voice messages to the AI coach and its replies.
- Billing: subscription status and Stripe identifiers (we never see or store card numbers).
We do not sell your personal data, and we collect only what a safe plan needs.
Processors we use
- Supabase (EU region) - database, authentication and storage.
- Mistral AI (EU) - generates plans and coach replies.
- Self-hosted voice (EU) - speech-to-text and text-to-speech run on Trael's own servers in Falkenstein, Germany (hosted with Hetzner). Voice audio is transient: it is processed to produce a reply and is never stored by us; only a minute-count is kept to enforce the daily cap.
- Stripe - payment processing (hosted Checkout / Customer Portal; card data never touches our servers).
- Brevo (EU) - transactional email: account messages (e.g. sign-up and password-reset) and the daily workout-reminder email you opt into (sent only to your own account address; turn it off any time in Settings).
International transfers
All our processors store and process data within the UK/EU. Where any transfer outside the UK occurs, it is protected by UK adequacy regulations or the UK International Data Transfer Agreement/Addendum.
Retention
Your account and plan data are retained while your account is active and deleted when you delete your account (deletion cascades after any subscription is cancelled). Voice audio is transient - it is transcribed, used to produce a reply, and discarded; it is never stored. Payment records are retained by Stripe as required by law. A formal retention schedule is in progress (DPIA item R8).
Your rights
You have the right to access, rectify, erase, restrict, and port your data, and to withdraw consent. You can export or delete all your data at any time from Settings → Your data (and the Account screen). To exercise other rights, contact privacy@trael.app. You can also change your cookie choice at any time via Cookie settings in the footer or Settings.
Complaints
You can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local EU supervisory authority.