§ 1 About this policy
Aquaplan AS is the data controller for the personal data we process in connection with our services: the training app AquaPlan for Swimming (Norwegian and English versions) and the website aquaplan.no.
This policy explains what personal data we process, why, who can access it, how long we keep it and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.
This is a translation of the Norwegian privacy policy (personvernerklæring). If the two versions differ, the Norwegian version applies.
§ 2 Data controller
When a coach or club registers information about athletes who do not have their own account (see § 10), the coach and the club are responsible for having a legal basis for registering it. Aquaplan AS then processes the data on their behalf.
§ 3 What data do we process?
We only process data that is needed to provide the service. What applies to you depends on whether you are a coach, an athlete or a contact person for a club.
Account
Name and email address
Password – stored only in encrypted form (hash); we cannot read it
Role (coach or athlete), club, training groups and settings
Training and planning
Season plans, period plans and session plans created by coaches
Training log: whether a session was completed, your own rating of effort, form and programme, and notes (private or shared with your coach)
Extra training you register yourself
Test results and race analyses (times and splits) registered by the coach
The coach's notes on individual sessions
Polar training data (optional)
If you connect AquaPlan to Polar Flow: training sessions with sport, time, duration, distance, average and maximum heart rate, calories, training load and device name
Your Polar user ID and the access token that allows AquaPlan to retrieve your sessions
Messages
The content of messages you send to other users in the app
Subscription and payment
Subscription status, subscription type and customer ID at Stripe
Card details are processed only by Stripe and are never stored by us
Technical data
IP address, browser type and time of login
Error logs when technical problems occur
Enquiries and marketing
Name, email address and message when you contact us, for example through the contact form on aquaplan.no (the form opens your own email program)
Contact details for clubs, federations and coaches (organisation, contact person and email address) collected from public sources such as club websites and public business registers, in order to tell them about AquaPlan
§ 4 Who in the app can see your data?
Coaches in your group can see your training log, extra training, test results, race analyses and notes you have chosen to share. Only you can see your private notes.
Polar data can only be seen by you and by coaches you have approved yourself under «Coaches» in the app. You can withdraw the approval at any time.
Others in the same group can see your name, for example when they want to send you a message.
Messages can only be seen by the people in the conversation.
§ 5 Purposes and legal basis
Contract (GDPR Art. 6(1)(b))
Creating and running your user account
Providing the service: planning, training log, tests, analyses and messages
Subscription and payment
Legal obligation (Art. 6(1)(c))
Keeping accounting records as required by the Norwegian Bookkeeping Act
Consent (Art. 6(1)(a) and Art. 9(2)(a))
Retrieving training data from Polar. Heart rate data may be regarded as health data, and we only process it when you have connected Polar yourself. You withdraw your consent by disconnecting Polar in the app.
Newsletters and product updates to registered users
Legitimate interests (Art. 6(1)(f))
Security, troubleshooting and preventing misuse
Improving the service based on anonymised usage
Training administration for athletes without their own account, registered by the club's coach
Information about AquaPlan by email to clubs and coaches. You can opt out at any time by contacting us at post@aquaplan.no.
Note: We never sell personal data, and we do not use it for third-party advertising.
§ 6 Storage and security
Your data is stored in a database operated by Supabase in the EU (Stockholm, Sweden). All traffic is encrypted (HTTPS), and data is encrypted at rest.
Access controls in the database ensure that each user can only see the data they are entitled to, as described in § 4. Access for our own staff is limited to what is needed for operations and support.
§ 7 How long do we keep your data?
Account and training data: for as long as you have an account. When you ask us to delete your account, the data is deleted within 30 days.
Polar data: deleted immediately when you disconnect Polar or delete your account. AquaPlan's access to your Polar account ends at the same time.
Athletes without their own account: until the coach deletes them, or on request.
Messages: for as long as the accounts in the conversation exist.
Accounting records: 5 years, as required by the Norwegian Bookkeeping Act.
Technical logs: no more than 90 days.
Contact details for marketing: until you opt out or the contact is no longer relevant. We keep a record of your opt-out so that we do not contact you again.
§ 8 Service providers and international transfers
We use these service providers to deliver the service:
Supabase — database, login and server functions. Data is stored in the EU.
Vercel — hosting of the app and the website. Processes IP addresses and technical logs.
Resend — sending email, such as login links, notifications and newsletters.
Stripe — payments. Stripe is an independent controller for card details.
Polar Electro Oy (Finland) — only if you connect Polar. Polar is an independent controller for the data in Polar Flow, and we retrieve your sessions from there with your permission.
Google Fonts and jsDelivr — fonts and a software library are loaded from their servers, which makes your IP address visible to them. No cookies are set.
Transfers outside the EEA: Vercel, Resend, Stripe and Google are US companies. Transfers to the US are based on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses. The providers process data under data processing agreements in accordance with GDPR Art. 28.
§ 9 Your rights
Under the GDPR you have the right to:
Access — find out what data we hold about you and get a copy
Rectification — have incorrect data corrected
Erasure — have data about you deleted
Restriction — have processing temporarily paused, for example while a disagreement is resolved
Data portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests, and opt out of marketing
Withdraw consent — at any time, for example by disconnecting Polar in the app
Send requests to post@aquaplan.no. We reply within 30 days.
If you believe we process your data in breach of the rules, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the data protection authority in the country where you live.
§ 10 Children and young athletes
You must be at least 16 years old to create an account on your own. Athletes under 16 need consent from a parent or guardian. This also applies to connecting Polar.
Coaches can register athletes who do not have their own account, with name, year of birth, attendance and test results. The club and the coach are responsible for having a legal basis for this, and for obtaining consent from parents or guardians where required. We recommend that clubs have their own routines for handling personal data about minors.
§ 11 Cookies and local storage
The app stores your login in your browser's local storage so that you stay logged in. This is technically necessary. We do not use cookies or any tools for analytics, tracking or advertising, either in the app or on aquaplan.no.
§ 12 Changes to this policy
We update this policy when the service changes. Significant changes are announced by email to registered users and/or by a clear message in the app. The date of the latest update is shown at the top of this page.
§ 13 Contact
Do you have questions about privacy, want to exercise your rights, or want to report a possible breach? Get in touch: