NDU

This is a translation provided for convenience. The French version is the only legally binding one. Read the French version

Privacy policy

Last updated: 10 October 2026

1. Data controller

The controller of the personal data collected through the endu.fr website is Aymeric Septvant EI (RCS Bordeaux 130 155 260), which publishes and operates the Endu brand, and can be contacted at hello@endu.fr.

2. Data collected

We collect the following data:

  • Identification data: name, email address, password (hashed)
  • Physiological data: date of birth, gender, MAS (maximal aerobic speed), heart rate, thresholds, experience level, race results
  • Training data: race objectives, generated plans, scheduled sessions, perceived exertion feedback (RPE)
  • Payment data: payment information is processed directly by Stripe and is never stored on our servers
  • Technical data: IP address, browser type, pages viewed
  • Prospect data: if you ask to receive the structure of a plan by email from a public page, without creating an account, we keep your email address, the plan requested, the page of origin and, where applicable, your agreement to receive our training tips

Signing in with Google

If you choose “Continue with Google”:

  • What Google sends us, with your agreement given on its screen: your name, your email address, your profile picture and your Google account identifier.
  • What we do with it: create your Endu account and recognise you each time you sign in. Your email address becomes the address of your account.
  • Where it is kept: with your account, at our hosting provider Supabase, in accordance with the rules in section 5.
  • What we do not do with it: we do not sell it, share it with anyone or use it for advertising purposes. Endu has access to nothing else in your Google account: not your emails, your contacts, your calendar or your files.
  • Withdrawing access: at any time, from your Google account, under “Third-party apps & services” (myaccount.google.com/connections).

3. Purposes of processing

Your data is used to:

  • Generate and adapt your personalised training plans
  • Manage your account and your subscription
  • Send you communications relating to the Service (confirmations, notifications, weekly summary, help getting started)
  • If you have an account: send you, a few times a month at most, our training tips, tools and what's new on Endu
  • Send you the plan structure you requested from a public page and, if you have expressly consented to it, training tips (2 to 3 per month)
  • Improve the Service and fix faults

Every non-essential email includes a one-click unsubscribe link. Unsubscribing takes effect immediately and requires neither an account nor any justification. Your profile has two separate settings: your plan by email (Sunday recap, emails around your race) and tips and news. Emails about your subscription (confirmation, payment) are always sent.

4. Legal basis

The processing of your data is based on:

  • Performance of the contract: your profile and training data are necessary to provide the Service
  • Consent: for the tips sent to visitors without an account who accepted them when requesting a plan
  • Legitimate interest: for the tips and news sent to account holders, which are about the Service they use, are announced at signup and can be refused at any time in one click (article L34-5 of the French Postal and Electronic Communications Code)
  • Legitimate interest: for improving the Service and for security

5. Retention period

Your data is kept for as long as you are registered, then deleted within 12 months of the deletion of your account. Billing data is kept in accordance with legal obligations (10 years). Prospect email addresses (plan requested by email without creating an account) are kept for 3 years from the last contact, or deleted immediately on request.

6. Processors

We neither sell nor rent your personal data. It is only passed on to the following processors, in order to run the Service:

  • Supabase (hosting and database) — EU/US
  • Vercel (application hosting) — US
  • Vercel Analytics (anonymous, cookie-free audience measurement of pages visited) — US
  • Google Ireland (Google Ads: measuring sign-ups that come from our ads, for visitors who arrive through an ad, see section 8) — EU/US
  • Stripe (payment processing) — US
  • Resend (sending transactional and informational emails) — US
  • Sentry (technical error monitoring) — US
  • COROS (sending your sessions to your COROS account) — EU, only if you link your COROS account

These providers have appropriate safeguards for transferring data outside the EU (standard contractual clauses, Data Privacy Framework).

Connected watches

Linking a watch is optional and is done from your profile.

  • COROS: you sign in on the COROS website, which gives us an access key to your account. We keep this key on our servers; it never passes through your browser. We use it solely to place in your COROS calendar the sessions you choose to send there. We do not retrieve your COROS activities or health data. You can unlink your account at any time from your profile: the key is then erased. Sessions already sent remain in your COROS calendar and can be deleted from the COROS app.
  • Garmin: the Endu app installed on your watch receives its own key, which you can revoke. It communicates with Endu only, to display your next session and load it onto the watch. Endu does not access your Garmin account and does not send any data to Garmin.

7. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

  • Access: obtain a copy of your data
  • Rectification: correct inaccurate data
  • Erasure: request the deletion of your data
  • Portability: receive your data in a structured format
  • Objection: object to certain processing
  • Restriction: restrict the processing of your data

To exercise these rights, contact us at hello@endu.fr. We will respond within 30 days.

8. Cookies

The Service uses cookies that are strictly necessary for it to function (authentication, session preferences) and, for visitors who arrive through a Google ad, the Google Ads measurement cookies described below. No other advertising or third-party tracking cookies are used.

To know which pages are read and at which signup step visitors stop, Endu measures its own audience: a random identifier is kept in your browser (local storage, no cookie), renewed after 13 months, and sent with the pages viewed, the time spent on each and the steps completed. No IP address, email or data from other sites is recorded; at signup, this identifier is linked to your account to learn which path leads to a subscription. This data is used for statistics only, shared with no one, hosted by Supabase like the rest of the Service, and deleted after 25 months. It is audience measurement exempt from consent under the CNIL guidelines; you can still opt out by opening this link from each browser.

Google ads measurement. If you reach Endu through a Google ad, the Google Ads tag is loaded: it sets Google Ads cookies (names starting with “_gcl_”, kept 90 days) that hold the identifier of your ad click, and it tells Google, without your name or email, whether the visit led to a sign-up or a trial. Google Ireland receives this information, along with the IP address and browser type as with any tag, and may transfer it to the United States. It is not used to show you personalised ads: that option is turned off. Visitors who came from elsewhere do not load this tag. To turn it off in your browser and delete these cookies, open this link.

9. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), hashed passwords, restricted access to databases, secure hosting.

10. Complaints

If you believe that the processing of your data does not comply with the GDPR, you may lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr

11. Contact

For any question about the protection of your data: hello@endu.fr