This policy explains how Kyklos Dev handles personal information for www.kyklosdev.io, business enquiries, and the training tools and connected services we are planning. It sets out the relevant company details, data categories, purposes, legal bases, recipients, retention, and privacy rights in one notice under the General Data Protection Regulation (GDPR) and applicable Greek data protection law.
Current service status: The company website and email enquiries are available. The training service, Garmin integration, athlete/coach dashboards, and AI/MCP connections described below are planned and not yet live. This website does not currently request, store, or analyse Garmin user data. Training-specific sections describe the intended design and requirements to implement before collection begins. Garmin API access and permitted uses remain subject to Garmin’s approval and program terms; this policy does not claim approval or affiliation.
This policy covers our intended role in operating our own training service. It does not replace the notices or data-processing agreements that apply to a client’s own software, users, or project data.
Quick links: website and email, planned training data, coach access, AI/MCP connections, retention and deletion, and privacy rights.
1. Who we are
Kyklos Dev is the commercial title of ARISTOS MANOLARAKIS KAI SIA L.P., a company established in Greece. The company is the data controller for the website and business-enquiry processing described here and the intended controller for its own planned training service.
- Legal name: ARISTOS MANOLARAKIS KAI SIA L.P.
- Business address: Aeton 11–13, Athens, Attica 11364, Greece
- Contact person: Aristos Manolarakis
- Privacy contact: contact@kyklosdev.io
You can use this email or our postal address for questions about this policy and requests concerning your personal information. A coach or external client/provider may have separate responsibilities for information you choose to send to it; those roles and recipient terms must be explained before access is enabled.
2. Current website and email enquiries
Our website is hosted by Vercel. Delivering pages involves processing technical information such as your IP address, the requested URL, the time of the request, browser or device information, and response or error information. The hosting provider may also process security and diagnostic information to prevent abuse and keep the service available.
The website does not offer account registration, a contact form, advertising trackers, visitor analytics, or mailing-list subscriptions. We do not use Vercel Web Analytics or Speed Insights. You do not need to provide personal information simply to read the website.
If you email us about our services, we may process your name, email address, company or role, the contents of your message, and project information you choose to provide. We use this information to respond, understand your requirements, and discuss a possible business relationship. Providing it is voluntary, but relevant contact details and requirements may be necessary for us to answer or assess a project.
Please provide only information relevant to your enquiry and avoid sending passwords, sensitive personal information, or confidential information about others unless we have agreed an appropriate way to handle it.
3. Planned training tools and data
The planned training tools would help users analyse training history, tailor training around their schedules, and create personalised dashboards and graphs. Athletes could also give selected coaches a more comprehensive view of their information.
The service is being designed to use information needed for enabled features, rather than requesting data simply because an API makes it available. Depending on Garmin’s approved APIs, the feature, and the permissions granted by the user, relevant categories may include:
- Connection and account information: account identifiers, a Garmin connection identifier, permissions, and authentication credentials needed by our backend to maintain the authorized connection.
- Activities and training information: activity type, dates and duration, distance, pace or speed, power, cadence, and available training or performance metrics needed for analysis and graphs.
- Health and recovery information: available heart-rate, heart-rate-variability, sleep, stress, daily-activity, or recovery information where needed for an enabled feature and separately authorized as required.
- Location and routes: GPS tracks and related activity-location information only where needed for a selected route or location feature.
- User-entered information: training goals, preferences, schedules, annotations, and other details users choose to supply for the tools.
- Derived information: summaries, comparisons, trends, dashboards, graphs, and training or scheduling insights. Information derived about an identifiable person remains personal information.
- Operational information: access events, IP addresses, and technical request information needed for authentication, security, and fault investigation.
The connection flow must identify the categories actually requested and how each supports a feature. Availability of these categories is not guaranteed; a Garmin authorization does not mean every API or category will be available.
4. Purposes and legal bases
Current website and business communications
- Website delivery and security: serving pages, investigating faults, preventing misuse, and protecting visitors and systems. The legal basis is our legitimate interest in operating a reliable and secure business website (Article 6(1)(f) GDPR).
- Service enquiries: answering questions and assessing potential work. Steps taken at your request towards a contract with you rely on Article 6(1)(b). Other business communications, including communications with a company’s representatives, rely on our legitimate interest in communicating about our services (Article 6(1)(f)).
- Legal obligations and claims: processing required to meet an applicable legal obligation relies on Article 6(1)(c). Necessary processing to establish, exercise, or defend legal claims may rely on our legitimate interest in protecting legal rights (Article 6(1)(f)).
Planned training service
The planned purposes are user-selected training analysis, personalisation of training and schedule information, dashboards and graphs, and sharing chosen by the athlete. For core features requested by an account holder, the intended basis is performance of the service contract or steps taken at the user’s request before that contract (Article 6(1)(b)). Optional sharing and AI/client connections are intended to rely on specific consent where appropriate (Article 6(1)(a)). Necessary security and administration may rely on legitimate interests (Article 6(1)(f)); legal obligations may require processing under Article 6(1)(c).
Health information requires an additional Article 9 condition. The service is being designed to request explicit consent under Article 9(2)(a) for the relevant health-data features and disclosures. Permission to connect Garmin alone will not be treated as a substitute for the required disclosures and consents. Users must be able to withdraw consent and stop processing that depends on it; withdrawal does not affect the lawfulness of prior processing.
Insights are intended to support users’ and coaches’ decisions. The notice and controls must explain any profiling involved. Any feature involving solely automated decisions with legal or similarly significant effects would need a separate assessment and the applicable disclosures and safeguards before being offered. Additional processing requiring consent must not begin before that consent is obtained.
5. Backend processing and the Garmin connection
Our own backend is intended to retrieve authorized Garmin information, store it, and perform the training service’s core analysis. Coaches and AI agents would access information through our service, not interact directly with Garmin through our connection. Garmin credentials and tokens must remain on the backend and must not be exposed to coaches, agents, or MCP clients.
Users must be able to disconnect Garmin. Once the service receives a disconnect or revocation request, the intended design is to stop new retrieval, invalidate or remove the relevant credentials, and stop access that depended on the authorization. Data already stored would follow the deletion schedule in section 10. These connection controls are requirements for the planned service, not features currently available on this website.
6. Athlete-controlled coach access
Coach dashboards are intended to be private by default. The athlete would select the coach and the information to make available. Access must be limited to that authorization and revocable; revocation must stop future access through the service.
Revocation cannot automatically retrieve information already exported or copied by an independent recipient. Before sharing, the service must explain the recipient’s identity, role, permitted access, relevant privacy terms, and how to address deletion requests for independently held copies. Copies held by a processor on our behalf remain subject to our applicable deletion instructions.
7. Optional AI agents and MCP clients
The planned MCP (Model Context Protocol) interface would let a user-authorized client or agent read selected information from our service, rather than connect directly to Garmin. Read access may transfer personal information to the client or its provider, including an external AI provider. Keeping Garmin access on our backend does not prevent that disclosure.
Before enabling a client, the connection flow must identify the client or provider, the data and purpose of access, and the permission’s scope and duration. Access is intended to require authentication, be limited to selected resources, and be revocable. Optional external AI processing or sharing of health information must have the required specific and explicit consents before access begins.
External providers may have their own retention, use, and model-training terms. Their terms and role must be disclosed before data is sent. No optional recipient should be enabled where its handling conflicts with the stated purpose, the required permissions and consents, or Garmin’s applicable program terms. User permission alone does not override those program terms.
The current plan does not involve the company publishing athlete information or independently sharing it for unrelated purposes. User-directed sharing is distinct from processing by the service providers needed to operate requested features. Revoking read access does not itself erase copies already transferred to an independent recipient.
8. Recipients and service providers
For the current website and business communications, information may be processed by:
- Vercel, for hosting, content delivery, security, and diagnostics. See its Privacy Notice and Data Processing Addendum.
- Our email and business communication providers, when you correspond with us.
- Professional advisers or relevant authorities, where necessary for legal obligations, professional advice, or a legal claim.
The planned training product will also need infrastructure such as hosting, storage, security, and operational support. The current website’s Vercel setup does not establish where the product’s Garmin data will be hosted. Its actual providers, roles, and processing arrangements must be identified before it begins processing data. User-selected coaches and AI/client providers must also be identified before access is authorized.
Access must be limited to what is needed for the relevant purpose. The current website does not operate advertising-based profiling or automated decisions with legal or similarly significant effects.
9. International processing
Hosting and communication providers may process information outside your country. Vercel’s terms describe its processing locations, subprocessors, and transfer arrangements, including standard contractual clauses where applicable.
For transfers outside the European Economic Area, GDPR requires a recognised mechanism, such as an adequacy decision or appropriate contractual safeguards. The future training product’s processing locations and relevant transfer safeguards must be identified before it processes personal information. Those arrangements must account for the actual infrastructure and any user-selected coach or AI/client provider.
Contact contact@kyklosdev.io for information about the safeguards relevant to your data or to request a copy of them.
10. Retention and deletion
Current website and email enquiries
- Website delivery, security, and diagnostic information: retention depends on the hosting provider’s configured periods and the time needed to investigate a specific fault or security incident.
- Enquiry correspondence: kept while handling your request and completing agreed follow-up. Relevant correspondence may become part of the records of a resulting business relationship.
- Legal obligations and claims: relevant information is kept for the applicable statutory period or while needed to handle a claim, including the applicable limitation period.
When information is no longer needed for these purposes, we delete or anonymise it under the relevant retention arrangements, unless continued retention is required by law.
Planned training service
The following are proposed operating requirements, not claims that account and deletion controls already exist:
| Information or event | Planned retention or action |
|---|---|
| Authorized training information and derived insights | Keep while the account and Garmin connection are active, and only as needed for enabled features. Users must also be able to request earlier deletion. |
| Garmin disconnection, consent withdrawal requiring deletion, or a relevant data/account-deletion request | Stop affected access and processing when the request is received. Delete affected live information without undue delay and within 30 days at most, including linked derived insights and processors’ copies, subject to a specific legal retention requirement. |
| Connection credentials | Invalidate or remove affected credentials on revocation, rather than retaining them for continued API access. |
| Residual backup copies | Expire within 90 days after live removal. Isolate backups from ordinary use and reapply deletion requests if a backup is restored. |
| Routine product security and access logs | Retain for up to 30 days; a specific incident or legal obligation may justify longer retention of limited relevant records. |
| Minimal consent, deletion, and legally required records | Keep only as needed to demonstrate or enforce the relevant action, meet a legal obligation, or handle a specific claim. Do not retain a full training dataset for this purpose. |
These defaults are not a universal industry standard. The live service must meet applicable legal requirements, the Garmin agreement, and the commitments in its active notice. Any shorter contractual deadline must be respected. Account deletion must cover profile details that are no longer needed; disconnecting Garmin alone need not delete an otherwise retained account profile.
User-directed disclosures may leave copies with independent recipients. Their retention and deletion arrangements must be explained before sharing. Revocation stops future access through our service; it does not automatically recall those copies.
11. Cookies and similar technologies
The current website does not set optional cookies or use browser storage for advertising, analytics, or profiling. Its hosting provider may use necessary security technologies to deliver and protect it.
The planned service’s authentication and storage requirements must be explained before launch. If optional cookies or tracking are introduced, we will update this policy and provide information, choices, and prior consent where required before enabling them.
12. Your privacy rights
Under the GDPR, subject to its conditions and exceptions, you may:
- Ask whether we process your personal information and request access.
- Correct inaccurate or incomplete information.
- Request erasure or restriction of processing.
- Object to processing based on legitimate interests for reasons relating to your situation.
- Receive a portable copy where the legal conditions for portability are met.
- Withdraw consent for processing based on consent.
- Complain to the Hellenic Data Protection Authority or another competent supervisory authority, including in your place of habitual residence, place of work, or the place of an alleged infringement. Contacting us first is not required.
Send requests to contact@kyklosdev.io. Proportionate identity checks may be needed to protect the information. We respond without undue delay and normally within one month; any permitted extension due to the complexity or number of requests will be explained within that initial month.
The planned service is intended to provide controls for disconnection, sharing permissions, and deletion. These controls are not currently available on this website. A connection or sharing permission must be revocable without being treated as consent to unrelated processing.
13. Security
For current website and enquiry processing, we use measures appropriate to the information and risks, including restricting access to people who need it and using the hosting provider’s security features.
Before enabling the planned service, it will need appropriate authentication and access controls, separation of users’ information, protection of connection credentials, encrypted transmission and storage, restricted administration, and tested revocation and deletion procedures. No method of transmission or storage can guarantee absolute security.
14. Changes and contact
We may update this policy when services, purposes, providers, company details, retention, or legal obligations change. The date above identifies the latest revision. The actual training-service implementation and provider arrangements must match the notice presented before data collection begins. Any new feature or disclosure requiring additional notice or consent must not begin before those requirements are met.
For questions about any part of this policy, or to exercise your privacy rights, contact contact@kyklosdev.io or write to the business address in section 1.