Privacy and Cookie Statement

This Privacy and Cookie Statement applies to the use of Fittar (the "App"), developed, operated and technically provided by Fittar B.V. ("Fittar", "we", "us"). Fittar B.V. is the controller responsible for the processing of your personal data described in this statement, within the meaning of the General Data Protection Regulation (GDPR).

We process personal data in line with the GDPR. This means we clearly specify our purposes before we process personal data, limit our collection to what is needed for those purposes, ask for your explicit consent where consent is required, take appropriate security measures and require the same from our processors, and respect your rights over your personal data.

What data we process and why

Your account

To use the App you create an account. For this we process your email address, password (stored only in hashed form), name or username, and language preference. Legal basis: performance of our agreement with you. We keep account data for as long as your account exists, including periods in which you do not use the App: coming back after a break is a core part of our service, and your history and progress should be waiting for you when you return. If you delete your account yourself, we delete your data within 30 days, except where a statutory retention obligation applies (for example tax records) or where we retain data in anonymized form as described below.

Your profile and goals

You can add optional profile information such as age or date of birth, height, weight, a profile picture, and your goals per pillar (movement, nutrition, wellbeing). We use this to personalize your experience, for example to estimate distances from your step length or to tailor suggestions. Legal basis: performance of our agreement, and consent for health-related fields. You can edit or remove profile fields at any time.

Health and activity data

When you use the App, we process the health-related data you generate: completed workouts and challenges, scores and repetitions, steps and distances, wellbeing sessions, and your nutrition logs. Health data is a special category of personal data under Article 9 GDPR. We process it exclusively on the basis of your explicit consent (Article 9(2)(a) GDPR), which we ask for separately in the App before these features are activated; this consent is not part of accepting the Terms and Conditions. We retain this data for as long as your account exists, so you can see your long-term progress and pick up where you left off after a break.

You can withdraw your consent at any time in the App or by contacting us. We then stop the processing and, at your choice, delete the related data or retain it only in anonymized form that can no longer be linked to you.

Nutrition logging and AI analysis

You can log meals with a photo, text or voice message, in the App or via the WhatsApp Coach. To recognize your meal and estimate its nutritional values, your photo, text or transcribed voice message is processed by our AI provider Google (Gemini), acting as our processor. Your logs are not used by Google to train its models. Nutrition statistics in the App cover calories, protein, carbohydrates, fat, fiber, sugar and salt.

Motion tracking

During interactive workouts, the App can use your device camera for real-time motion tracking (powered by Asensei). All analysis takes place on your device: camera images are never captured, stored or transmitted to Fittar or anyone else. Only the resulting workout data (such as repetition counts) is stored in your account. Camera access is optional and controlled through your device settings.

WhatsApp Coach

If you use the WhatsApp Coach, we process your WhatsApp phone number, your messages to the coach, and the coach's replies, in order to provide the coaching service, remember your preferences and generate your progress updates. Your messages travel through WhatsApp, operated by Meta Platforms, which is an independent controller for its own processing; Meta's privacy policy applies to that part. Message delivery is handled by our messaging infrastructure provider, and replies are generated with the help of our AI providers, all acting as our processors. Conversations may occasionally be reviewed by our team in pseudonymized form to ensure quality; a support staff member may take over when you ask for direct help. Legal basis: performance of our agreement (you actively opt in to the WhatsApp Coach); explicit consent for health-related content you share.

Push notifications and messages

With your permission via your device settings, we send push notifications, such as reminders you set, progress updates and coach messages. We may also send you service emails about your account or important changes. You control notification preferences in the App and your device settings. Legal basis: performance of our agreement and, for optional messages, consent.

Newsletters

If you sign up for our newsletter, we use your name and email address to send it. Legal basis: consent. Every newsletter contains an unsubscribe link, and we stop processing for this purpose when you unsubscribe.

App analytics

We use PostHog, hosted in the EU, to understand how the App is used: which screens are viewed, which features are used, technical events and crash information, linked to a pseudonymous identifier. We use this to improve the App. Legal basis: legitimate interest in understanding and improving our service; where required, consent. We configure analytics to minimize personal data and do not use it to show you advertising.

Subscriptions

Purchases run through the Apple App Store or Google Play Store. Apple or Google processes your payment; we never receive your payment card details. We use RevenueCat to manage subscription status (which plan is active, trial status, renewal dates) linked to your account, so the App knows what you have access to. Legal basis: performance of our agreement. Transaction records are retained as long as required by Dutch tax law (currently 7 years).

Connected health apps

You may have the option to connect other health applications to your account. If you do, we process the data those apps provide, such as weight, heart rate, activity or sleep data, based on your consent given at the moment of connection. You can disconnect at any time, after which we stop receiving this data.

Support and contact

When you contact us, we process your name, email address and the content of your message to answer your question. Legal basis: legitimate interest in providing support. We keep support correspondence for up to 2 years after the last contact, so we can help you better with follow-up questions.

Who we share data with

We share data only with parties that help us provide the App, under processor agreements, or where we are legally required to do so. We never sell your personal data and we do not share it with advertisers. Our main processors and partners are:

• Supabase · Database, authentication and storage · EU (Frankfurt, AWS) · Within EEA
• PostHog · App analytics · EU · Within EEA
• RevenueCat · Subscription management · USA · EU Standard Contractual Clauses
• Expo · Push notification delivery · USA · EU Standard Contractual Clauses
• Google (Gemini) · AI analysis of meal logs and AI-generated suggestions · EU/USA · EU Standard Contractual Clauses
• Meta (WhatsApp) · Message transport for the WhatsApp Coach (independent controller) · EU/USA · Meta's own GDPR mechanisms
• Resend · Service and lifecycle emails · USA · EU Standard Contractual Clauses
• Bunny CDN · Delivery of workout videos and audio · EU · Within EEA

Where a party is located outside the European Economic Area, we only work with them if an adequacy decision applies, appropriate safeguards such as the EU Standard Contractual Clauses are in place, or you have given your explicit consent for the transfer.

AI transparency

The App uses artificial intelligence for the AI Coach (in-app and via WhatsApp), for the analysis of your meal logs, and for personalized suggestions such as meal plans. The App does not make automated decisions about you that produce legal effects or similarly significantly affect you (Article 22 GDPR). AI suggestions are general guidance, not medical advice.

Minors

The App is not intended for children under 16. We do not knowingly process personal data of children under 16 without the consent of a parent or guardian. If you believe we have collected data from a child under 16, please contact us and we will delete it.

How long we keep your data

We keep personal data no longer than necessary for the purposes described above. In summary: account, profile, health and activity data for as long as your account exists, including periods of inactivity, and until 30 days after you delete your account; inactive accounts are deleted after 36 months of inactivity; support correspondence up to 2 years after last contact; newsletter data until you unsubscribe; financial records for the statutory retention period. Data in routine encrypted backups is removed in accordance with our regular backup cycles.

We may retain data indefinitely in aggregated or fully anonymized form that can no longer be linked to you, for example for statistics, benchmarks and improving our services. Anonymized data is no longer personal data.

Security

We take appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256), access on a need-to-know basis, multi-factor authentication for administrative access, and encrypted backups within the EEA. We require the same level of protection from our processors.

Cookies and similar technologies

The App itself does not use advertising cookies and does not track you across other apps or websites for advertising purposes.

Our website www.fittar.fit uses functional cookies (needed for the website to work) and analytical cookies (to understand how the website is used, with IP addresses anonymized). Where analytical cookies are not privacy-friendly configured, or where other non-essential cookies are used, we ask your consent through a cookie banner before placing them. You can delete cookies or adjust cookie settings in your browser at any time; see your browser's help pages.

Your rights

You have the right to access the personal data we process about you, to have it rectified or deleted, to restrict processing, to object to processing based on legitimate interest or to direct marketing, to receive your data in a machine-readable format (data portability), and to withdraw any consent you gave, at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at info@fittar.eu. We may ask you to verify your identity in a proportionate way, for example by responding from the email address linked to your account. We respond within one month; for complex requests this can be extended by two months, in which case we will let you know.

Privacy contact person

Our privacy contact person is Alje Hoving, reachable at alje@fittar.eu for all questions and requests about your personal data.

Complaints

If you have a complaint about how we handle your personal data, please email info@fittar.eu and we will look into it. You also have the right to lodge a complaint with the supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Changes to this statement

We may update this statement, for example when we add features or change providers. For material changes we will inform you through the App or by email. The date at the top shows when this statement was last updated.

Contact

Fittar B.V. · Abe Lenstra Boulevard 50-6, 8448 JB Heerenveen, the Netherlands · info@fittar.eu · KVK 74409603