Skip to content
Sport.CTRL, CTRL.LAB · Annecy, home page
FR

Privacy Policy

Last updated: October 22, 2026· Version 1.5

Sport.CTRL, a French simplified joint-stock company (SASU) registered in France, places fundamental importance on the protection of your personal data. This policy applies to all services operated by Sport.CTRL, including the CTRL.LAB predictive intelligence system, its website (ctrllab.app), and associated interfaces.

1. Data controller

Sport.CTRL (SASU)
Address: 9 rue d'Orion, 74000 Annecy, France
Email: bastien.lm@sportctrl.com
Website: https://ctrllab.app

2. Data we collect

2.1 Identification data

  • First and last name, date of birth, nationality
  • Contact details: postal address, email, phone
  • Photograph, image elements
  • Sports license number (UCI, national federations)

2.2 Professional and contractual data

  • Team, status, sports history
  • Compensation, contract history
  • Sponsors, commercial partners

2.3 Sports performance data

  • Race results (from public sources such as procyclingstats.com and race organizers)
  • Training data: power, heart rate, cadence, speed, distance, elevation, duration
  • Derived metrics: FTP, CTL, ATL, TSB, power-duration curves, intensity zones
  • Optional complementary physiological data: VO2max, lactate, resting heart rate, heart rate variability (HRV)

2.4 Data from social media (Instagram)

When you explicitly authorize us to access your Instagram professional account through Instagram Login, we may collect:

  • Public profile information: username, biography, profile picture, follower count
  • Your published media (posts, reels, stories): media type, caption, publication date, link, like and comment counts
  • Insights on your media and account: views, reach, saves, shares, engagement rate
  • Aggregated audience demographics (age, gender, country — never individual identifiers)

Public Instagram profiles of people who have not connected an account to CTRL.LAB, picked up by our scouting monitoring, fall under section 8 and not under this authorization.

This data is used exclusively for predictive analytics within the CTRL.LAB system and is never resold.

2.5 Browsing data

We collect the minimum technical data necessary for website operation: IP address (used in clear for abuse limitation and, for a dossier preview, the internal alert; see section 7), browser type, pages viewed, visit duration.

3. Purposes of processing

  • Contractual management: execution of sports agent mandates, sponsorship contracts, invoicing
  • CTRL.LAB predictive analytics: calculation of composite scores, identification of predictive media performance windows, strategic recommendations for athletes and partner brands
  • Following riders without a CTRL.LAB account: identifying riders the agency could represent, with the related profiling (section 8)
  • Commercial prospecting: qualified athlete/brand matchmaking
  • Institutional communication: newsletter, Sport.CTRL social media
  • Legal obligations: accounting, UCI compliance, taxation

4. Legal basis

  • Contract performance for athletes under mandate and partner brands
  • Explicit consent for algorithmic processing of physiological data and social media data
  • Legitimate interest for B2B commercial prospecting (brands)
  • Legitimate interest for following riders without a CTRL.LAB account and the related profiling (section 8)
  • Legal obligation for retention of accounting and contractual documents

5. Data from Meta platforms (Instagram)

Sport.CTRL uses official APIs provided by Meta Platforms, Inc. (Instagram API with Instagram Login) to access certain public data and engagement metrics within the CTRL.LAB system. We request two permissions only: instagram_business_basic (profile and media) and instagram_business_manage_insights (insights and audience demographics). We never publish content or send messages on your behalf.

5.1 Authorized access

We access no Meta data through the official APIs without prior and explicit authorization from the user concerned. Authorization is granted via Meta's standard OAuth 2.0 authentication process, which allows the user to control and revoke access at any time from their Meta account settings.

5.2 Data collected

We collect only data necessary for CTRL.LAB's analytical purposes: public metrics, aggregated insights metrics, anonymized audience demographics.

5.3 No sharing with Meta

We share no user data with Meta beyond what naturally transits via the official APIs. We do not train any algorithmic model on behalf of Meta.

5.4 Compliance with Meta Platform Terms

Use of Meta APIs strictly complies with platform terms of service (Meta Platform Terms, Instagram Platform Policy). We are subject to Meta's review process and commit to honoring all obligations associated with this status.

6. Physiological and sports performance data

Physiological data constitute a sensitive category requiring particular attention. They may fall under Article 9 GDPR (health data) depending on their granularity.

6.1 Reinforced consent

Collection and algorithmic processing of physiological data is conditional on explicit, specific, and documented consent from the athlete, formalized in a contractual amendment separate from the agent mandate.

6.2 Granular consent

Consent is granular: the athlete can independently authorize (a) collection and storage, (b) algorithmic analysis by CTRL.LAB, (c) aggregated transmission to third parties (partner brands, teams).

6.3 Revocability

Consent can be revoked at any time. After withdrawal, synchronization stops the following night and the physiological data already imported is erased within 30 days.

6.4 Sources

Physiological data originates from partner platforms (intervals.icu, Nolio, TrainingPeaks, Garmin Connect, Wahoo Cloud) or is transmitted directly by the athlete in standard file formats (.fit, .tcx, .pwx).

6.5 Consent for the intervals.icu and Nolio sync

Automatic synchronization from intervals.icu and Nolio imports health data (heart rate, heart rate variability, sleep, weight). It requires your explicit consent (Article 9.2.a GDPR), collected at sign-up or through a signed link valid for 30 days, resent on request, or by email. You can withdraw it at any time through that link or by email to bastien.lm@sportctrl.com: synchronization stops the following night and the data already imported is erased within 30 days. This consent does not cover activity files that you hand over yourself or that the agency imports from a TrainingPeaks export.

7. Data sharing

  • Partner brands in aggregated and anonymized form (unless contractual agreement provides for nominative sharing)
  • Sports teams in the context of transfer negotiations, with prior athlete consent
  • Neon(Databricks, Inc., United States): the platform's database, hence all the data described in this policy. Servers in Frankfurt (Germany). Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Vercel(Vercel Inc., United States): application hosting. Runs in Frankfurt (Germany). Data sent: the application's requests and its execution logs, which may name athletes. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Cloudflare (Cloudflare, Inc., United States): file storage (training files, documents, photos, consent proofs), in the European Union (Cloudflare EU jurisdiction). For any access from the United States, transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Trigger.dev (API Hero Ltd, United Kingdom, a country with an adequacy decision; jobs run in the European Union (Frankfurt), job payloads and logs kept in the United States): runs the jobs that import and compute training sessions (reading the activity files exported from TrainingPeaks and uploaded by the agency, full files, possibly with the GPS track; computing the indicators; writing the extracted files to our storage and the results to the database). Data processed: import and athlete identifiers, FTP, workouts (power, heart rate, cadence, speed, distance, duration). Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Fly.io (Fly.io, Inc., United States): collection of public race results and programs from procyclingstats.com. Servers in Paris (France). Data sent: rider and race identifiers, already public. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Sentry (Functional Software, Inc., US company, data hosted in Germany, de.sentry.io region): error and performance tracking. Data sent: error and performance logs, including the addresses of visited pages, the browser type and internal identifiers, and session recordings with masked text, after removal of link tokens, request contents, cookies and authentication headers. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Resend(Plus Five Five, Inc., United States; account, logs and metadata kept in the United States): sending of emails (team sign-in links, invitations to connect Instagram, verification codes for the consent page and for shared dossiers, synchronization recap to the agency). Data sent: the recipient's email address and the content of the message, including the athlete's name. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Upstash (Upstash, Inc., United States): rate limiting against abuse. Data sent: IP address, email address (team sign-in) or request identifier, kept from one minute to one hour. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Telegram (Telegram Messenger Inc.; EEA accounts hosted in the Netherlands): nightly alerts sent to the agency team. Data sent: athlete names, the top three TAAV scores, form peaks, predictive-window forecasts and results, number of press articles and sentiment of mentions on X per athlete, classified synchronization errors, onboarding alerts with the name, FTP with an opaque reference for the import and, when an alpha athlete views a preview, their name and IP address; Sentry error titles related to Instagram are reduced to their type. No raw Instagram data and no Instagram identifier. No processing agreement or specific contractual safeguard covers this service or any transfer outside the EEA.
  • GitHub(GitHub, Inc., United States): hosting of the project's code and documents, some of which name athletes. No real database is stored there. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Anthropic, PBC(United States): the agency's Cadence assistant, reading of press articles, analysis of public posts on X and reading of the documents added by the agency, contracts included. Data sent: the team's questions; database data the assistant consults to answer (including identity, results, training and physiological data, contracts and remuneration); the full text of the documents analyzed. Transfer outside the EEA covered by the contractual safeguards offered by this provider. Cadence has no access to Instagram data.
  • Voyage AI(United States): search in the agency's document base. Data sent: document excerpts (press articles, public posts on X, reference sheets, documents added by the agency, contracts included) and search queries. Transfer outside the EEA covered by the contractual safeguards offered by this provider.
  • Google(Google Cloud France SARL, Paris, for Google Workspace services; Google LLC, United States, for YouTube, Google News and Google search): read-only access to an agency Drive folder shared with the application's service account, to import athletes' contracts (names, remuneration, clauses), and internal birthday calendar (athletes' names and dates of birth), provided by Google Cloud France SARL; YouTube, Google News and Google searches with the athlete's name, for press, popularity and X-post monitoring, provided by Google LLC. The application writes no contract to Drive. For Google LLC services, the transfer outside the EEA is covered by the contractual safeguards offered by this provider.
  • Nolio (France): training platform from which we import workouts (power, heart rate, cadence, perceived effort) when the athlete connects their account; we send it no data.
  • Competent authorities upon judicial request

We never sell your personal data to third parties.

8. People followed without a CTRL.LAB account (Article 14)

Sport.CTRL follows riders who have neither a CTRL.LAB account nor a mandate with us. They did not give us this data: this section informs you in accordance with Article 14 GDPR.

8.1 Sources and data

  • ProCyclingStats and DirectVelo (rankings, race lists): first and last name, date of birth (or year), nationality, team, category, results, race program
  • Press articles (Google News) and public posts on X (Google search)
  • Popularity: YouTube and Google searches with the rider's name
  • Instagram scouting: public profile (username, name, biography, follower count, engagement), picked up by our monitoring from the account's public page, without Meta's APIs, and a potential score from 0 to 100
  • Indicators computed from this data, and the agency's internal notes

As long as you have not yourself connected an account (Instagram, training platform), we collect no health data about you, and no Instagram data other than the public profile described above.

8.2 Purposes and legal basis

Identifying riders the agency could represent and preparing a first contact: press and X-post monitoring, TAAV score (1 to 1000), predictive windows, contract indices. The TAAV score and the predictive windows are profiling (Article 4(4) GDPR). Legal basis: legitimate interest (Article 6(1)(f)), set out in a balancing assessment kept by the agency. These indicators are reading tools for the team: no decision producing a legal effect or similarly significantly affecting you is taken automatically. Former athletes are excluded from these processings.

8.3 Recipients

The agency's administrators. Processors described in section 7: Anthropic, PBC (reading of articles and public posts on X) and Voyage AI (search in article excerpts); Google LLC (your name is sent in searches); Fly.io (collection of public ProCyclingStats data); Telegram (nightly alerts to the team: name, TAAV score, sentiment of mentions on X). Transfers outside the EEA are described in section 7.

8.4 Retention period

A record is kept while the rider is active, and for at most 3 years after its last update without contact. The agency reviews them every year and erases those no longer used.

8.5 Right to object

You may object to this monitoring at any time, without giving a reason, by email to bastien.lm@sportctrl.com (subject "GDPR — objection"). We then erase your data and record your identifiers (ProCyclingStats, DirectVelo) and a fingerprint of your name with your date or year of birth on an exclusion list, so that our imports do not recreate you. Without an identifier or a date of birth, nothing can be recorded. You may also lodge a complaint with the CNIL.

9. Retention period

  • Contractual data: contract duration + 5 years (accounting obligations and statute of limitations)
  • Physiological data: mandate duration + 24 months (unless deletion request)
  • Meta data: active consent duration + 30 days
  • Commercial prospecting of brands: 3 years after last contact
  • Browsing data: maximum 13 months

10. Security

  • Encryption in transit (TLS) and at rest; additional encryption of access tokens for connected services (Instagram, intervals.icu, Nolio) and of athletes' phone numbers
  • Administration interface restricted to Sport.CTRL administrators (allow-listed addresses); database access partitioned by application roles and PostgreSQL Row-Level Security
  • Administrator sign-in through a single-use link sent by email
  • Immutable history of data changes; log of dossier views by third parties and of data disclosures
  • Backups provided by the database host
  • Database (Neon) and web application (Vercel) hosted in the European Union (Frankfurt)
  • Some providers listed in section 7 are located outside the EEA; the safeguard for each transfer is stated with each of them

11. Your rights

In accordance with GDPR and French Data Protection Act, you have the following rights:

  • Right of access: obtain confirmation of processing and a copy of your data
  • Right of rectification: correct inaccurate or incomplete data
  • Right to erasure("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability in a standard format
  • Right to object to processing based on legitimate interest, including the monitoring described in section 8 and prospecting: it can be exercised at any time and without giving a reason, for the monitoring in section 8 as for prospecting
  • Right to withdraw consent at any time
  • Right to lodge a complaint with the French data protection authority (CNIL)

To exercise your rights, contact us at bastien.lm@sportctrl.com. We will respond within a maximum of one month.

Deletion of data collected through Instagram: see the Data deletion page.

12. Cookies

The ctrllab.app website uses only cookies strictly necessary for site operation and aggregated audience measurement. No advertising or third-party tracking cookies are deposited without explicit consent.

13. Changes to this policy

This policy may be modified to reflect the evolution of our services or regulations. The date of last update appears at the top of the document. Substantial changes are notified to affected users.

14. Contact

Sport.CTRL
Email: bastien.lm@sportctrl.com
Subject: "GDPR — [your request]"

Note on CTRL.LAB. The CTRL.LAB predictive intelligence system is developed and operated exclusively by Sport.CTRL for internal purposes. It is not marketed as a service to third parties. Final decisions (contract signatures, recommendations to athletes, brand selection) remain systematically made by humans.
Back to homeFR