--- title: "Privacy Policy" description: "How typetwo collects, uses, and protects your personal data." url: "https://www.typetwo.eu/privacy-policy" language: "en" --- # Privacy Policy ## Privacy Policy ### 1. Who is responsible for your data - typetwo is currently run by Luca Ferrara, as a private individual, the company has not yet been formally incorporated. The data controller for the purposes of the GDPR is: - Luca Ferrara Schillerstr. 41 80336 München, Germany - Contact: lucaferraraeu@gmail.com / +39 347 718 7624 - We haven't appointed a Data Protection Officer, since one isn't legally required at typetwo's current size and scale of data processing. ### 2. What data we collect and why - We only collect what you give us directly: through the sign-up forms on this website (on the Home, About Us, Spartan Race, and Fuel Plan pages), through the contact form on the Home page and, if you ask for your plan by email, through the Fuel Plan tool. We don't currently collect payment details or any other personal information, since typetwo does not yet sell any product directly through this site. Specifically, when you use one of these forms or tools, we process: - Your first and last name, so we can address you personally in our communications. - Your email address, to add you to our mailing list and contact you about product launches, priority access, and news, only after you've given consent (Art. 6(1)(a) GDPR). - The language of the page you signed up from (English, German, or Italian), so we can write to you in the right language. - If you sign up using another visitor's invite link, we record that referral relationship (who invited you) and how many people you've referred, this is what powers the waitlist ranking and the reward milestones we tell you about when you sign up. This is necessary to provide the referral feature itself, so it doesn't rely on separate consent (Art. 6(1)(b) GDPR). - A hashed version of the IP address you signed up from, kept only to spot abuse patterns like an unusually high number of signups from the same network in a short time, based on our legitimate interest in keeping the referral program fair (Art. 6(1)(f) GDPR). - If you use the contact form, your name, email address, and message, so we can read and reply to your enquiry (Art. 6(1)(b) GDPR). - Fuel Plan tool: the answers you enter to calculate your plan (race or training details, weight, age, sex, level, sweat and caffeine habits, and the health questions) are processed only in your browser. They are not sent to us and not stored. - Fuel plan by email: if you ask for your plan by email, your email address and your answers are sent to our server only to generate and send that one email, and we don't keep them afterwards. Your answers about your health are data concerning health, so we process them only with your explicit consent, given with the required checkbox on the form (Art. 9(2)(a) and Art. 6(1)(a) GDPR). - Newsletter from the fuel plan form: if you tick the optional box, we save your email address in Resend to send you news and offers, only with your consent (Art. 6(1)(a) GDPR). ### 3. Cookies - We use one strictly necessary cookie on this website. For full details on which cookies we use and why, see our Cookie Policy. ### 4. Who we share your data with - We use the following service providers (data processors) to run this website: - Resend: email delivery and mailing list management. Processes your name and email address to send you communications. It also sends the fuel plan you request, whose content is derived from your answers (which can include health information). - Vercel: website hosting. Processes technical data, such as your IP address, to serve you this website securely. - Supabase: database hosting for waitlist and referral data. Processes your name, email address, referral relationships, and hashed IP address. Hosted in the EU (Frankfurt, Germany). - Cloudflare: bot protection on our sign-up form and on the Fuel Plan email form (Turnstile). Processes technical data, such as your IP address and browser characteristics, to tell human visitors apart from automated abuse. We never sell your data, and we don't share it with anyone else. This website is served entirely over an encrypted (HTTPS) connection, and Resend, Vercel, Supabase, and Cloudflare each maintain their own technical and organisational security measures to protect it. ### 5. International data transfers - Supabase, our database provider, stores your data in the EU (Frankfurt, Germany), so no international transfer applies there. - Resend, Vercel, and Cloudflare are based in the United States. Where your data is transferred outside the European Economic Area, we rely on their Standard Contractual Clauses and other GDPR-compliant safeguards to keep it protected. You can review these safeguards directly: Resend's Data Processing Agreement (https://resend.com/legal/dpa), Vercel's Data Processing Addendum (https://vercel.com/legal/dpa), and Cloudflare's Data Processing Addendum (https://www.cloudflare.com/cloudflare-customer-dpa/). ### 6. How long we keep your data - We keep your name and email address for as long as you're subscribed. You can ask us to delete them at any time (see "Your rights" below), and we'll remove them without delay, unless we're required by law to keep them longer. - If someone you referred asks us to delete their data, we remove their record entirely, this will naturally lower your referral count too, since no trace of them remains. - Vercel, our hosting provider, also keeps short-term technical request logs (retained for 1 hour) to operate and secure this website. - We don't keep your Fuel Plan answers: they stay in your browser and, if you ask for your plan by email, only in the request that generates that email. According to its documentation, Resend keeps sent emails and their content (which is derived from your answers) in its sending logs for 30 days. ### 7. Your rights - Under the GDPR, you have the right to: - Access the personal data we hold about you - Correct inaccurate data - Request deletion of your data - Restrict or object to how we process your data - Receive your data in a portable format - Withdraw your consent at any time, without affecting anything we did before you withdrew it To exercise any of these rights, use the contact form on our website, we'll respond within one month, as required by Art. 12(3) GDPR. You can also lodge a complaint with a supervisory authority, in particular the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA, Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de), or the authority in your own country of residence. ### 8. Children - This website isn't directed at children, and we don't knowingly collect data from anyone under 16. ### 9. Changes to this policy - We may update this policy as typetwo grows, for example, once we start selling products directly, or add new tools to the website. We'll update the date at the top of this page whenever we make changes. ### 10. Contact - Questions about this policy or your data? Use the contact form on our website.