Last updated: June 2026
Bootcamp Tracker is a tool that lets fitness trainers and clubs manage class groups, attendance and payments. For the personal data of students, the group admin (trainer/club) is the data controller and Bootcamp Tracker acts as the data processor on their behalf. For the admin’s own account data, Bootcamp Tracker is the controller.
Account data (name, email, optional phone for WhatsApp/SMS, password hash, optional photo, 2FA). Group/operational data entered by admins: students’ names, emails and optional phone numbers, attendance, class balances and payments, sessions and feedback. Technical logs and minimal usage metrics for security and reliability.
Performance of a contract (providing the service) and legitimate interest (security, service improvement). Admins are responsible for having a lawful basis to process their students’ data.
Different categories of data are kept for different periods, in line with the GDPR storage-limitation principle: (1) detailed session history — individual sessions and attendance — is kept for up to 18 months, after which it is aggregated into monthly totals and the per-session detail is deleted; (2) account, group, student and payment data is kept for as long as your account is active and is removed when you delete the record or your account (invoices may be retained longer where tax law requires); (3) usage analytics for 90 days; and (4) in-app notifications for 90 days. Separately, free accounts that remain inactive for 12 months are deleted — together with all the data they own — after we send a warning email and a short grace period; logging in keeps the account. The 18-month session-history window is a uniform policy for all accounts, not a paid feature. You can export your data at any time, and deleting your account removes it together with all data you own.
You can access, rectify, export (portability) and erase your data. Use “Export my data” and “Delete my account” in Security settings, or contact us. The export includes the data held about you both as an account holder and as a linked student. Deleting your account permanently removes your account and all data you own.
Data is hosted in the EU (Spain). We use a small set of subprocessors (hosting, transactional email, error monitoring). Optional channels (such as WhatsApp) and invoicing providers are only engaged if and when they are activated, and will be listed on the subprocessors page before use. Where a subprocessor is outside the EU, transfers rely on Standard Contractual Clauses.
Encryption in transit, password hashing, optional two-factor authentication, rate limiting and security headers. No method is 100% secure; we work to protect your data and will notify of breaches as required by law.
By creating an admin account you accept our DPA governing the processing of your students’ personal data on your behalf (subject matter, duration, instructions, confidentiality, security, subprocessors, assistance and deletion/return on termination).
For privacy requests, contact the platform operator: Pablo Noya Peña, soporte.bootcamptracker@outlook.com.
Starting documents pending legal review.