Privacy Policy
This explains what information NextSet stores about you, why we do it, and what you can do about it. This is an English translation of the Norwegian original (“Personvernerklæring”).
1. Who is responsible?
NextSet is a brand name of Lunde, a Norwegian sole proprietorship (enkeltpersonforetak) with organisation number 932 034 891. Lunde is the data controller for the information described here.
Questions about privacy can be sent to contact@nextset.no.
2. What information do we store?
| What | Examples | Why |
|---|---|---|
| Account | Your email address, password (stored only in encrypted form by the login service, never as plain text), when the account was created and last activity | So you can log in and use the app |
| Training data | Programs, training days, exercises, sessions, sets (weight, repetitions, time and date), notes, favorites, and content you have deleted but not permanently removed (the recycle bin) | So the app can show what you did last time, your history and progress |
| Settings | Theme, accent color and color mode | To show the app the way you have chosen |
| Messages | The email address and message you send through “Contact us” in the app, the time, and whether the notification to us was sent | So we can reply to you |
| Subscription (only if you have started or had one) | Customer number and subscription number with the payment service, status and when the subscription ended | To end the subscription and meet our bookkeeping obligations |
We do not store your card number. NextSet is free, and a voluntary subscription can no longer be purchased.
We do not ask for body weight, heart rate, health condition, location, contacts or photos.
3. Cookies and storage in the browser
- Login cookies from the login service (Supabase). They are necessary for you to stay logged in.
- Storage in the browser (localStorage) on your device: language, theme, your own accent color, color mode, the state of the rest timer, and choices in the app's overview. This is used only so the app works and looks the way you have chosen. It is not sent to anyone.
- “Try without an account” stores example data only in the browser's session storage (sessionStorage), and sends nothing to us.
- We use no analytics tools, marketing cookies or third-party tracking, and therefore show no consent banner.
- Fonts are delivered from our own server, not from Google.
4. Why do we use the information, and on what basis?
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Providing the app: account, login and storing training data | Contract with you (Article 6(1)(b)) |
| Replying to messages | Contract or legitimate interest (points (b) and (f)) |
| Security, bug fixing and preventing misuse | Legitimate interest (point (f)) |
| Keeping accounting records for past payments | Legal obligation (point (c)) |
We do not use your information for marketing, we do not sell it, and we do not use it for automated decisions or profiling.
5. Who has access?
We use these providers to run the service. They process information on our behalf:
| Provider | What they do | Server location |
|---|---|---|
| Supabase | Database and login | Ireland (EEA) |
| Vercel | Hosting of the website and the app | USA (Washington D.C.). The pages themselves are served from Vercel's global network |
| Resend | Sends email: login messages and notifications to us about new messages | Ireland (EEA). Resend states that its primary processing takes place in the USA |
| Stripe | Payment service for subscriptions that were started or held. Handles card details | See the provider's own statement |
- Supabase and Resend: their data processing agreement is part of the terms we have accepted with them. We have not signed any separate agreement.
- Vercel: their data processing agreement applies only to Pro and Enterprise plans. We use the Hobby plan and have not entered into such an agreement.
- Stripe: their data processing agreement is part of Stripe's services agreement, which applies to our account.
The person who operates NextSet can see, in a separate administration area, account information (email, subscription status and times) and messages from “Contact us”. The area does not show your training data.
6. Transfers outside the EEA
Account and training data are stored with Supabase in Ireland (EEA). In its data processing agreement, Supabase (Supabase Pte. Ltd., Singapore) states that data is to be stored and primarily processed in the region we have chosen, with some exceptions described in the agreement.
The website and the app's servers run at Vercel, mainly in the USA (Washington D.C.). Email is sent through Resend: our domain is held with them in Ireland, but Resend states that its primary processing takes place in the USA. If you have had a subscription, Stripe processes information about it in the USA and may transfer it onward globally.
Vercel and Resend themselves state that they are certified under the EU–US Data Privacy Framework, a scheme the European Commission has approved as providing adequate protection for transfers to certified companies in the USA. The data processing agreements of Resend and Supabase also contain the EU Standard Contractual Clauses. Stripe states its transfer basis in its own data processing agreement.
Vercel's data processing agreement with Standard Contractual Clauses applies only to Pro and Enterprise plans. We use Vercel's Hobby plan and have not entered into such an agreement with Vercel.
7. How long do we keep the information?
- Account and training data: for as long as you have an account. We do not delete your account or your training history automatically, even if you do not log in for a long time. It stays until you delete the account yourself or ask us to. When you delete the account in the app (Account tab), the account and all training data, notes, settings and messages linked to it are permanently deleted. Any old subscription is ended.
- Recycle bin: content you have deleted in the app stays there until you delete it permanently or delete the account.
- Backups at Supabase: We use a Supabase plan that does not include automatic database backups, and we have not enabled any.
- Emails and messages you have sent us (to contact@nextset.no or through “Contact us” in the app): Up to 12 months after the last contact, or earlier if you ask us to delete them, subject to any retention requirements imposed by law. This applies only to emails and messages, not to your training data.
- Accounting records for past payments: for as long as the Norwegian Bookkeeping Act requires.
8. Your rights
You have the right to access, rectify and erase information, to ask for processing to be restricted, to object to processing based on legitimate interest, and to receive your information in a portable format (data portability).
You can delete the account yourself in the app under the Account tab, and export your training history as PDF, text or CSV under the History tab. For other requests, contact us at contact@nextset.no. We reply within 30 days.
You can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you believe we process your information in breach of the rules.
9. Security
All traffic goes over an encrypted connection (HTTPS). The database is set up so that each user can only read and change their own data. Passwords are never stored as plain text. No service can nevertheless be guaranteed to be completely secure.
10. Children
You must be at least 13 years old to use NextSet.
11. Changes
We may update this policy. For significant changes we will notify you in the app or by email. The current version is always on this page.
12. Contact
Lunde (NextSet), organisation number 932 034 891. Address: Kjøyafaret 14, 3474 Åros. Email: contact@nextset.no.