Privacy Policy

SKALAR GLOBAL sp. z o.o. — website skalarglobal.com and the SPORTO training platform

Version 1.0 · Effective from 08.10.2026

Summary

• We are SKALAR GLOBAL sp. z o.o., a company registered in Poland. We run the website skalarglobal.com and we own and develop SPORTO, a training platform for athletes and their coaches.
• Part A explains what happens to your data when you visit skalarglobal.com or send us a request. Part B explains how SPORTO processes your data, including the data we receive from and send to Garmin and how SPORTO uses artificial intelligence (see the Garmin data section and the AI Transparency Statement). Part C covers your rights, international transfers and how to contact us.
• We do not sell your personal data. Data from SPORTO, including data received from Garmin, is never used for advertising. On our website skalarglobal.com, advertising cookies are used only if you agree to them (see A2).
• Data about your health (for example heart rate, sleep or injuries) is processed only with your explicit consent. AI features work only with your separate explicit consent, which you can withdraw at any time.
• Your Garmin data is never used to train, test or benchmark AI models.
• You can withdraw any consent at any time and object to processing based on our legitimate interests (see Your rights in Part C).

1. Who we are

The controller of your personal data is SKALAR GLOBAL spółka z ograniczoną odpowiedzialnością, ul. Legionowa 31A, 01-343 Warszawa, Poland, KRS 0001093519, NIP 5223291296, REGON 528059303 ("SKALAR", "we", "us"). SKALAR owns and develops the SPORTO platform.

Contact for any data protection matter: [email protected] or by post to the address above.

We have not appointed a Data Protection Officer, because our processing does not currently reach the "large scale" threshold of Article 37 of the General Data Protection Regulation (GDPR). We review this as SPORTO grows. Until then, all questions about personal data are handled through the contact above.

Part A — Website skalarglobal.com

A1. Requests sent through the contact form

What we process: your name, phone number, the services you are interested in, your budget, your message, the page from which you sent the request, your language and the channel through which you found us.

Why and on what basis: to answer your request and prepare an offer — steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). If you contact us on behalf of a company, we process your business contact details on the basis of our legitimate interest in communicating with that company (Article 6(1)(f) GDPR).

Who receives it: our hosting provider for the form OVH Groupe SAS (FRANCE), Cloudflare, Inc. (content delivery and security of the website) and Uspacy CRM.

How long we keep it: 12 months after our last contact, unless we enter into a contract with you; contract records are kept for as long as accounting and tax law requires.

Providing this data is voluntary, but without your name and phone number we cannot reply to your request.

A2. Cookies on skalarglobal.com

Strictly necessary cookies keep the website working — for example, a cookie that remembers the language you selected (stored for up to 365 days). They do not require consent.

Analytics and advertising cookies and similar technologies are used only with your consent, which you give or refuse in the cookie banner (refusing is as easy as accepting) and can change at any time via Cookie settings at the bottom of each page. Until you consent, none of the following is loaded or stored:

• Google Tag Manager (Google Ireland Ltd) — the tool that loads the services below after your consent;
• a note in your browser's local storage of the channel through which you reached our website (for example, an advertising link); if you send us a request, it is attached to it (see A1);
• Google Analytics (Google Ireland Ltd) — to measure visits to the website;
• Meta Pixel (Meta Platforms Ireland Ltd) — to measure the effectiveness of our advertising. We and Meta are joint controllers for collecting this data on our website and transmitting it to Meta. Under our arrangement with Meta, we are responsible for informing you and asking for your consent, and Meta is responsible for what it does with the data afterwards, as described in Meta's privacy policy (facebook.com/privacy/policy). You can exercise your rights regarding this joint processing with us or with Meta;
• Google Ads (Google Ireland Ltd) — to measure the effectiveness of our advertising.

These cookies are stored in your browser for up to 2 months; the cookie banner lists each cookie and its lifetime. Google Analytics keeps the data collected through them for 2 months; Meta and Google keep advertising data under their own privacy policies.

These providers may transfer data to the United States; such transfers are covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

Part B — The SPORTO platform

B1. What SPORTO is and who it is for

SPORTO is a training platform. It builds and adapts a training plan for an athlete, reviews completed workouts and connects athletes with their coaches. SPORTO does not provide coaches: a coach works with an athlete in SPORTO only if the athlete already works with that coach or has found the coach independently and connected them in SPORTO.

SPORTO is intended only for adults aged 18 or over; athletes confirm their age when they register. If we learn that we hold data of a person under 18, we will delete it.

B2. What data we process

Account and sign-in

• Your mobile phone number, verified with a one-time SMS code, and a password. The password is stored only in our identity system, as a secure hash and never in plain text.
• If you sign in through our Telegram bot, Telegram shares with us your phone number, your Telegram first and last name, and your Telegram user ID and chat ID.
• Basic information about the device you sign in from (platform, device model or browser, and a random device identifier stored in your browser), to keep your account secure.
• We do not ask for your e-mail address.

Profile and training preferences

• Name, date of birth, sex, height and weight (with their history), sports and experience, personal records, goals and events, weekly availability, equipment, preferred coaching language, time zone, an optional profile photo and an optional "about me" text.
• The city, region and country you enter. We convert the city into approximate city-level coordinates and a time zone to show you the weather and schedule your training. We never access your device's location.

Health data you provide

• Injuries, illnesses, medications and training restrictions you describe during onboarding or in chat; your wellness journal (for example sleep, fatigue and soreness); how you felt after a workout (effort rating, well-being, comments, injury flags).

Training data

• Your training plan, planned workouts and completed workouts — logged manually, received from Garmin (see B4) or created by your coach (planned workouts, changes and comments).

Data we receive from others

• From Garmin — the data listed in B4; from Telegram — the details listed above, if you sign in through our bot; from your coach — the phone number by which the coach invited you and the planned workouts, changes and comments the coach adds to your plan.

If you use SPORTO as a coach

• Your account details; the profile details shown to your athletes (name, profile photo and a short description); the first names and phone numbers of the athletes you invite; the categories in which you group your athletes; the workouts and comments you create; and your messages with your athletes. If your athlete uses the AI assistant, the planned workouts you add to that athlete's plan are part of the data the AI assistant works with.

Communications

• Messages you exchange with SPORTO and with your coach in the in-app chat, messages sent through our Telegram bot, and text transcripts of conversations with the voice coach (see B8).
• Facts that the AI assistant remembers from your conversations to personalise its answers (for example, the name you prefer or the equipment you have), if you use the AI assistant.

Payments

• Paid SPORTO plans are sold by Vexat LLP (Товарищество с ограниченной ответственностью «Vexat»), BIN 251040029229, office 125a, 151 Mynbayev Street, Bostandyk District, Almaty 050046, Republic of Kazakhstan, which accepts the payments through its bank, ForteBank JSC.
• If you buy a paid plan: a payment token from the bank, the card brand, the last four digits, the expiry date and the issuing country of your card, your subscription, invoices and payment status. Your full card number is entered only on the bank's own payment page and never reaches us.

Consent records and technical logs

• Which version of a document or consent you accepted, when, and the IP address and browser you used — so that we can prove your choice.
• Server access logs (IP address, time, the requested address including its parameters, the page you came from and browser type) to keep SPORTO secure and to investigate errors.

B3. Why we process your data and on what legal basis

Your phone number is required to create an account, because we use it to sign you in. Providing health data, connecting Garmin and using the AI assistant are voluntary; without health data SPORTO cannot adapt your plan to your physiology.

B4. Garmin data

What we receive. If you connect your Garmin account, Garmin sends us the data you authorise on Garmin's permission screen:

• your activities — summaries and the original activity files. Activity files of outdoor workouts may contain your GPS route; we do not use routes for analysis and do not show them to your coach or to the AI assistant;
• your daily health summaries — such as sleep, stress, heart-rate variability, resting heart rate, respiration, pulse oximetry, skin temperature, blood pressure and body composition. If you connect Garmin, your weight in SPORTO is updated from your Garmin body-composition data.

What we send to Garmin. With the express consent you give on Garmin's permission screen (the Training switch), SPORTO sends the workouts planned for you — their name, description, steps with heart-rate, pace or power targets, and the date — to your Garmin Connect calendar, so that you can perform them on your device. Workouts already sent stay in your Garmin Connect account even after you disconnect Garmin or delete your SPORTO account; you can delete them in Garmin Connect. This data is transferred to Garmin and processed under Garmin's privacy notice: https://www.garmin.com/privacy/connect. Do not send workouts to your Garmin Connect account if you are not permitted to upload such data to it.

Garmin's role. Garmin is an independent controller of the data in your Garmin Connect account. Data we send to Garmin may be transferred to Garmin International, Inc. in the United States under the European Commission's Standard Contractual Clauses.

Your control. We never ask for your Garmin password: you authorise access through Garmin's own sign-in and choose on Garmin's permission screen which data to share (Activities, Daily Health Stats) and whether SPORTO may send workouts to Garmin (Training). You can change these choices at any time in your Garmin account's settings for SPORTO; we keep a record of the permissions you granted. The access tokens are stored encrypted. You can disconnect Garmin at any time in SPORTO or in Garmin Connect; we then stop receiving new data and stop sending workouts. Data already received stays in your account until you delete your account; you can ask us to delete it earlier by writing to [email protected].

What we never do with Garmin data. We do not sell it and do not use it for advertising. Neither we nor our providers use your Garmin data, or anything derived from it (including AI prompts, responses, conversation logs and summaries), to train, test, evaluate, benchmark, improve or otherwise develop AI models; we do not include it in any training or evaluation dataset and do not keep it for that purpose.

B5. Who processes your data

Workout reviews and plan adjustments are made by your own coach — a coach you already work with or have found yourself and connected in SPORTO — by SPORTO's AI training assistant, or by both. The AI assistant works only if your plan includes it and you have given separate explicit consent; it runs through the OpenAI or Anthropic API, with data sharing for model training disabled. Your coach sees your Garmin data only after you approve the connection. Your Garmin data is never used to train, test, evaluate or benchmark AI models. You can withdraw your AI consent at any time (see B6).

B6. AI Transparency Statement

What the AI does. If you choose SPORTO's AI training assistant, AI models:

• build and adjust your training plan and individual workouts, and prepare your daily plan;
• review your completed workouts and training weeks;
• check in with you when a planned workout is missed;
• answer your questions in the chat and in voice conversations with the voice coach;
• turn what you tell us about injuries, illnesses and restrictions into structured restrictions that your plan must respect, track your return to training after an injury, and periodically re-check these records for contradictions, outdated restrictions and messages that may signal a safety risk;
• estimate your first training thresholds and zones, and structure the free-text answers in your profile (goals, records, health);
• sort the messages you send so that they reach the right feature, and remember facts you mention (for example, the name you prefer or your equipment) to personalise later answers;
• lead the introductory voice session that explains how SPORTO works;
• prepare spoken audio guidance for your planned workouts.

What data the AI uses. Only the data needed for the specific task: your profile and goals, your plan and workouts, training metrics and health summaries (including data received from Garmin), your health restrictions, the messages you write and the facts the AI assistant remembered from earlier conversations. For your daily plan the AI also receives your city and its city-level coordinates (for weather-appropriate advice); in chat it knows your city, region and country (for example, to give you local emergency numbers). It never receives the GPS routes of your workouts. Workout reviews are prepared without your name. In chat and voice conversations the AI assistant knows the name you use in SPORTO.

Who provides the AI. The AI models are provided by OpenAI or Anthropic, accessed directly through their APIs, as our processors. Data sharing for model training is disabled, and these providers do not use your data to train their models; they may keep it for a limited period (for OpenAI, up to 30 days) to monitor abuse. Audio guidance for planned workouts is prepared from your planned workout together with your training thresholds, your goals and your training restrictions (without diagnoses and without your name): an AI model accessed through OpenRouter, Inc. (USA) writes the script, which may mention a restriction (for example, to take care of an injured knee), and Alibaba Cloud's Qwen text-to-speech service, also accessed through OpenRouter, turns it into speech.

Your consent. The AI assistant processes your data only after you give separate explicit consent, before any AI processing starts. You can withdraw it at any time in Settings → Privacy or by writing to [email protected]. After you withdraw it, AI processing of your data stops immediately and no new data is sent to AI providers; a coach can continue to work with you, and you can use SPORTO without AI features. If your paid plan includes the AI assistant, its AI features stop working; you can switch to another plan at any time in the app. Withdrawal does not affect the lawfulness of processing before it.

You are talking to an AI. When you chat with or talk to SPORTO's AI assistant, you interact with an AI system, not a person. Its suggestions are training recommendations, not medical advice.

Automated decisions and profiling. The AI analyses your workouts and health data to suggest and adjust your training plan. These are recommendations without legal or similarly significant effects: you can change or skip any workout, ask your coach to review it, or contact us to have a person review an AI recommendation, give your view and contest it.

How long we keep AI records. We keep the technical records of what was sent to the AI and what it returned for 30 days, to resolve errors and answer your questions about your plan, and then delete them. The results themselves — your plan, workouts and reviews, your chat history and voice transcripts — stay in your account while it exists (see B10). Once the technical records are deleted, and after your account is deleted, we keep only anonymous usage statistics (date, feature, model, token count, cost) that cannot be linked to you.

Updates. We update this statement whenever the law, Garmin's requirements or our AI features change, and we will notify you in the app before changes take effect. If a change affects how AI uses your data, we will ask for your consent again.

B7. Your coach

A coach can see your data only after you accept the coach's invitation in SPORTO. After that, your coach can see your training calendar and plan and your completed workouts with their metrics (including heart rate, pace, power and recovery data from Garmin), can create, change or cancel your planned workouts and comment on them, and can message you. In the list of athletes your coach also sees your name, profile photo, age, city and country, the phone number linked to your SPORTO account, the date of your last workout, your current training cycle and your SPORTO plan. Your coach does not see your wellness journal (including the daily sleep, stress and heart-rate-variability summaries received from Garmin) or the location of your events.

You can disconnect your coach at any time; from that moment the coach no longer sees your data. The copy of your phone number, city, country and date of birth kept with the coach connection is deleted when the connection ends. If a coach invited you by phone number, we received that number from the coach; if you decline the invitation or it expires, we keep the number for 30 days and then delete it.

B8. Chat, Telegram and the voice coach

In-app chat. The SPORTO chat service runs on our own servers, and your messages are stored in your account so that the conversation can continue. If you use the AI assistant, your messages are also sent to the AI provider to prepare the answer (see B6).

Telegram. If you connect our Telegram bot, we send you workout reviews, your daily plan and chat messages through it, and we store your Telegram user ID and chat ID. Telegram (Telegram Messenger Inc.) processes messages sent through it as an independent controller under its own privacy policy (telegram.org/privacy). Messages already delivered to Telegram remain there even after you delete your SPORTO account. You can disconnect Telegram at any time.

Voice coach. During a voice conversation your voice goes directly from your browser to OpenAI's real-time voice service. We do not record audio; we keep a text transcript of the conversation in your account. Voice conversations are part of the AI assistant and require your AI consent.

B9. Who receives your data

We share personal data only with:

Our service providers (processors), under data processing agreements:

• OVH — hosting; all SPORTO databases and files are stored on servers in Warsaw, Poland;
• OpenAI (OpenAI Ireland Ltd) and Anthropic (Anthropic Ireland, Limited) — AI features, only with your AI consent;
• OpenRouter, Inc. (USA), and through it, as OpenRouter's sub-processor, Alibaba Cloud (Qwen text-to-speech) — audio guidance for planned workouts;
• TurboSMS (Ukraine) — sending one-time sign-in codes; receives your phone number and the code.

Independent controllers (each decides itself how to process the data it receives and is responsible for it under its own privacy policy):

• Garmin — if you connect your Garmin account (see B4);
• Telegram — if you connect our Telegram bot;
• Vexat LLP (Almaty, Kazakhstan) — the seller of paid SPORTO plans; receives the data needed for payment and invoicing (your phone number, plan, amount, payment status), if you buy a paid plan;
• ForteBank JSC (Kazakhstan) — Vexat's bank that processes card payments on its own payment page;
• Google (Google Maps Platform) — converting the city you enter into coordinates when Open-Meteo cannot find it, and finding your time zone; it receives only the city, region and country you entered and the city-level coordinates, never your name. The SPORTO app also loads fonts from Google Fonts, so Google sees your IP address when the page loads.

Your coach — only after you approve the connection (see B7).

Weather services — Open-Meteo (OpenMeteo GmbH, Switzerland) and, as a fallback, WeatherAPI.com. Our server sends them only a city or city-level coordinates, without your name or any identifier, so they receive no data that identifies you.

Our own team. Members of the SKALAR team, including our branch in Ukraine, access personal data only when needed to run and support SPORTO, under confidentiality obligations and the same security measures as in the EU.

We may also disclose data where the law requires us to do so.

B10. How long we keep your data

Deleting your account. You can delete your whole account, or only your athlete profile, in the app settings. We complete the deletion within 30 days: we remove your profile, training, health and Garmin data and files, messages, voice transcripts and AI records, and close your Garmin connection. We keep only the data listed above as retained after deletion, and data that we must keep to establish or defend a legal claim. Copies in our database backups disappear when the backups are overwritten, within 15 days. Messages already delivered to Telegram and workouts already sent to Garmin Connect are not deleted by us (see B4 and B8).

B11. Cookies and local storage in SPORTO

SPORTO uses only cookies and browser storage that are strictly necessary: to keep you signed in and your session secure, to remember your device, to protect requests from being sent twice, to remember your dashboard layout and to run the support chat. SPORTO uses no analytics or advertising cookies; if this changes, we will ask for your consent first.

B12. Security

SPORTO data is stored on servers in Warsaw, Poland, and protected with appropriate technical and organisational measures, including encrypted storage of access tokens for connected services and access control for our team.

Part C — Common provisions

C1. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• data portability — receive the data you provided to us, including data we received from Garmin, in a structured, machine-readable format;
• withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority.

Right to object. Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing it unless we have compelling legitimate grounds or need it to establish or defend legal claims.

How to exercise your rights. In SPORTO, in Settings, you can disconnect Garmin, disconnect your coach, disconnect Telegram, withdraw your health-data consent, withdraw your AI consent and delete your account. For data exchanged with Garmin, you can also switch off Daily Health Stats or Training in your Garmin account's settings for SPORTO. If you withdraw your health-data consent, we stop using your health data to adapt your training and delete it within 30 days. Copy of your data. Requests for a copy of your SPORTO data (access and data portability) are handled only through [email protected]. Because SPORTO accounts are linked to a phone number, before sending your data we confirm that the request comes from you — for example, with a code sent to the phone number of your account. We send the data in a structured, machine-readable file (JSON) within one month of your request. For any other request, write to [email protected]; we respond within one month and may ask you to confirm your identity first.

Supervisory authority. In Poland: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. You may also complain to the supervisory authority in the EU country where you live or work.

C2. Transfers outside the European Economic Area

Some recipients process data outside the European Economic Area. We transfer data only where the European Commission has recognised an adequate level of protection or under the European Commission's Standard Contractual Clauses: OpenAI and Anthropic (United States), OpenRouter (United States), TurboSMS (Ukraine), Vexat LLP and ForteBank (Kazakhstan), Garmin (United States), Google (United States) and Cloudflare (United States). Alibaba Cloud, outside the EEA, receives the audio-guidance text as OpenRouter's sub-processor. USPACY OÜ (Estonia), the CRM in which we keep website requests, may itself transfer data outside the EEA (for example, to the United States) under its own safeguards. Messages you choose to receive through our Telegram bot are passed to Telegram, a company established outside the EEA, because you asked us to send them there; this transfer is based on the explicit consent you give when you connect Telegram, after we inform you that Telegram is established outside the EEA (Article 49(1)(a) GDPR). Transfers made by the tools on our website are described in A2. You can request a copy of the safeguards from us.

C3. Changes to this policy

We may update this policy. We will publish the new version on this page with its effective date, and if the change is significant — in particular if it concerns AI processing or Garmin data — we will notify you in SPORTO before it takes effect and, where required, ask for your consent again.

C4. Contact

SKALAR GLOBAL sp. z o.o., ul. Legionowa 31A, 01-343 Warszawa, Poland · [email protected]