Last updated: October 2026
Bootcamp Tracker is a tool that lets fitness trainers and clubs manage class groups, attendance and payments. For the personal data of students, the group admin (trainer/club) is the data controller and Bootcamp Tracker acts as the data processor on their behalf. For the admin’s own account data, Bootcamp Tracker is the controller.
Account data (name, email, optional phone for WhatsApp/SMS, optional photo, 2FA). Sign-in is passwordless, with single-use codes sent by email, so no passwords are stored. When you sign up we also record how you found us, if known: the referring site or campaign tag (for example “chatgpt.com”), never the page you came from. Group/operational data entered by admins: students’ names, emails and optional phone numbers, attendance, class balances and payments, sessions and feedback. Technical logs and minimal usage metrics for security and reliability.
Performance of a contract (providing the service) and legitimate interest (security, service improvement). Admins are responsible for having a lawful basis to process their students’ data.
Different categories of data are kept for different periods, in line with the GDPR storage-limitation principle: (1) detailed session history — individual sessions and attendance — is kept for up to 18 months, after which it is aggregated into monthly totals and the per-session detail is deleted; (2) account, group, student and payment data is kept for as long as your account is active and is removed when you delete the record or your account (invoices may be retained longer where tax law requires); (3) usage analytics for 90 days; and (4) in-app notifications for 90 days. Separately, free accounts that remain inactive for 12 months are deleted — together with all the data they own — after we send a warning email and a short grace period; logging in keeps the account. The 18-month session-history window is a uniform policy for all accounts, not a paid feature. You can export your data at any time, and deleting your account removes it together with all data you own.
You can access, rectify, export (portability) and erase your data. Use “Export my data” and “Delete my account” in Security settings, or contact us. The export includes the data held about you both as an account holder and as a linked student. Deleting your account permanently removes your account and all data you own.
Data is hosted in the EU (Spain). We use a small set of subprocessors (hosting, transactional email, error monitoring). Optional channels (such as WhatsApp) and invoicing providers are only engaged if and when they are activated, and will be listed on the subprocessors page before use. Where a subprocessor is outside the EU, transfers rely on Standard Contractual Clauses.
You can connect an AI assistant (for example Claude or ChatGPT) to your account through our MCP connection. This only happens if you approve it on a consent screen that shows what the assistant will be able to do. From then on, when you ask it to, the assistant can read your groups’ data (groups, students, class balances, sessions, attendance and payments) and, on paid plans, make changes for you. The data the assistant obtains is sent to that assistant’s provider, which processes it under its own terms: you choose and contract that provider, and for your students’ data it acts on your behalf — it is not a Bootcamp Tracker subprocessor. Students’ email addresses and phone numbers are never shared with assistants. For security we log which tool was used, when, for which group and with what outcome — not the content and not names. We also keep a short record of each change an assistant makes (what changed, and how to revert it) for 30 days, so you can review it and the assistant can undo its own changes within 24 hours. You can see and revoke connected assistants at any time in Security → Connected apps; revoking takes effect immediately.
Encryption in transit, passwordless sign-in via single-use, time-limited email codes (no passwords stored), rate limiting and security headers. No method is 100% secure; we work to protect your data and will notify of breaches as required by law.
By creating an admin account you accept our DPA governing the processing of your students’ personal data on your behalf (subject matter, duration, instructions, confidentiality, security, subprocessors, assistance and deletion/return on termination). The full text is in the DPA tab (/legal#dpa).
For privacy requests, contact the platform operator: Pablo Noya Peña, soporte.bootcamptracker@outlook.com.
Starting documents pending legal review.