Privacy policy

1. Who is responsible

Método Xis operated by Daniel Millán Marco(tax ID 54166429A), C/ Can Donadeu, n12, 1o 2a, 08120, La Llagosta, Barcelona.For anything about your data, write to hola@metodo-x.com.

2. Two roles, depending on whose data it is

• Coach accounts. For the data of the coaches who sign up (name, email, business details, subscription), Método X is the controller.
• Clients of each coach. For the data coaches enter or collect about their own clients (training, nutrition, measurements, photos, check-ins, messages), the coach is the controller and Método X processes it on their behalf, only to provide the service, under the data processing agreement.

Some of that client data can be health-related (bodyweight, injuries, nutrition). Coaches are responsible for having a valid basis, usually their client's explicit consent, to collect it.

3. What we collect and why

• Account: name, email, password (stored hashed by our auth provider), business name, phone if you give it, country, timezone. To run your account.
• Billing: plan, billing period and payment status. Card details are handled by Stripe; we never see them.
• Service data: everything you and your clients enter in the app. Only to provide the service.
• Usage: technical logs and, only if you accept analytics, usage statistics without personal data.
• Support: what you tell us in the support form. If you choose to message us on WhatsApp, that message is also processed by WhatsApp (Meta) under its own terms.

4. Legal bases

Performing the contract (your account and subscription), legal obligations (invoicing and tax), legitimate interest (security and error prevention) and consent (analytics cookies), which you can withdraw at any time from “Cookie preferences” without affecting earlier processing. Account data is needed to provide the service: without it we cannot create your account.

5. Artificial intelligence

We make no automated decisions with legal effects on you: the assistant only suggests, and nothing changes without your confirmation. The AI assistant sends questions to Mistral AI, in the EU. Client names are replaced with labels ("Client 3") before anything is sent, and the assistant cannot change anything without your explicit confirmation. When you import a file, its contents are sent to Mistral only if they cannot be read directly.

6. Who processes the data

The full, up-to-date list is on the subprocessors page. When data leaves the EU, it does so under the European Commission’s standard contractual clauses.

7. How long we keep it

• While your account is active.
• If you delete your account, it is deactivated immediately and everything is permanently erased after 30 days, a window in which you can change your mind. Daily backups are kept in the EU for 14 days, so after that period the data is gone from them too.
• Billing records are kept for as long as tax law requires, in Stripe and in our accounting.
• Security records keep only what is needed, without client content.

8. Your rights

You can access, correct, delete, restrict or object to the processing of your data, and take it with you. From Settings you can export all your data (JSON, CSV or PDF) and delete your account yourself.For anything else, write to hola@metodo-x.com. You can also complain to the Spanish Data Protection Agency (aepd.es). We have not appointed a data protection officer because, given our size and activity, it is not mandatory; any question goes straight to the controller.

If you are a coach’s client, your coach is your first point of contact; we will help them handle your request.

9. Cookies

See the cookie policy.

10. Security

Every coach’s data is isolated from every other coach’s, access is always checked on the server, traffic is encrypted, and data is stored in the EU. No system is invulnerable; if a breach ever affected your data we would tell you and the authorities as the law requires.