Privacy Policy
Last updated: 19 July 2026
This policy explains what personal data Macrocycle collects, why, who we share it with, and the rights you have over it. It covers our website and both mobile apps.
1. Who we are
Macrocycle is operated by Petar Ivanov Tech EOOD (Петър Иванов Тех ЕООД), a single-member limited liability company registered in Bulgaria under UIC 205390030, VAT number BG205390030, with its registered seat at Ovcha Kupel 2, bl. 39, ent. A, ap. 64, Ovcha Kupel district, 1632 Sofia, Bulgaria. We are the data controller described in this policy, except where section 3 says otherwise.
For any privacy question or to exercise your rights, contact us at info@petarivanov.tech. We have not appointed a Data Protection Officer, as we are not required to.
2. What this policy covers
This policy applies to three things:
- getmacrocycle.com — this website, including the early-access form.
- Macrocycle Coach — the app coaches use to build programmes, run sessions, and track their clients.
- Macrocycle Client — the app a coach’s clients use to see and log their training.
3. When we are the controller, and when we are not
This distinction matters, because most of the sensitive data in Macrocycle is not ours and we do not decide what happens to it.
- We are the controller for website visitors and waitlist signups, for coach and client account data (name, email, sign-in identity), and for technical data such as crash diagnostics.
- We act as a processor on the coach’s behalf for the records a coach keeps about their clients — training history, body measurements, intake answers, notes. The coach decides what to record, why, and for how long; we only store and process it so the service works. Coaches are responsible for having a lawful basis for that data and for informing their own clients. Coaches using Macrocycle professionally should have a data processing agreement with us; contact us to put one in place.
4. What we collect
Website
| Data | Why |
|---|---|
| Email address | To contact you about early access. |
| What you currently coach on (a single choice) | To understand who is interested and prioritise the product. |
| Campaign parameters (utm_source, utm_medium, utm_campaign) and referring page | To see which channels bring interested coaches. |
| Aggregate usage statistics (only if you agree) | We use Google Analytics 4 to count visits and see which pages are read. It sets cookies and assigns a random identifier to your browser. It does not load at all unless you accept it in the banner shown on your first visit; if you decline, no analytics cookies are set and nothing is sent to Google. You can change your mind by clearing this site’s data in your browser, which makes the banner reappear. |
The apps
| Category | Examples |
|---|---|
| Account and identity | Name, email address, and the identifier from the sign-in method you choose (Google, Apple, or email). Handled by our authentication provider — we never see or store your password. |
| Client profile (entered by the coach) | Name, sex, year of birth, height, training goal, start date, coach notes, and contact details the coach records (phone, Viber, email). |
| Training data | Programmes, scheduled and completed sessions, exercises performed, sets, repetitions and weights lifted, and any exercises excluded for a client together with the reason recorded — which may include an injury or limitation. |
| Health and body-composition data | Body weight, tape measurements, skinfold caliper readings and the body-fat figures calculated from them, daily weight and calorie entries, and the answers to the intake questionnaire, which asks about training history, lifestyle, and health. See section 5. |
| Package and billing status | Session package size, sessions used, agreed price, and renewal date, where the coach records them. We do not process card payments and never hold card details. |
| Technical and diagnostic | App version, device model, operating system version, and crash or error reports, where error monitoring is enabled for a build. |
Progress photos. Our data model reserves a place for progress photos, but the feature is not enabled and no photos are collected or uploaded today. If we turn it on, we will update this policy first and ask for consent where required.
5. Health data and your explicit consent
Body weight, body-composition measurements, and intake answers about your health are special category data under Article 9 of the GDPR. We process them only where you have given explicit consent, or your coach has obtained it from you, for the purpose of delivering your coaching.
You can withdraw that consent at any time — through your coach or by emailing us. Withdrawing consent does not affect processing that already happened, but it does mean we stop, and the affected records are deleted unless we must keep them by law. Parts of the service will not work without this data: check-in tracking and progress charts exist to process exactly this information.
6. Our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the apps to coaches and their clients | Performance of a contract — Art. 6(1)(b) |
| Health and body-composition data | Explicit consent — Art. 6(1)(a) together with Art. 9(2)(a) |
| Early-access emails from the website form | Consent — Art. 6(1)(a); withdraw it at any time |
| Website analytics cookies | Consent — Art. 6(1)(a); nothing loads before you give it |
| Keeping the service secure, fixing crashes, preventing abuse | Legitimate interests — Art. 6(1)(f); we use the least data that achieves this |
| Accounting and tax records | Legal obligation — Art. 6(1)(c) |
7. How we use AI
Macrocycle uses Anthropic’s Claude models to help a coach with drafting work: proposing a next training programme, summarising check-ins, suggesting an exercise substitution, or drafting a message. To do that, the relevant training context — goals, recent session logs, current programme, check-in figures — is sent to Anthropic’s API and a suggestion comes back.
Three things are true of this by design:
- Every AI output is a suggestion the coach reviews. The AI layer never writes to the database and nothing it generates reaches a client without the coach explicitly acting on it.
- There is no automated decision-making that produces legal or similarly significant effects for you within the meaning of Article 22 GDPR. A human coach decides.
- Your data is not used to train AI models. We use Anthropic’s commercial API, whose terms provide that inputs and outputs are not used for model training.
8. Who we share data with
We do not sell personal data and we do not share it for advertising. We use the following providers, each bound by a data processing agreement and permitted to use the data only to provide their service to us:
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database and backend hosting for the apps | EU (Frankfurt) |
| Clerk | Authentication and account management | USA |
| Anthropic | AI suggestions (section 7) | USA |
| Sentry | Crash and error diagnostics, where enabled | EU/USA |
| Vercel | Hosting for this website | EU/USA |
| Google (Google Analytics 4) | Website statistics, only where you have consented | EU/USA |
| Apple, Google | App distribution and beta testing | EU/USA |
We may also disclose data where the law requires it, or to establish or defend legal claims.
9. International transfers
Your data is stored in the European Union. Some providers above are based in the United States, so limited transfers outside the EEA occur. These are covered by the European Commission’s Standard Contractual Clauses, and where applicable by the provider’s certification under the EU–US Data Privacy Framework. Contact us if you would like details of the safeguards for a specific provider.
10. How long we keep data
- Coaching records — for as long as the coach maintains the client relationship in Macrocycle. When an account is deleted, the associated records are deleted within 30 days, except where the law requires otherwise.
- Waitlist emails — until you unsubscribe or ask us to delete them, and in any case no longer than 24 months after the last contact.
- Crash diagnostics — up to 90 days.
- Accounting records — for the period Bulgarian law requires, which is generally 5 years, and 10 years for certain tax documents.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we process it;
- receive your data in a portable, machine-readable format — Macrocycle is built to export your data on request, and we consider this a product promise, not merely a legal duty;
- withdraw consent at any time, without affecting past processing.
Deleting your account. Email info@petarivanov.tech from your account address and we will delete your account and its data within 30 days. If you are a coach’s client, you can also ask your coach, who can remove your records directly.
We respond to requests within one month. Exercising these rights is free unless a request is manifestly unfounded or excessive.
If you believe we have handled your data unlawfully, you can complain to the Commission for Personal Data Protection (CPDP) (Комисия за защита на личните данни (КЗЛД)), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria — cpdp.bg. We would appreciate the chance to address it first.
12. Security
Data is encrypted in transit and at rest. Access to client records is enforced at the database level, so a coach can reach only their own clients’ data and a client only their own. Passwords are never stored by us — sign-in is handled by our authentication provider. Access to production systems is limited to those who need it. No system is perfectly secure, but if a breach ever affects your rights we will notify the supervisory authority within 72 hours and inform you where the law requires.
13. Children
Macrocycle is not intended for children under 18 using it on their own. A coach may train a minor and keep their records in Macrocycle, but only with the consent of a parent or guardian, which the coach is responsible for obtaining. If you believe a child’s data has been recorded without such consent, contact us and we will delete it.
14. Changes to this policy
We will update this page when our processing changes, and revise the “last updated” date above. For material changes affecting you we will give notice in the app or by email. Where a change relies on your consent, we will ask for it before it takes effect.
15. Contact
Petar Ivanov Tech EOOD (Петър Иванов Тех ЕООД)
UIC 205390030 · VAT BG205390030
Ovcha Kupel 2, bl. 39, ent. A, ap. 64, Ovcha Kupel district, 1632 Sofia, Bulgaria
info@petarivanov.tech
16. Language
This policy is available in Bulgarian and English. For users in Bulgaria, the Bulgarian text prevails in the event of any discrepancy between the two versions.