Privacy Policy

Last updated: 11 October 2026

This policy describes how ZoneDeux (zonedeux.cc) collects, uses and protects your personal data. We follow the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR).

Data Controller

ZoneDeux AS (under formation) is the data controller for the personal data described here. Send questions about privacy to contact@zonedeux.cc.

What Data We Process

We process this data:

  • Name – when you create an account
  • Email address – when you create an account, make a purchase or sign up for the newsletter
  • Payment information – processed directly by Stripe; we never see or store your card number
  • IP address – in server logs, for security and to keep the service running
  • Cookies – for signing in
  • Training data – the sessions you log or tick off, with duration, RPE and notes, and summaries of the sessions fetched from intervals.icu if you connect it. Heart rate and power can say something about your health; we use them only to show you your own sessions, and never share or sell them.

Purposes and Legal Basis

We use the data only for these purposes, each with its basis in the GDPR:

  • User account – creating and running your account. Basis: our agreement with you (Art. 6(1)(b)).
  • Training calendar – showing your sessions, and fetching sessions from intervals.icu once you have connected it yourself. Basis: our agreement with you (Art. 6(1)(b)).
  • Purchases – delivering the product and sending a receipt. Basis: our agreement with you (Art. 6(1)(b)). Accounting records are kept because the Norwegian Bookkeeping Act requires it (Art. 6(1)(c)).
  • Newsletter – sending training content. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
  • Security and operation – server logs to stop misuse and fix faults. Basis: our legitimate interest in a safe service (Art. 6(1)(f)).

Providers That Process Data for Us

These providers process data on our behalf and on our instructions:

  • Render — Hosting of the website. Every request to zonedeux.cc passes through Render.
  • Cloudflare — Network and security in front of the website, used by Render. Sees the IP address of everyone who visits.
  • Neon — Database. Stores accounts, training data and purchase history in Frankfurt (EU).
  • Resend — Email delivery. Sends confirmations, receipts and newsletters.

Services You Choose

You use these services only if you choose to. Each is responsible for what it stores, under its own privacy policy.

  • Stripe — Payment. Stripe handles all payment information when you buy something, and is PCI DSS certified.
  • Google — Sign-in. Used only if you choose to sign in with your Google account.
  • intervals.icu — Training session import. Used only if you connect your intervals.icu account. When you connect, we fetch your sessions from the last two years, and after that the last week as it goes. We store only a summary of each session; detailed power and heart-rate data is fetched when you open a session and is not stored. The API key or access token from intervals.icu is stored encrypted, and you can disconnect at any time on My page.

Transfers Outside the EU/EEA

Our database is in the EU. Render, Cloudflare, Resend, Stripe and Google are US companies, and data may be processed in the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How Long We Keep Data

  • Account: as long as you have the account. When the account is deleted, the data that belongs to it is deleted too.
  • Training data: the sessions you log, your notes and the summaries from intervals.icu are kept until you delete them or the account.
  • The intervals.icu connection: the key is deleted when you disconnect. Detailed power and heart-rate data is never stored.
  • Purchases: for five years, because the Norwegian Bookkeeping Act requires it.
  • Newsletter: until you unsubscribe.

Your Rights

Under the GDPR you have the right to:

  • Access – know what data we hold about you
  • Rectification – have incorrect data corrected
  • Erasure – have your data deleted
  • Data portability – receive your data in a machine-readable format
  • Restriction – ask us to pause processing for a time, for example while an error is corrected
  • Objection – object to processing based on our legitimate interest
  • Withdraw consent – at any time, for processing based on consent

How to Use Your Rights

Send an email to contact@zonedeux.cc. We answer within 30 days. If you believe we do not process your data correctly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Cookies

We use only the cookies needed for signing in. We use no analytics or tracking tools.