Privacy Policy

Effective date: April 16, 2026

1. Who We Are

Infitivy ("we", "us", or "our") is a global marketplace platform that connects fitness clients with personal trainers and wellness coaches. Our registered address and data controller details are available upon request at privacy@infitivy.app.

2. What Information We Collect

Account data: your full name, email address, password (stored as a bcrypt hash — never in plain text), and user role (Client or Trainer). Profile data: for Trainers, this includes your bio, specialties, hourly rate, location (city and country), availability, certifications, and profile photo. Location data: with your permission, we collect your approximate location (city-level) to show you nearby Trainers. You can use Infitivy without granting location access by entering your city manually. We do not track your precise GPS coordinates continuously or share your location with Trainers without your consent. Transaction data: booking details, session dates, payment amounts, and Stripe payment intent IDs. We do not store full card numbers — Stripe handles all payment data under PCI-DSS Level 1 compliance. Communication data: messages sent through our in-app AI coaching feature, reviews you write, and support tickets. Usage data: device type, operating system, app version, session duration, feature interactions, and crash reports collected via anonymous analytics.

3. How We Use Your Information

We use your information to: (a) create and manage your account; (b) facilitate bookings and process payments; (c) display Trainer profiles to Clients; (d) send booking confirmations, reminders, and receipts; (e) power AI features such as trainer matching and goal coaching; (f) detect and prevent fraud, abuse, and unauthorised access; (g) comply with legal obligations including tax reporting and anti-money-laundering requirements; and (h) improve our product through aggregated, anonymised analytics.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal bases for processing are: • Contract performance — processing necessary to provide you with the Infitivy service you signed up for. • Legitimate interests — fraud prevention, platform security, and product improvement, balanced against your rights. • Legal obligation — tax records, dispute resolution, and regulatory compliance. • Consent — optional features such as marketing emails and session recording, which you may withdraw at any time.

5. How We Share Your Information

We do not sell your personal data. We share it only with: • Stripe Inc. — to process payments and manage Trainer payouts under Stripe Connect. Stripe is a certified PCI-DSS Level 1 service provider. • Daily.co — to create and host video call rooms for virtual training sessions. • Anthropic, Inc. — your AI coach conversations and quiz answers are processed by the Claude API to generate responses. Anthropic does not train on your data by default under their API usage policy. • Supabase, Inc. — our backend infrastructure provider hosting the database and authentication system. • Law enforcement or regulators — only where required by a valid legal order, subpoena, or to protect the rights and safety of our users. All third-party processors are bound by data processing agreements (DPAs) and are required to protect your data to at least the same standard as we do.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain it (e.g., financial records for 7 years under tax law). AI coaching messages are retained for 12 months to provide continuity of service, then automatically deleted. Optional session recordings are deleted after 30 days.

7. Your Rights

Depending on your location, you may have the right to: • Access — request a copy of the personal data we hold about you. • Rectification — correct inaccurate or incomplete data. • Erasure ("right to be forgotten") — request deletion of your data. • Restriction — ask us to limit how we use your data. • Portability — receive your data in a structured, machine-readable format. • Objection — object to processing based on legitimate interests. • Withdraw consent — for any processing based solely on consent. To exercise any right, email privacy@infitivy.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8. Security

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest via Supabase, Row Level Security policies on every database table, and regular security audits. Passwords are never stored in plain text. Access to production systems is restricted to authorised personnel using multi-factor authentication.

9. Children's Privacy

Infitivy is intended for users aged 16 and over. In the United States, Infitivy complies with the Children's Online Privacy Protection Act (COPPA) and does not knowingly collect personal information from children under 13. In the European Economic Area and United Kingdom, we do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact privacy@infitivy.app immediately and we will delete it promptly.

10. International Transfers

Infitivy operates globally. Your data may be processed in countries outside your own, including the United States, where our infrastructure providers are based. When transferring data from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.

11. Do Not Track

Some browsers and devices allow you to broadcast a "Do Not Track" (DNT) signal. Because Infitivy is a mobile application and does not use third-party advertising trackers or cross-site tracking, DNT signals do not change how we operate. We do not track users across third-party apps or websites.

12. Push Notifications

If you grant permission, Infitivy sends push notifications for booking confirmations, session reminders, and new messages. You can withdraw permission at any time in your device Settings → Notifications → Infitivy. Disabling notifications does not affect your ability to use the app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification and email at least 14 days before they take effect. Continued use of Infitivy after that date constitutes acceptance of the updated policy.

14. Contact Us

For any privacy-related questions, data subject requests, or concerns, contact our Data Protection Officer at: Email: privacy@infitivy.app Response time: within 5 business days