# Privacy policy

**Effective 19 September 2026.**

This policy explains how MovePacket handles personal information when you use our website and services.

## Who we are

MovePacket is operated by **Semi-pro Limited**, Suite 1104 Crawford Building, 70 Queen's Rd Central, Hong Kong. For privacy questions or requests, email **[damian@semiprocycling.com](mailto:damian@semiprocycling.com)** or write to that address, marked “Privacy”.

This policy covers the MovePacket website, accounts, support and platform. It does not replace the privacy notice of a coaching business using MovePacket or the notices of services you choose to connect.

MovePacket serves adult coaching-business customers, including customers in the European Union and United Kingdom. Coaches may handle information about athletes under 18; the safeguards and responsibilities for that information are explained below.

For account administration, service security, billing and our own communications, Semi-pro Limited decides why and how information is used. Where applicable data-protection law uses that term, we act as the controller.

For athlete records and other personal information a customer supplies to run their software, we generally process information on that customer's instructions. The coaching business decides its coaching purposes and who should have access. Our responsibilities for this processing also depend on the applicable service and data-processing agreements. We remain responsible for our own obligations; this distinction does not remove them.

## Information we handle

- **Account and workspace information:** your name, email, sign-in identifiers, workspace membership, access permissions, project names and setup choices. You can optionally provide your coaching company name for project naming and an athlete-count range to help us understand the coaching businesses using MovePacket. These preferences can be changed or cleared in Settings. For our own signup and sign-in forms, credentials pass through the MovePacket server to WorkOS for authentication; we do not store passwords or verification codes. Authorised MovePacket management staff can see signup details and whether a first project has been started or saved, for account administration and onboarding support. Unverified signup entries are labelled separately.
- **Billing information:** subscription and payment status, billing contact details and payment-provider references. Card details entered into Stripe's checkout are handled by Stripe; MovePacket does not store full card numbers.
- **Software and activity data:** the prompts, project files, application records, coaching notes and uploads you or authorised users provide. FIT, GPX and similar files may contain activity times, precise routes, device information, performance measurements and health-related information. The contents depend on what is supplied.
- **Connection information:** the service connected, account references, permissions and connection status. When a supported integration is enabled, it may also supply the data covered by that authorisation. Connection credentials require protected handling and must not be pasted into AI chats or generated software.
- **Support and operational information:** messages you send us, privacy requests, access and change records, service errors, usage measurements and backup or recovery evidence. Our infrastructure providers may process IP addresses, device/browser information and request metadata to deliver and protect the service.

Information comes from you, your workspace administrators and authorised users, sign-in and payment providers, and services that you or the relevant person authorises. We also generate operational records when the platform is used.

Basic account and authentication information is necessary to provide an account. Payment information is needed when purchasing a service. Uploads and optional connections are your choice; features that depend on missing information will not work. Do not supply information about another person unless you have authority and an appropriate basis to do so.

## Why we use information

We use information to provide accounts and projects; store and process authorised data; carry out requested building, publishing, export and recovery operations; manage subscriptions; provide support; protect against abuse; investigate faults; and meet applicable legal obligations.

Where EU or UK data-protection law applies to our own controller activities, we rely on the following bases:

| Purpose | Basis |
| --- | --- |
| Provide the service, requested support and billing to an individual customer | Performance of our contract, or steps requested before entering it |
| Administer a business customer's staff accounts and communications | Our legitimate interest in providing and managing the business relationship |
| Protect the service, investigate faults, maintain necessary operational records and manage legal claims | Our legitimate interests in a reliable, secure service and protecting our legal rights, balanced against individuals' rights |
| Meet applicable accounting, tax or regulatory requirements | Compliance with a legal obligation recognised by the applicable EU or UK law; otherwise our legitimate interest in meeting our business obligations, balanced against individuals' rights |
| Optional uses that require consent | Consent for the stated purpose, which can be withdrawn |

For customer-controlled athlete data, the customer must establish the appropriate basis and, where required, an additional condition for health or other sensitive data. Authorising an API connection does not by itself resolve every legal requirement for using that data.

We do not sell personal information or use it for advertising. Service messages are separate from promotional communications. Any optional marketing or non-essential tracking must have the notices, choices and permissions required for that use.

## AI and your choice of builder

When you use MovePacket's built-in generation feature, your request and the current project content are sent to the configured AI provider to generate or revise the project. First-project builds and refinements use OpenAI when the frontier-model configuration is enabled. Other built-in generation and enabled AI-assisted support use Anthropic under their separate configuration. The question and relevant conversation context may be sent to the provider handling that feature.

The project chat interface uses OpenAI ChatKit. Its hosted interface processes the requests, responses and build activity shown in the conversation. MovePacket keeps this chat transcript in page memory for the open project view; the saved project and latest build brief remain in your workspace. Closing the view clears that page-memory transcript. Provider processing and retention are separate from this local behaviour. Setting an API request not to be stored for retrieval is not a promise of zero provider retention.

Use example data in the current first-project generation experience. Do not submit real athlete health information, credentials or other sensitive records to that flow. Connecting an activity source does not automatically authorise sending its contents to an AI model.

When you choose an external builder such as Codex, Claude or Cursor, that builder has its own account, terms and privacy practices. Information you give it, including data obtained through an authorised MovePacket connection, may be processed by its provider. Review the connection permissions and the information you choose to share.

MovePacket does not use customer content to train or fine-tune its own AI models. Where a supported feature classifies or analyses data, applying existing rules or an existing model to produce a label or result is analysis or inference, rather than training a model. Results linked to an athlete remain customer data and are subject to the relevant access, retention and deletion controls. This explanation does not mean every proposed classification feature is already available.

AI-provider retention and use are governed by the applicable provider arrangement; this policy does not promise that every external AI tool has the same terms. No-training and zero-retention are different commitments. Generated coaching tools and their outputs require human judgement. We do not use MovePacket's building feature to make solely automated decisions about people that have legal or similarly significant effects; a customer's own application may have different uses, which it must explain.

## Who receives information

We share information as needed with authorised workspace members, service providers supporting the relevant feature, and people or services you instruct us to share with. Publishing a public page makes its contents available to visitors; public content may be copied or indexed. A private project and a public publication have different audiences. Check access settings and content before sharing.

The platform's provider arrangements include:

| Provider or service | Purpose and information involved |
| --- | --- |
| Cloudflare | Website and application delivery, database, file storage and service security; relevant content and request information |
| WorkOS | Account authentication and sign-in information |
| Stripe | Checkout and billing information when payment features are used |
| OpenAI | Configured first-project generation; prompts, responses and build activity displayed by the ChatKit interface |
| Anthropic | The requests and project content submitted to other enabled built-in generation and support features |
| GitHub | Source control and delivery workflows; source and build metadata where used, not a general destination for athlete datasets or secrets |
| Backblaze | Off-site recovery copies for projects enrolled in the backup rollout; this is not yet universal project coverage |
| Better Stack | External availability checks, incident information and operator alert delivery |
| Email delivery providers, including Resend where configured | Service or operational messages, recipient addresses and delivery information |

Nango credential custody and an Intervals.icu connection are in development. They are not generally available customer integrations under this policy. Before enabling them for customers, we will update the relevant information and connection notices. Proposed Intervals features include authorised activity data, with wellness and planned-workout features subject to further implementation and consent.

Your independently chosen services are not automatically covered by MovePacket's supplier agreements. Their roles depend on the actual service and relationship. We may also disclose necessary information to professional advisers, authorities where legally required, or in connection with a business reorganisation, with appropriate confidentiality and protection.

## International handling

Semi-pro Limited is established in Hong Kong. The providers supporting MovePacket operate internationally, and information may be stored or accessed outside your country. MovePacket does not currently promise that all information stays within Hong Kong, the EEA or the UK.

Where a transfer needs a specific legal safeguard, the applicable provider arrangements and safeguards must be established before that processing is enabled. Contact us for information about the arrangements relevant to your service. We are reviewing the arrangements for wider EU/UK customer-data processing, including the planned Nango and Intervals.icu integrations. These integrations will remain unavailable to customers until the relevant contractual and transfer safeguards are established. You can request information about applicable safeguards and copies where available by contacting us.

## How long information is kept

We retain information according to the service purpose, customer instructions and applicable obligations. A subscription cancellation or an archived athlete is not the same as a completed data-deletion request.

| Information | Retention approach |
| --- | --- |
| Account, workspace and project content | Kept to provide the service until deletion is requested or an applicable retention rule takes effect. Account closure and content deletion currently need an assisted review. Necessary legal, security and billing records may be retained separately. |
| Incomplete MovePacket signup details | Name, email and optional company are held for up to 48 hours while verification is pending, then removed by scheduled cleanup. After verification, the company preference moves into the account record and the pending entry is removed. WorkOS account records have separate provider retention and may need assisted deletion. |
| Sign-in abuse prevention | Short-lived, secret-hashed IP/email counters expire within 24 hours and are removed by scheduled cleanup. We also use Cloudflare Turnstile to verify signup and sign-in requests. |
| Customer-controlled athlete data | Kept under the customer's documented instructions. Archiving alone does not erase records; customers should set and review their retention needs. |
| Prepared privacy-export downloads | Access expires 24 hours after the export request; scheduled cleanup removes expired package files. Downloaded copies remain under the recipient's control. |
| Built-in daily aggregate project analytics | Current UTC day and the previous 29 days; older rows are excluded and scheduled for removal. |
| Platform operations change feed | Scheduled cleanup removes entries older than 90 days. This does not cover every security or provider log. |
| Privacy requests and deletion evidence | Minimal records are retained to record actions and prevent deleted information being restored. These records currently require retention review rather than an automatic expiry. |
| Billing, support, security logs and backups | Retained according to their purpose, any applicable legal obligations, incident or dispute needs, and the configured provider schedule. Ask us for the schedule relevant to your account; no single expiry period applies to all these copies. |

Deletion from live systems does not instantly remove every backup or third-party copy. Recovery requires checking current restrictions and deletion records before restored data is made available again. Some custom content and external systems require separate action. We will explain outstanding scope or retention exceptions when handling a request.

## Cookies and browser storage

MovePacket uses necessary browser technologies for sign-in, session security and interface preferences. The current account-session cookie has a seven-day lifetime and may be renewed; the temporary sign-in and verification-flow cookies last up to 30 minutes. Signing out clears the MovePacket session cookie. Authentication providers can use their own necessary cookies.

Local browser storage remembers preferences such as whether the workspace sidebar is collapsed and whether an introduction has been shown. You can remove these through your browser settings. Blocking essential cookies may prevent sign-in.

MovePacket's built-in project analytics stores daily aggregate counts and response measurements, rather than named-athlete or unique-visitor tracking. Infrastructure access logs are separate. Customer-built applications and external sites may add their own analytics or cookies and must explain those separately.

## Security

We use access controls, private storage, protected account sessions and provider-managed encryption to help protect information. Access is limited according to the workspace and supported operation. Backups and monitoring have a defined scope; a connected service or a saved backup is not a guarantee that every application or workflow has been tested.

See our [trust centre](/trust) for control descriptions and their limits. No system can guarantee complete security, and this policy is not a certification or a promise of GDPR compliance. Customers remain responsible for how they configure their applications, authorise users and share information.

## Your choices and privacy requests

Contact **[damian@semiprocycling.com](mailto:damian@semiprocycling.com)** to ask about information we hold, request access or correction, raise a concern, or ask about deletion or restriction. Include enough information to identify the relevant account or service; do not send passwords or API keys. We may need to verify identity and authority before acting.

Depending on the law and circumstances, you may also have rights to portability, object to processing based on legitimate interests, withdraw consent, and challenge certain automated decisions. Withdrawing consent does not affect processing already lawfully carried out. Rights can have exceptions, including protection of other people and necessary legal retention. We will respond within the applicable legal time limits and explain relevant exceptions.

If the information concerns your relationship with a coach, contact that coaching business first. We can help identify the appropriate contact and assist within our role; an athlete does not need a separate MovePacket account to contact us about privacy. Workspace owners can use the available privacy tools, but an exported file alone may not be a complete response to a legal request.

You can complain to Hong Kong's [Privacy Commissioner for Personal Data](https://www.pcpd.org.hk/), or to the relevant data-protection authority where other applicable law gives you that right, including the [UK Information Commissioner's Office](https://ico.org.uk/make-a-complaint/).

## Children and policy changes

MovePacket accounts are for adults running or supporting a coaching business, not for direct purchase by under-18s. A coaching customer may work with athletes under 18. The customer is responsible for establishing its lawful basis, giving appropriate privacy information, and obtaining parental involvement or permission where required by the applicable law and circumstances. A general account or API authorisation does not by itself provide that authority.

MovePacket remains responsible for its own duties, including protecting information, following lawful documented instructions, managing its service providers and assisting with relevant privacy requests. Before enabling a workflow involving children's health or location information, the customer and MovePacket must assess the safeguards appropriate to their respective roles. Athlete-facing applications need their own assessment where children may use them. Contact us if you believe children's information has been supplied without the required authority.

We will update this notice when our practices change and identify the effective version. Where required, we will notify affected people of material changes before using information for a new purpose. A changed notice does not replace consent or another legal requirement.