Privacy Policy

The intended operator is [PRE-LAUNCH TODO: registered operator/legal entity], at [PRE-LAUNCH TODO: full registered business address]. These are not verified public contact details yet. Its final legal identity, Data Protection Officer ([PRE-LAUNCH TODO: DPO contact if legally required, otherwise confirm not applicable]), EU representative ([PRE-LAUNCH TODO: EU representative if legally required, otherwise confirm not applicable]) and supervisory authority ([PRE-LAUNCH TODO: applicable privacy supervisory authority / complaint route]) remain pending verification. Privacy questions and rights requests can be sent to gymanai.team@gmail.com.

Depending on the features used, Gymanai can process account and session data; profile, goals, schedule and equipment; readiness and health-sensitive inputs; plans, workouts and progress; coach messages and member-controlled memory; consent and privacy-request history; subscription state; support, security and limited product-performance telemetry. Payment-card details are handled by the payment provider rather than stored as Gymanai application data.

Data is used to authenticate and secure accounts, provide requested training and coaching, explain adaptations, operate billing and entitlements, remember confirmed context, answer support and privacy requests, improve reliability and meet legal obligations. The applicable legal ground may be contract, consent, legitimate interests or a legal duty, depending on the purpose and jurisdiction.

Readiness, soreness, pain, limitations and similar inputs can be health-sensitive. Activating health-sensitive coach memory requires a separate current consent record and confirmation; withdrawing consent blocks new activation and future AI use but does not silently rewrite historical consent events. Members can review, correct, confirm or delete memory through product controls.

Gymanai sends bounded context needed for the request to approved AI services and instructs the model to answer in the active language. AI output is advisory and cannot bypass deterministic safety, training, entitlement or confirmation rules. Gymanai does not rely on unrestricted AI output as the sole authority for decisions with legal or similarly significant effects.

Essential authentication uses the Supabase browser session. Gymanai uses limited browser storage for a sidebar preference, temporary in-progress workout reliability and safe checkout retries. Vercel Analytics for site/product usage measurement and Vercel Speed Insights for web-performance measurement operate across public, authentication and signed-in application routes. Review must establish the legal basis, any required consent or preference behavior, provider roles, retention, access and transfers. This does not add advertising pixels, cross-site behavioral advertising or marketing profiling. Provider disclosure remains [PRE-LAUNCH TODO: legally reviewed provider/subprocessor and transfer disclosure].

Depending on law, you may have rights to request access, correction, deletion, restriction, portability or objection, and a right to complain to a competent data-protection supervisory authority. Members can download a structured JSON export. Submitting the request does not instantly delete application records. Applicable law may impose response or completion deadlines, and the internal beta workflow does not override any statutory deadline or mandatory right. Retention remains [PRE-LAUNCH TODO: legally reviewed retention periods, exceptions and request SLA] and the complaint authority remains [PRE-LAUNCH TODO: applicable privacy supervisory authority / complaint route].