Skip to content

Legal

Sub-processors

Checked against the product on 21 October 2026.

This is who receives your data when you use Nymiva, what they receive and where it is processed. It belongs to our Privacy Policy. Questions go to [email protected].

Providers that process data for us

They handle data on our instructions, to run the service you asked for.

  • Supabase

    Database and sign-in

    Data it receives
    Everything in your account: sign-in details, profile, training, plans, notes and coach history
    Where
    European Union (EU West), backups in the same region

  • Cloudflare

    Hosting, file storage and the bot check at sign-in

    Data it receives
    Requests to the site and the app, the activity files you upload, your IP address
    Where
    European Union (EU data residency)

  • Cloudflare Web Analytics

    Visit counts, without cookies

    Data it receives
    The page opened, browser details and your IP address
    Where
    United States

  • OpenAI

    The AI coach. Each request goes to one of two providers, chosen by Nymiva

    Data it receives
    The training context needed to answer: planned and completed sessions, zones and thresholds, event goals, readiness and load figures, and your message
    Where
    United States

  • Anthropic

    The AI coach. Each request goes to one of two providers, chosen by Nymiva

    Data it receives
    The training context needed to answer: planned and completed sessions, zones and thresholds, event goals, readiness and load figures, and your message
    Where
    United States

  • Stripe

    Membership payments, invoices and the billing portal

    Data it receives
    Your email, billing details and membership status. Card details go to Stripe, not to Nymiva
    Where
    United States

  • Resend

    Account and summary emails

    Data it receives
    Your email address and the text of the message
    Where
    United States

  • CARTO

    The map picture under a route or an event course

    Data it receives
    The map area on screen and your IP address. CARTO shortens the address and keeps the record for 30 days
    Where
    United States

Public services we ask a question

They receive a coarse piece of data and nothing that identifies you. They are not processors.

  • OpenStreetMap Overpass

    The kind of surface along a course you add (road, trail or gravel). A mirror, overpass.kumi.systems, answers when the main service is down

    Data it receives
    Up to 25 coordinates sampled from the route
    Where
    Germany and Austria (European Union)

  • OpenWeather

    Weather on the calendar and on an event page

    Data it receives
    One location rounded to about 1 km, and the dates asked about
    Where
    United Kingdom

Services you connect yourself

They only receive data when you choose to use them.

  • Strava

    Importing your activities

    Data it receives
    What you authorise Strava to share with Nymiva
    Where
    United States

  • Google

    Signing in with Google, if you pick it

    Data it receives
    The sign-in request, which returns your Google account email and name
    Where
    United States

  • AI assistants such as ChatGPT or Claude

    Reading your training in that assistant, if you connect it

    Data it receives
    What you allow that assistant to read
    Where
    United States

A note on cookies

We use strictly necessary cookies to keep you signed in and Nymiva running. With your permission we would also use analytics to understand and improve it. Read the Cookie Policy.