Gymscanner Privacy Policy

Version 2.0 | Effective Date: June 15, 2026

App name: Gymscanner Developer: Gymscanner General Trading Co.

This Privacy Policy is provided by Gymscanner General Trading Co., the developer and publisher of the Gymscanner mobile application (the "App").

This Privacy Policy (“Policy”) explains how the Gymscanner group collects, uses, shares, and protects personal data when you use the Gymscanner website at gymscanner.com (the “Site”), the Gymscanner mobile applications for iOS and Android (the “Apps”), and all related services, features, tools, and content (collectively, the “Platform”).

This Policy forms part of, and should be read together with, our Terms of Use and Cookie Policy, which are incorporated by reference. Capitalized terms that are not defined in this Policy have the meaning given to them in the Terms of Use.

By creating an account, making a purchase, listing services as a Vendor, or otherwise using the Platform, you acknowledge this Policy. Where we rely on your consent, for example to process health data or to send you marketing, we ask for that consent separately, and you may withdraw it at any time as described below.

⚠️ PLEASE READ SECTION 7 CAREFULLY. IT EXPLAINS HOW WE HANDLE HEALTH DATA FROM THE HEALTH TOOLS, INCLUDING THE FOOD CALORIE SCANNER, THE PERIOD AND CYCLE TRACKER, THE STEPS TRACKER, AND THE AI NUTRITION PLAN BUILDER. WE PROCESS THIS DATA ONLY WITH YOUR EXPLICIT CONSENT OR ANOTHER LAWFUL BASIS, AND WE NEVER SELL IT OR USE IT FOR ADVERTISING.

1. Who We Are; Your Data Controller

The Platform is operated by the Gymscanner group. The Gymscanner entity that determines the purposes and means of processing your personal data, and therefore acts as the data controller for your personal data, depends on your country of residence:

Your Region	Data Controller	Registered Address	Primary Data Protection Framework
European Union, EEA, United Kingdom	Gymscanner SRL (“Gymscanner Romania”)	Strada Valea Adâncă 17C, 700712 Iași, Romania	EU General Data Protection Regulation (GDPR) and, for UK residents, the UK GDPR and Data Protection Act 2018
GCC and MENA region	Gymscanner General Trading Co. (“Gymscanner Kuwait”)	Nuzha Complex, Floor 2, Ibn Khaldoun Street, Hawalli, Kuwait	Kuwait CITRA Data Privacy Protection Regulation and applicable local data protection law
Australia and New Zealand	Gymscanner General Trading Co. (“Gymscanner Kuwait”)	Nuzha Complex, Floor 2, Ibn Khaldoun Street, Hawalli, Kuwait	Australian Privacy Act 1988 (Cth) and New Zealand Privacy Act 2020, as detailed in the ANZ Addendum
United States, the Americas, and all other countries	Gymscanner, Inc. (“Gymscanner US”)	256 Chapman Road, Suite 105-4, Newark, DE 19702, USA	Applicable US federal and state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA)

References to “Gymscanner,” “we,” “us,” or “our” mean the data controller applicable to you under this table. Gymscanner group entities may process personal data on one another’s behalf as joint controllers or as processors under intra-group data protection agreements, so that we can operate the Platform, provide support, and administer our business consistently across regions.

Data Protection Contact: You can reach our privacy team at [email protected] for any question or request about this Policy or your personal data. Where a Data Protection Officer or an EU or UK representative is appointed, their contact details will be published on the Platform.
Users and Vendors in Australia or New Zealand are also covered by the Australia and New Zealand Regional Addendum, which prevails over this Policy for them.

2. Scope and Related Documents

2.1 What this Policy covers: This Policy covers personal data we process about Users, Vendors, visitors to the Site, and people who contact us. It applies across the Site, the Apps, the Health Tools, and our communications with you.
2.2 What this Policy does not cover: This Policy does not cover:
(a) The independent data practices of Vendors, who are separate controllers for the personal data they collect and use to deliver their own services;
(b) Third-party websites, applications, or services that are linked from or integrated with the Platform; or
(c) Data you choose to share on external platforms. The privacy policies of those parties govern those activities.
2.3 Vendors as separate controllers: When a Vendor receives your personal data in order to deliver a purchased service (for example, your name and booking reference to admit you to a gym), the Vendor is an independent controller and is responsible for its own use of that data, as set out in the Terms of Use, Section 12.

3. Definitions

In addition to the definitions in the Terms of Use, the following terms are used in this Policy:

“Personal Data” (or “personal information”): Any information relating to an identified or identifiable natural person.
“Processing”: Any operation performed on personal data, such as collection, use, storage, disclosure, or deletion.
“Controller”: The party that determines the purposes and means of processing personal data.
“Processor” and “Sub-Processor”: A party that processes personal data on behalf of, and under the instructions of, a controller.
“Special-Category Data” (or “sensitive personal information”): Data revealing sensitive characteristics, including data concerning health, which receives heightened protection under applicable law.
“Health Data”: Data related to your physical or mental health, including menstruation, symptoms, nutrition, and activity data you provide through the Health Tools.
“Consent”: A freely given, specific, informed, and unambiguous indication of your agreement to processing.
“Supervisory Authority”: A public authority responsible for monitoring the application of data protection law.

(The defined terms “User,” “Vendor,” “Vendor Services,” “Health Tools,” “Listing,” “User Content,” and “Tourist Pass” have the meanings given to them in the Terms of Use.)

4. Personal Data We Collect

We collect the categories of personal data described below. Not all of it applies to every User, and much of it depends on how you use the Platform.

4.1 Identity and Account Data: Your name, username, account identifier, password or authentication credentials, profile details, and, for Vendors, authorized-contact details.
4.2 Contact Data: Email address and any other contact details you provide, such as a phone number or address.
4.3 Transaction and Order Data: Records of purchases, order references, Vendor Services purchased, redemption and check-in data, favorites you save, and refund or dispute records.
4.4 Payment Data: Limited payment information needed to process a purchase or payout. We act as merchant of record, payments are processed by Stripe, and we do not store full payment card numbers. Stripe processes card and payment details under its own terms and PCI-DSS obligations.
4.5 Vendor Business and Payout Data: For Vendors: legal business name, registration number, address, tax identifiers, bank or Stripe payout details, authorized contacts, and identity, business, and compliance verification data, including KYC, AML, and sanctions-screening results.
4.6 Health Tools Data: Health data you provide through the Health Tools, including food and nutrient logs, menstruation and cycle data, symptoms, step and activity data, and inputs to the AI nutrition plan builder. This is special-category or sensitive personal data and is described in detail in Section 7.
4.7 Device, Technical, and Usage Data: Device type and identifiers, operating system, app version, IP address, language and time-zone settings, log data, diagnostics and crash data, and data about how you interact with the Platform.
4.8 Location Data: Approximate location derived from your IP address, the location of gyms and Listings you view or search, and, only with your permission, more precise device location for location-based features.
4.9 User Content: Reviews, ratings, photos, comments, and any other content you submit, together with the account and identity data associated with a submission.
4.10 Communications and Support Data: The content of your messages to us, support tickets, correspondence, and records of complaints, disputes, and chargebacks.
4.11 Marketing and Preference Data: Your marketing choices, communication preferences, and, where used, preference or profile data derived from your use of the Platform.
4.12 Cookies and Similar Technologies: Data collected through cookies, SDKs, pixels, and similar technologies on the Site and in the Apps, as described in Section 9 and our Cookie Policy.

ℹ️ Sensitive Data Note: We do not seek to collect special-category data other than the health data you choose to provide through the Health Tools. Please do not send us sensitive data that we have not requested.

5. How We Collect Your Personal Data

5.1 Directly from You: When you Sign Up, complete your profile, make a purchase, enter data into the Health Tools, submit User Content, or contact us for support.
5.2 Automatically: When you use the Platform, through cookies and similar technologies, device and log data, and analytics, as described in Section 9.
5.3 From Third Parties: From our payment processor (transaction and verification data), app stores, mapping and location providers, device health frameworks (with your permission), fraud-prevention and sanctions-screening sources, publicly available sources used for Vendor verification, and Vendors themselves in connection with a transaction.

6. Why We Use Your Personal Data and Our Legal Bases

We use personal data only where we have a lawful basis to do so. The table below sets out our main purposes, the categories of data involved, and the legal basis under the GDPR. Where you are located outside the EU, EEA, or UK, we rely on the equivalent bases permitted by your local law.

Purpose	Categories of Data	Legal Basis (GDPR)
Create and administer your account, authenticate Sign-Ins, and provide the Platform	Identity and account data, contact data, Sign-In and security data	Performance of a contract (Art. 6(1)(b)); for Vendors, also our legitimate interest in operating the marketplace (Art. 6(1)(f))
Process purchases as merchant of record, issue confirmations, and manage redemptions	Transaction data, order and redemption data, limited payment data	Performance of a contract (Art. 6(1)(b)); legal obligation for invoicing, accounting, and tax (Art. 6(1)(c))
Process Vendor payouts and perform KYC, AML, and sanctions screening	Vendor business and payout data, identity verification data, sanctions-screening results	Legal obligation (Art. 6(1)(c)); performance of the Vendor contract (Art. 6(1)(b)); legitimate interest in fraud and financial-crime prevention (Art. 6(1)(f))
Operate the calorie scanner, steps tracker, and AI nutrition plan builder	Health Tools inputs, device and activity data, and, where you disclose it, health data	Consent for health data (Art. 6(1)(a) & Art. 9(2)(a)); performance of a contract for non-health elements (Art. 6(1)(b))
Operate the period and cycle tracker (sync and backup of cycle data)	Menstruation, symptom, and cycle data (special-category health data)	Explicit consent (Art. 9(2)(a)), which you may withdraw at any time in App settings
Publish and moderate reviews, ratings, and other User Content	User Content, account and identity data associated with a submission	Performance of a contract and legitimate interest in a trustworthy review system (Art. 6(1)(b) & 6(1)(f))
Provide customer support and handle complaints, disputes, and chargebacks	Contact data, transaction data, correspondence, and supporting evidence	Performance of a contract (Art. 6(1)(b)); legitimate interest in resolving disputes (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c))
Prevent, detect, and investigate fraud, abuse, security incidents, and Terms breaches	Account, device, transaction, usage data, and technical log data	Legitimate interest in protecting Users, Vendors, and the Platform (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c))
Analyze, maintain, secure, and improve the Platform and develop new features	Usage and analytics data, device and technical data, aggregated/pseudonymized data	Legitimate interest in operating and improving our services (Art. 6(1)(f)); consent where required for non-essential analytics cookies (Art. 6(1)(a))
Send service messages (order confirmations, security alerts, essential notices)	Contact data and transaction data	Performance of a contract (Art. 6(1)(b)); legal obligation for certain notices (Art. 6(1)(c))
Send marketing and promotional communications	Contact data and, where used, profile and preference data	Consent (Art. 6(1)(a)); or, for existing customers on similar products, legitimate interest subject to opt-out (Art. 6(1)(f))
Comply with legal obligations and respond to lawful requests from authorities	Any relevant data required by applicable law or request	Legal obligation (Art. 6(1)(c)); legitimate interest in cooperating with lawful requests (Art. 6(1)(f))
Establish, exercise, or defend legal claims, and enforce our Terms	Any relevant data reasonably necessary for the claim or enforcement	Legitimate interest in protecting legal rights (Art. 6(1)(f)); establishment, exercise, or defense of legal claims (Art. 9(2)(f)) where health data is involved
Effect a merger, acquisition, financing, or sale of assets	Relevant account, transaction, and business data as part of the transaction	Legitimate interest in corporate transactions (Art. 6(1)(f)), subject to appropriate confidentiality safeguards

🔒 Consent and Objection: Where processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you may object as described in Section 16.

7. Health Data and the Health Tools

7.1 Health Data is Sensitive: Data about your body, menstruation, symptoms, nutrition, and activity is special-category or sensitive personal data. We process it only with your explicit consent or another lawful basis, and we apply enhanced safeguards. The Health Tools are provided for general wellness purposes only and are not medical advice, as explained in the Terms of Use, Section 9.
7.2 Food Calorie Scanner: Food photos you capture with the calorie scanner are processed on your device, and the photos themselves are not uploaded to or stored on our servers. We do not receive your food photos. Any calorie or nutrient estimates you choose to save are stored in your account as log data.
7.3 Period and Cycle Tracker: Data you enter in the cycle tracker is stored both on your device and on our servers to enable sync and backup. We process this health data only with your explicit consent. You may withdraw consent, and delete your cycle data, at any time in the App settings, after which we delete it from our active systems promptly. The tracker is not a contraceptive and is not a medical device. We do not use your cycle data for advertising, and we do not sell it.
7.4 Steps Tracker: With your device-level permission, we read step and activity data from your device or its health framework, such as Apple Health or Google Fit. You control this permission and may revoke it at any time in your device settings. These are wellness estimates, not medical measurements.
7.5 AI Nutrition Plan Builder: To generate a plan, the inputs you provide are processed through the Anthropic API. Anthropic acts as our processor under a data processing agreement that includes confidentiality and security commitments, and your inputs and the generated outputs are not used to train Anthropic’s models. Where you disclose health information in order to obtain a plan, we process it on the basis of your explicit consent. Generated plans are stored in your account until you delete them.
7.6 Your Control Over Health Data: You can view your health data, export it where that option is available, and delete it in the App. Withdrawing consent stops further processing of that category and triggers deletion, except where we must retain limited records to comply with law or to establish, exercise, or defend legal claims.
7.7 No Sale and No Health Advertising: We never sell your health data, and we never use it for third-party advertising or profiling.

8. Artificial Intelligence and Automated Processing

8.1 How We Use AI: The AI nutrition plan builder uses artificial intelligence provided by Anthropic to generate automated plans from the inputs you provide. Other parts of the Platform may use automated logic for fraud detection, content moderation, and personalization.
8.2 No Solely Automated Decisions with Significant Effect: We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing without human involvement, except where permitted by applicable law with appropriate safeguards. Where automated screening flags a transaction or account, a human reviews any materially adverse decision on request.
8.3 Your Rights Regarding Automated Processing: Where applicable law grants rights in relation to automated decision-making, you may request human review, express your point of view, and contest a decision by contacting [email protected].
8.4 AI Outputs Are Not Professional Advice: AI-generated outputs, including nutrition plans, are automated and may contain errors. They are not a substitute for advice from a qualified health professional, as set out in the Terms of Use, Section 9.

9. Cookies and Similar Technologies

We and selected partners use cookies, software development kits (SDKs), pixels, local storage, and similar technologies on the Site and in the Apps for essential operation, security, remembering your preferences, analytics, and, where you consent, marketing. Essential technologies do not require consent. Non-essential technologies are used only with your consent where the law requires it.

You can manage your preferences through our cookie banner and through your device or browser settings. Full details, including the categories of cookies and their lifespans, are available in our Cookie Policy at gymscanner.com/cookies.

10. How and When We Share Personal Data

We share personal data only as described below. We do not sell your personal data, and we do not share it for cross-context behavioral advertising in the sense given to those terms under United States state privacy laws.

10.1 Vendors: When you purchase a Vendor Service, we share the data the Vendor needs to deliver and honor it, such as your name, order or booking reference, and redemption details. The Vendor is an independent controller for that data.
10.2 Payment Processor: We share transaction and limited payment data with Stripe to process payments and payouts and to perform verification, as described in Section 11.
10.3 AI Provider: For the AI nutrition plan builder, the inputs you provide are processed by Anthropic as our processor, as described in Section 7.5.
10.4 Service Providers (Sub-Processors): Hosting, storage, analytics, communications, security, and support providers process personal data on our behalf under contract. A summary of recipient categories is in Annex B.
10.5 Group Entities: We share personal data among Gymscanner group entities to operate the Platform, provide support, and administer our business, under intra-group agreements.
10.6 Legal, Safety, and Compliance: We disclose personal data where required by law, to respond to lawful requests from authorities, to enforce our Terms, to prevent fraud or harm, and to protect the rights, property, or safety of Gymscanner, our Users, our Vendors, or the public.
10.7 Corporate Transactions: We may disclose personal data in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality safeguards. A successor may continue to process personal data in accordance with this Policy.
10.8 With Your Direction or Consent: We share personal data with other parties when you ask us to or otherwise consent.

11. Payments and Merchant of Record

Gymscanner acts as merchant of record for purchases on the Platform. Payments are processed by our payment processor, currently Stripe. We do not store full payment card numbers. Stripe processes card and payment data as an independent controller and, where applicable, as our processor, under its own terms and its PCI-DSS obligations. For Vendors, Stripe also processes onboarding, KYC, AML, and payout data. See the Terms of Use, Sections 4, 6, and 12, for more on our payment role.

12. Vendors: Additional Privacy Terms

12.1 Vendor Data We Process: Business identity, registration and tax identifiers, authorized-contact details, bank or Stripe payout details, verification and KYC/AML data, sanctions-screening results, Listing content, and transaction and payout records.
12.2 Purposes and Bases: Operating the Vendor relationship (performance of a contract), meeting financial-crime, tax, and accounting obligations (legal obligation), and preventing fraud and protecting the Platform (legitimate interests).
12.3 Vendor as Controller of User Data: Vendors receive User personal data solely to deliver purchased services. Vendors must use it only for that purpose, must comply with applicable data protection law, and must not retain or repurpose it, as required by the Terms of Use, Section 12.3. Vendors are independent controllers and are responsible for their own privacy compliance.
12.4 Vendor Staff and Trainers: Where a Vendor operates through staff or trainers, the Vendor is responsible for informing them about this processing and for their compliance.

13. International Data Transfers

13.1 Why Transfers Happen: Gymscanner operates globally, with entities in Romania, Kuwait, and the United States, and uses service providers located in multiple countries. Your personal data may therefore be transferred to, stored in, or accessed from countries other than your own, including the United States.
13.2 Safeguards: Where we transfer personal data from the EEA, the UK, or another region with transfer restrictions to a country that does not have an adequacy decision, we use appropriate safeguards, including the European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with technical and organizational measures such as encryption. You may request a copy of the relevant safeguard by contacting [email protected].
13.3 Adequacy: Where a transfer is to a country recognized as providing an adequate level of protection, we rely on that recognition.

14. How Long We Keep Personal Data

14.1 Principles: We keep personal data only for as long as necessary for the purposes described in this Policy, to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. When personal data is no longer needed, we delete or anonymize it.
14.2 Retention Schedule: Annex A sets out our main retention periods. Where retention periods differ by jurisdiction, the longer applicable statutory period governs financial and transaction records.
14.3 Deletion on Request: You may request deletion as described in Section 16. We honor deletion requests subject to legal retention requirements and other legitimate exceptions.

15. How We Protect Personal Data

15.1 Security Measures: We implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest (where appropriate), access controls and least-privilege access, network and application security, logging and monitoring, secure development practices, and vendor due diligence. We do not store full payment card numbers.
15.2 On-Device Processing: For the calorie scanner, food photos are processed on your device and are not transmitted to us, which reduces the data we hold about you.
15.3 Your Role: No system is perfectly secure. You are responsible for keeping your credentials confidential and for notifying us at [email protected] of any suspected unauthorized use of your account (Terms of Use, Section 5.2).
15.4 Breach Notification: If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in accordance with applicable law and within legally mandated timeframes.

16. Your Privacy Rights

Subject to your location and applicable law, you have rights over your personal data. We provide these rights to Users wherever we can, and region-specific details are in Section 17.

16.1 The Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you and obtain a copy;
Have inaccurate or incomplete personal data corrected;
Have your personal data erased or deleted;
Restrict how we process your personal data;
Receive your personal data in a portable, machine-readable format and have it transmitted to another controller where feasible;
Object to processing, including direct marketing and processing based on our legitimate interests;
Withdraw consent at any time where we rely on it;
Obtain human review of, and contest, decisions based solely on automated processing where applicable; and
Lodge a complaint with a supervisory authority.

16.2 How to Exercise Your Rights

Email [email protected] or use the in-App controls where provided. We may need to verify your identity before acting. We respond within the timeframe required by applicable law (under GDPR, generally within one month, extendable by two further months for complex requests).

16.3 No Fee & Non-Discrimination

We do not charge a fee for most requests, and we will not discriminate against you for exercising your rights. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, as permitted by law.

16.4 Authorized Agents

Where permitted, you may use an authorized agent to submit a request on your behalf, subject to verification of the agent’s authority and your identity.

17. Region-Specific Rights and Disclosures

17.1 European Union, EEA, and United Kingdom (GDPR / UK GDPR)

Your data controller is Gymscanner Romania. You have the rights listed in Section 16.1, including the right to lodge a complaint with your local supervisory authority:

Romania: ANSPDCP (dataprotection.ro)
United Kingdom: ICO (ico.org.uk)

17.2 United States (including California CCPA/CPRA)

No Sale or Sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Sensitive Personal Information: Health data from the Health Tools may be sensitive personal information. We use it only to provide the features you request and for related purposes permitted by law. You may direct us to limit its use.
Your Rights: Access, delete, correct, opt out of sale/sharing (N/A as we do not sell/share), limit sensitive info use, and non-discrimination.
Other States: Residents of states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, etc.) have similar rights. Contact [email protected] to exercise them.

17.3 GCC and MENA (Kuwait)

Your data controller is Gymscanner Kuwait. We process personal data in accordance with the Kuwait CITRA Data Privacy Protection Regulation and applicable local law.

17.4 Australia and New Zealand

Your data controller is Gymscanner Kuwait, subject to the ANZ Addendum.

Australia: Handled in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). Complaints can be made to the OAIC (oaic.gov.au).
New Zealand: Handled in line with Information Privacy Principles under the Privacy Act 2020. Complaints can be made to the Office of the Privacy Commissioner (privacy.org.nz).

18. Marketing and Communications

18.1 Service Messages: We send essential service messages (order confirmations, security alerts, legal notices) that you cannot opt out of while holding an account.
18.2 Marketing: Sent only where permitted, based on your consent or legitimate interest for existing customers on similar products. You can unsubscribe at any time using the link in each email, in App settings, or by emailing [email protected].
18.3 Preferences: Manage your notification preferences in your account and device settings.

19. Children’s Privacy

The Platform is intended for adults. You must be at least 18 years old to create an account or use the Platform. We do not knowingly collect personal data from anyone under 18. We may suspend or delete any account we reasonably believe belongs to a minor. If you believe a minor has provided us with personal data, contact [email protected] so we can delete it.

20. Third-Party Services and Links

The Platform integrates with and links to third-party services, including Stripe, Anthropic, app stores, mapping providers, and device health frameworks. Their processing of your data is governed by their own privacy policies. See Terms of Use, Sections 14 and 15.

21. Changes to this Privacy Policy

We may update this Policy from time to time. For material changes, we will provide notice by email or in-App notice at least 15 days before taking effect. The Effective Date above reflects the latest version. Continued use after the effective date constitutes acknowledgment of the updated Policy.

22. How to Contact Us; Complaints

Privacy Requests & Questions: [email protected]
Postal Address: The registered address of your regional data controller listed in Section 1.
Supervisory Complaints: You may complain directly to your local data protection authority: EU/Romania (ANSPDCP), UK (ICO), Australia (OAIC), or New Zealand (Privacy Commissioner).

Annex A: Categories of Personal Data, Sources, and Retention

Category of Personal Data	Typical Sources	Retention Period
Account and profile data	Provided by you at Sign-Up and updated over time	For the life of your account, then deleted or anonymized within 90 days of closure (unless longer required by law)
Transaction, invoicing, and payout records	Generated when you purchase, and from our payment processor	Retained for tax and accounting law requirements (up to 10 years in Romania; up to 7 years elsewhere)
KYC, AML, and sanctions-screening records (Vendors)	Provided by Vendors and generated during verification	Retained for statutory financial-crime retention periods (generally 5 to 7 years post-relationship)
Cycle tracker health data	Entered by you in the period and cycle tracker	Retained while consent is active; deleted promptly upon consent withdrawal, App deletion, or account closure
Calorie scanner photos	Captured on your device	Not uploaded to our servers; processed on-device and retained per your device settings
AI nutrition plan inputs & generated plans	Provided by you and generated by the AI builder	Inputs processed transiently; generated plans retained in account until deleted by you or account is closed
User Content (reviews, ratings, photos)	Submitted by you	Retained while published; may remain post-closure for content already published until removed
Support and correspondence records	Your messages and our responses	Retained for up to 3 years after the matter is closed (or longer for ongoing disputes)
Technical logs, security, and fraud data	Generated automatically as you use the Platform	Retained for up to 24 months (or longer for security investigations/legal claims)
Marketing consent & preference records	Provided by you and recorded by us	Retained while subscribed and for a reasonable period afterward to evidence your choices
Cookie & similar-technology data	Collected via your device	Retained for the lifespan stated in the Cookie Policy (varies by cookie)

Annex B: Sub-Processors and Third-Party Recipients

Recipient	Purpose	Typical Location	Safeguards
Stripe	Payment processing, merchant-of-record settlement, Vendor payouts, and KYC/AML verification	United States, EU, and other regions	PCI-DSS certification; EU Standard Contractual Clauses & UK Addendum; DPA
Anthropic	AI processing for the nutrition plan builder via the Anthropic API	United States	DPA with confidentiality/security commitments; API inputs/outputs not used to train models; SCCs
Cloud hosting & infrastructure providers	Hosting, storage, content delivery, and backup of Platform data	United States, EU, and other regions	DPAs; Standard Contractual Clauses; encryption in transit and at rest
Analytics & product-monitoring providers	Usage analytics, performance monitoring, and crash reporting	United States, EU, and other regions	DPAs; pseudonymization where feasible; consent-gated where required
Communications & email providers	Delivery of service, transactional, and marketing messages	United States, EU, and other regions	DPAs; Standard Contractual Clauses where applicable
App Stores (Apple & Google)	App distribution, in-app functionality, and store-level analytics	United States and other regions	Governed by respective store terms and privacy frameworks
Mapping & location providers	Displaying gym locations, maps, and directions	United States and other regions	Governed by provider terms; location data minimized to the feature
Device Health Frameworks (Apple Health, Google Fit)	Reading step and activity data with your permission	On your device and provider frameworks	Access controlled by your device permissions (revocable anytime)
Professional advisers & auditors	Legal, accounting, tax, and audit services	Varies	Bound by professional confidentiality and data processing terms
Authorities, regulators, and courts	Compliance with law, lawful requests, and legal proceedings	Varies	Disclosed only as required or permitted by applicable law

Annex C: United States Statutory Categories Collected

Statutory Category (CCPA/CPRA)	Collected by Us	Examples
Identifiers	Yes	Name, email, account identifier, IP address, device identifier
Customer records	Yes	Contact details and limited payment information (no full card numbers)
Commercial information	Yes	Purchases, transactions, redemptions, and favorites
Internet or network activity	Yes	Usage, interactions, diagnostics, and log data
Geolocation data	Yes, limited	Approximate location and Listing locations viewed; precise location only with permission
Sensory data	Processed on device	Food photos processed on-device and not collected by us
Professional or business information	Yes (Vendors)	Vendor business and authorized-contact details
Sensitive personal information	Yes (with consent)	Health data from Health Tools, used strictly to provide requested features
Inferences	Limited	Preferences derived from your use of the Platform
Biometric information	No	We do not collect biometric identifiers