Legal

Privacy Policy

Last updated: April 2026

1. Who We Are

MTB Training Squad ("we", "us", "our") operates the website mtbtrainingsquad.com and provides coaching and training services for mountain bike athletes. If you have any questions about this policy, contact us at web@xcomtb.com.

2. What Data We Collect

We collect the following personal data:

  • Account information — your name, email address and password when you sign up
  • Profile information — your discipline, fitness level, training goals, hours per week, and race dates that you provide during onboarding
  • Training data — check-ins, messages, and session requests you submit through the platform
  • Intervals.icu data — if you choose to connect your Intervals.icu account, we access your activity, calendar and wellness data as permitted by the scopes you authorise
  • Payment data — if you subscribe, payment is handled by Paddle (our merchant of record). We do not store your card details.
  • Usage data — standard server logs including IP address and browser type

3. How We Use Your Data

We use your data to:

  • Provide and personalise your training experience
  • Match you with an appropriate training plan
  • Enable communication between you and your coach
  • Send transactional emails (welcome, check-in replies, session confirmations)
  • Sync your training plan to your Intervals.icu calendar (if connected)
  • Process your subscription via Paddle
  • Improve the platform

4. Legal Basis for Processing

We process your data on the following legal bases:

  • Contract — to provide the service you signed up for
  • Consent — for connecting third-party accounts such as Intervals.icu
  • Legitimate interests — to improve our platform and prevent fraud

5. Third-Party Services

We use the following third-party services:

  • Supabase — database and authentication (data stored in EU region)
  • Vercel — website hosting
  • Resend — transactional email delivery
  • Paddle — payment processing and subscription management
  • Intervals.icu — training calendar integration (only if you choose to connect)

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or financial reasons.

7. Your Rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict processing
  • Data portability
  • Withdraw consent at any time (including disconnecting Intervals.icu)

To exercise any of these rights, email us at web@xcomtb.com.

8. Cookies

We use essential cookies only — to keep you logged in and maintain your session. We do not use advertising or tracking cookies.

9. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), row-level security on our database, and restricted access to personal data.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or via a notice on the platform. The date at the top of this page shows when it was last updated.

11. Contact

For any privacy-related questions or requests, contact us at web@xcomtb.com.