Fitness.AI Personal Data Processing Policy

1. General provisions

This Policy governs processing on fitaipro.ru, the mobile app and related functions. It is publicly available at fitaipro.ru/privacy. Public pages require no registration; self-service registration, User consent and Pro are available only to persons aged 18 or over.

2. Controller

The Controller is the current Service Provider. Current Controller details are stated in the Offer.

3. Data subjects

This Policy covers visitors submitting support forms, registered Users, Pro Users, AI-function Users and Users connecting supported integrations.

4. Data processed

Depending on the function, data may include email, internal ID, protected password representation and account status; Pro status and dates; payment operation ID, plan code, amount, status and dates without full card data; support name, email, topic and message; minimal session and security data; and AI accounting data such as User ID, request type, provider/model, status, timing, tokens, estimated cost and a safe error code.

5. Workout data and AI

Workout data is used for the requested function. The production model does not permanently retain raw AI input/output, optional workout payloads, summaries, plan adjustments, technique analysis results or review payloads unless a future function expressly introduces retention on a separate legal basis. Permanent AI accounting is limited to technical data.

6. Photos and video

Technique media is processed temporarily. Source files are not intended for permanent storage, are deleted after normal processing, and are cleaned from temporary storage after errors.

7. Medical data

The Service is not intended to collect diagnoses, medical histories, opinions, treatment, test results or other special-category data. Such data must not be submitted through free text, media or support.

8. Purposes

Purposes include registration and authentication, account operation, free and Pro functions, User-requested AI processing, technique analysis, support, security and abuse prevention, payments after launch, and legal compliance.

9. Legal bases

Depending on the operation, the basis may be contract performance, separate consent, a legal obligation or another basis under Russian law.

10. Consent

Consent is voluntary, specific, informed and unambiguous, and separate from Offer acceptance. The checkbox is not preselected, links to a separate document and must be provable. Consent may be withdrawn; processing then continues only on another lawful basis.

11. Processors and suppliers

Suppliers may include OpenAI for a specific AI request, Google for Google Sign-In and a payment provider after launch. Workout-data backups are not stored on the Service servers. When backup is used, the data is stored in the User’s Google Drive; the Service server is not a permanent repository for backup contents. Full card details are not transferred to the Service.

12. Cross-border processing

A foreign supplier may cause cross-border transfer of limited data. This is permitted only after compliance with Russian legal, organisational and notification duties.

13. Localisation

When collecting Russian citizens’ data online, recording, systematisation, accumulation, storage, updating and retrieval comply with Russian database-location rules except where law provides otherwise. Frontend development does not move the primary User database to foreign storage.

14. Retention

Account data is processed while the account exists and later only for legal duties or claims. Accounting, tax and payment data follows statutory periods. Technical logs target up to 90 days unless a specific security log lawfully needs another term. Support correspondence is retained up to one year after closure; source media only during processing.

15. Deletion

After the purpose ends or another termination basis arises, data is deleted or anonymised under law and internal procedures unless a separate lawful retention basis exists.

16. Subject rights

Where applicable, Users may obtain information, request correction, blocking or deletion, withdraw consent, contact the Controller or authority, and protect rights by lawful means.

17. Security

Organisational and technical measures restrict access, protect credentials and secrets, minimise logs, control access, back up necessary data, detect incidents and restore operation. Public text does not disclose details that would weaken security.

18. Contact form

The User separately confirms consent through an unchecked checkbox. The landing does not save messages in its own PostgreSQL database; protected server infrastructure sends them to support.

19. Cookies and localStorage

Technical localStorage may retain language and theme. Marketing trackers and third-party advertising cookies are not used unless separately introduced with a Policy update.

20. Roskomnadzor notice

Publication does not replace any required notification. Before registration launch, the Controller’s status and the factual purposes, categories, methods and systems must be checked against filed information.

21. Changes

The Policy may change with law, architecture or functions. The current version is at fitaipro.ru/privacy.

22. Contact

Data requests may be sent through support. Current Controller details are stated in the Offer.

In the event of discrepancies, the Russian version shall prevail to the extent permitted by applicable law.