Privacy Policy

Nutshell Lab ("we", "us", "our") operates the WOD Lane platform. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable French data protection law.

1. Data Controller

• Company: Nutshell Lab
• Address: Lille, France
• Email: [email protected]

Nutshell Lab is the data controller for personal data collected through the WOD Lane platform.

2. Data We Collect

Account information

• Email address (required for authentication)

Athlete profile

• First name, last name
• Date of birth
• Competition category (men's/women's)
• Phone number (optional)
• Box affiliation (optional)
• Bio (optional)
• Profile photo (optional)
• Emergency contact (name, phone)

Organizer profile

• Organization name
• Contact email, website
• Logo (optional)

Registration data

• Competition registrations and team membership
• Waiver acceptance records
• Custom question answers as defined by the Organizer

Payment data

• Payment transactions are processed by Stripe. We do not store credit card numbers. We store transaction references, amounts, and payment status for accounting purposes.

Usage data

• Pages visited (first-party, pseudonymized audience measurement: a random session identifier and, where applicable, your user identifier)
• IP address — pseudonymized before storage with a keyed cryptographic hash; the raw address is used transiently in memory for rate limiting and security and is never persisted
• Browser type and device information

3. Legal Basis for Processing

We process your personal data on the following legal bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the service you signed up for: account management, competition registration, payment processing.
• Legitimate interest (Art. 6(1)(f)) — platform security, fraud prevention, service improvement, anonymized analytics.
• Legal obligation (Art. 6(1)(c)) — financial record-keeping as required by French commercial law.
• Consent (Art. 6(1)(a)) — optional marketing communications, if you opt in.

4. How We Use Your Data

• To create and manage your account
• To process competition registrations and payments
• To route payments to Organizers via Stripe Connect and collect our platform fee
• To send transactional emails (magic links, registration confirmations, payment receipts)
• To display public athlete and organizer profiles
• To enforce competition eligibility rules (age, gender composition)
• To prevent fraud and abuse
• To improve the Platform through anonymized analytics

5. Data Sharing

We share personal data only with:

• Stripe (payments) — Stripe Inc., San Francisco, USA. Stripe is certified under the EU-US Data Privacy Framework.
• Scaleway (hosting and email) — Scaleway SAS, Paris, France. Data stored in the EU.
• Cloudflare (content delivery and DDoS protection) — Cloudflare Inc., San Francisco, USA. All traffic to the Platform transits Cloudflare, which processes connection data including IP addresses. Cloudflare is certified under the EU-US Data Privacy Framework.
• Competition Organizers — when you register for a competition, the Organizer receives the information necessary to manage your participation (name, email, date of birth, gender, phone number, waiver acceptance, custom question answers).
• Your team and past teammates — team leaders and fellow members of a registration can see each other's registration details (name, email, date of birth, phone). Athletes you have previously competed with can additionally see your email, date of birth, and phone number through the registration form's teammate pre-fill. Emergency contacts are never shared with other users.

Publicly visible information: athlete profile pages are public and show your name, age (computed, never the birth date itself), gender, box affiliation, bio, profile photo, and competition history. Your name and team name appear on public rosters, leaderboards, and schedules once the Organizer publishes them. Your email, phone number, date of birth, and emergency contacts are masked from the public by field-level access rules.

We do not sell your personal data. We do not share data with advertising networks.

6. International Data Transfers

Your data is primarily stored in the EU (Scaleway, France). Where data is transferred to the United States (Stripe), this provider relies on the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

7. Data Retention

• Account data — retained as long as your account is active. Deleted upon account closure, subject to legal retention obligations.
• Registration and payment records — retained for 10 years after the transaction, as required by French commercial law (Code de commerce, Art. L123-22).
• Audience-measurement data — pseudonymized pageviews are deleted after 25 months (the ceiling recommended by the CNIL for audience measurement).
• Technical error logs — may include your user identifier and email to help us investigate incidents affecting your account; stored on our EU infrastructure alongside application data.
• IP addresses for rate limiting — stored in memory only, not persisted.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your personal data, subject to legal retention obligations.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to restrict processing (Art. 18) — request that we limit the processing of your data.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected] . We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority (CNIL) at www.cnil.fr .

9. Cookies

WOD Lane uses only strictly necessary cookies for authentication and session management. These cookies are essential for the Platform to function and do not require consent under the ePrivacy Directive.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), secure password-less authentication, rate limiting, and access controls. Payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified.

11. Minors

Holding a WOD Lane account requires being at least 15 years old (the age of digital consent in France, loi Informatique et Libertés art. 45); the date of birth is verified when the athlete profile is created.

Minor athletes below that age can still take part in competitions with age-appropriate divisions: an adult (team leader, parent, or guardian) registers them as team members, and where the Organizer requires a parental release, a parent or legal guardian e-signs it after the registration is confirmed. In that case we process the minor's name, date of birth, and gender — and the signing guardian's full name — under the responsibility of the registering adult. If you believe a minor's data was registered without appropriate authority, contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email. The "last updated" date at the top indicates the most recent revision.