Privacy
How beSporty handles your personal data, under GDPR Art. 13.
Data controller
Markus Klemann
What we store
Your name, email address and profile photo; the activities, events and groups you create; who you are connected to; and, if you log them, health data such as body weight, body-fat percentage and resting or average heart rate, plus the precise location of activities and events. That is what the product needs to work — nothing is collected for advertising and nothing is sold.
Who processes it for us
Supabase (database hosting, EU), Vercel (application hosting), Amazon Web Services (transactional email through SES, Frankfurt), Sentry (error reporting), Upstash (rate limiting, keyed on your user id), Anthropic (AI chat: your messages and the names of people in your crew) and Google (sign-in, and place search). Each processes data only on our instructions.
Your rights
You may request access to your data, correct it, have it erased, receive it in a portable format, or object to its processing. Deletion is available directly in your profile under Delete account: it removes your name, email and photo. Activities and events you created remain, attributed to a deleted user, so other people's records stay intact. If you believe we have mishandled your data, you have the right to complain to a supervisory authority.
How long we keep it
Deleting your account (see Your rights above) erases your name, email, profile photo and the identity shown to others — immediately, not just from view. The activities, events, groups and messages themselves are retained, since removing them would also erase other people's records, such as a shared event or a group's history. Any health data you logged — weight, body-fat percentage, resting and average heart rate — is retained too, still linked to the anonymized account, because it lives in the same records. Error reports are discarded after 90 days.
The waitlist
If you ask for an invite, we store your email address, the language you asked in, when you consented, when you confirmed the address, and which batch you are waiting in. Nothing else. The address is kept only after you confirm it by clicking the link we send; an unconfirmed address is deleted after seven days. Every email we send you carries a link that deletes your entry in one click, with no account and no reply, and we delete the entry rather than flagging it. The legal basis is your consent under GDPR Art. 6(1)(a), which you may withdraw at any time using that link.