Who is responsible for your data
Karlit is run by the Karlit founder, an individual based in Spain, who is the data controller under the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD). For anything about your data, write to infokarlit@gmail.com.
The waitlist on this website
This website, karlitendurance.com, collects one thing: the email address you type into a waitlist form, together with which form you used. Nothing else is asked for, and you do not need an account.
- Why
- To tell you when Karlit opens and to invite you to early access.
- Legal basis
- Your consent, given by submitting the form (GDPR Art. 6(1)(a)).
- How long
- Until you are invited and the early-access period ends, or until you ask us to remove it, whichever comes first.
- Who can read it
- Only Karlit. The list is stored in our database and the website itself has no way to read it back.
To leave the waitlist, write to infokarlit@gmail.com from the address you signed up with. We remove it, and that is the end of it.
What the app collects
Once you have an account, Karlit needs data about you to plan your training:
- Account data. Your email address, your name if you give one, and your sign-in details.
- Profile and goals. Your sports, experience, availability, races, training preferences and the answers you give during onboarding.
- Training data. Workouts and activities: duration, distance, pace, power, cadence, elevation, routes, and your thresholds and training zones.
- Health data. Heart rate, heart rate variability, resting heart rate, sleep, weight, check-ins on how you feel, and injuries or health notes you tell us about.
- Connected services. If you connect Strava, the activities and profile data Strava shares with us, and the access tokens needed to keep them in sync.
- Coach conversations. The messages you exchange with the Karlit AI coach.
- Technical data. Logs of requests and errors, kept to run and secure the service.
Why we use it, and on what legal basis
- Providing Karlit
- Building and adapting your plan, showing your progress, running the AI coach. Performing our contract with you (GDPR Art. 6(1)(b)).
- Using health data
- For those same purposes only. Your explicit consent (GDPR Art. 9(2)(a)), which we ask for separately before onboarding begins.
- Security
- Keeping the service secure and working. Our legitimate interest in protecting Karlit and its users (GDPR Art. 6(1)(f)).
We do not sell your data, use it for advertising, or use it to build profiles for anyone else.
The AI coach
Karlit’s coach uses the AI provider configured for the service (OpenAI by default; Anthropic is also supported). To generate onboarding replies, plans and coach responses, Karlit may send the provider your messages and relevant athlete context. This context can include health data such as heart rate, heart rate variability, sleep, weight or injury notes when needed for the feature and covered by your consent. The provider’s handling and retention depend on the service and account settings in use.
Training load, zones and other numbers are calculated by Karlit itself, not by the AI. The AI can still make mistakes. See the medical disclaimer.
Who else processes your data
These providers process data on Karlit’s behalf:
- Supabase
- Database, sign-in and file storage, including the waitlist.
- Cloudflare
- Hosting, DNS and network security for this website. It handles your IP address and request details to deliver pages and block abuse.
- Vercel
- Hosting of the Karlit web app.
- OpenAI
- AI features when selected in service configuration. See its data controls documentation.
- Anthropic
- AI features only if selected in service configuration. See its Privacy Center.
- Our contact address is a Gmail account, so Google handles emails you send us.
If you connect Strava, Strava is an independent service with its own privacy policy. We only receive what you authorise, and you can disconnect at any time from your profile.
If you accept a human coach inside Karlit, that coach can see your training. Your health data stays private unless you separately choose to share it, and you can end the relationship at any time.
Transfers outside the European Union
Some of these providers, the AI providers in particular, may process information outside the European Economic Area. The provider, data location and applicable transfer safeguards depend on the service configuration. Contact us for details about the provider and safeguards currently used by Karlit.
How long we keep it
We keep your data while your account is open. When you delete your account, or ask us to, we delete your data within 30 days, apart from anything the law requires us to keep. Backups are overwritten on a rolling basis. Technical logs are kept for a short period and then deleted. Waitlist emails follow the rule in the waitlist section above.
Your rights
You can, at any time and free of charge:
- get a copy of your data, including in a portable format;
- correct data that is wrong;
- have your data deleted;
- restrict or object to how we use it;
- withdraw your consent, including to health-data processing. This does not affect processing already done, but some Karlit features may no longer work without that data.
Write to infokarlit@gmail.com and we will answer within one month. If you are unhappy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
Age
Karlit is for people aged 16 or older. We do not knowingly collect data from anyone younger. If you think someone under 16 has an account or is on the waitlist, tell us and we will delete it.
Security
Your data is encrypted in transit and at rest. Access is restricted per athlete at the database level, so no user can read another user’s data.
Changes
If this policy changes in a way that matters, we will ask you to review and accept it again the next time you open Karlit. The date at the top of this page always shows the latest version.