Privacy Notice
The short version. We use your data only to run your training (sign-in, your program, your workouts and the AI coach) and to see how the service is used, so we can improve it. Health information (stress and sleep) is used only if you say yes, and you can take that back at any time. If you join the waitlist, we use your email only to confirm it and to tell you about early access and the launch. We don't sell data, show ads or build advertising profiles. Everything runs in the EU. You can download or delete your data yourself in Account & privacy.
1. Who is responsible for your data
FitEntrepreneur is run by Konstantin Apostolov (FitEntrepreneur), [business address, the Netherlands], KvK [KvK number]. We are the controller of your personal data. Contact us at privacy@fitentrepreneur.nl. We have not appointed a data protection officer because the law doesn't require one for us; write to the address above with any privacy question.
2. What we collect, why, and for how long
| Data | Source | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Google account ID, name, email address, profile picture link | Google, when you sign in | Signing you in and keeping your data under your account, seeing who uses the service, and contacting you about your account. Our database holds your Google ID and email address; your name and picture stay in your sign-in cookie | Art. 6(1)(b) contract; for seeing who uses the service, Art. 6(1)(f), our legitimate interest in running and improving it | Until you delete your account, or after 24 months without signing in |
| Age range, goal, lifestyle, experience, training frequency | You (assessment) | Building and adjusting your program | Art. 6(1)(b) | Same |
| Stress level, sleep, and health details you type in the chat | You, only if you agree | Adjusting recovery and training load | Art. 9(2)(a) explicit consent (and Art. 6(1)(a)) | Until you withdraw consent or delete your account |
| Workouts and saved plans: exercises, weights, reps, sets to failure, rest, duration, ratings, notes, the coach's line after each work set, and the plans you save from the chat | You | Tracking, progress statistics and coaching | Art. 6(1)(b) | Until you delete them or your account |
| Chat messages with the AI coach and its answers | You and the AI | Coaching | Art. 6(1)(b); Art. 9(2)(a) for health details | Same |
| Waitlist: email address, your optional answers (what you'd pay, what gets in the way of training) and the link tag you arrived with (for example "reddit") | You, on the home page | One email to confirm that the address is yours; emailing you when early access opens and about the launch; measuring interest | Art. 6(1)(a) consent | Until you leave the list, and at most 18 months after you joined. If you don't confirm your address, we delete it 7 days after the confirmation email |
| Guest ID (random) and guest data | Your browser tab | Letting you try the app without an account | Art. 6(1)(b) | 30 days after your last activity |
| Usage overview: when you joined and were last seen, whether you built a plan, how many workouts you logged and questions you asked the coach, and your AI cost this month. Never what you wrote | Our systems, from the data above | Seeing who uses the service, who keeps training and where people stop, so we can improve it and offer help | Art. 6(1)(f), our legitimate interest in running and improving the service | Nothing extra is stored: the overview is worked out from the data above when we look at it |
| Home page visits: the time, the link tag you arrived with (for example "reddit") and whether it was your first visit that day. To tell, your IP address and browser name are turned into a code that changes every day; it stays in our server's memory and is never saved. Visits while you're signed in aren't counted | Your browser | Counting how many people visit the site | Art. 6(1)(f), our legitimate interest in knowing whether the site reaches people | Visit counts: 18 months. The daily code: until midnight (Amsterdam time) at the latest |
| AI usage per month: how many AI replies you got, the number of tokens (pieces of text) the AI read and wrote, and what that cost us. Never the text itself | Our systems | The monthly AI credit and fair use (Terms §5(b)), and keeping AI costs under control | Art. 6(1)(b) contract and Art. 6(1)(f), our legitimate interest in preventing abuse | The current month and the two before it; deleted with your account |
| Security log: pseudonymised user ID, action, time | Our systems | Security and abuse prevention | Art. 6(1)(f), our legitimate interest in keeping the service secure | 90 days |
| Reports of illegal content: name, email, the report | You | Handling reports under the Digital Services Act | Art. 6(1)(c) legal obligation (DSA Art. 16) | 12 months after we close the report |
| Records of your consent choices | Our systems | Proving what you agreed to | Art. 6(1)(c) and (f) | While your account exists, then 2 years in pseudonymised form |
You don't have to give us any data. Without Google sign-in you can only use guest mode: the assessment with one plan, the workout log and a short trial of the AI coach, which you can reach only from that browser tab; without the assessment answers we can't tailor your program; the health questions are always optional. If you sign in with Google in a tab where you used guest mode, we ask whether to add that guest data to your account. If you add it, it becomes account data and is kept like the rest of your account; if you don't, we delete it.
We don't sell your data, show ads or use your data for advertising, and we don't use your data to train AI models.
3. The AI coach
The coach is an AI system, not a person. When you use it, we send the following to Mistral AI SAS (Paris, France), which generates the answer on our behalf:
- your message and up to your last 10 chat messages;
- your assessment answers, your saved plan and a short summary of your recent workouts and progress;
- your stress and sleep answers, only if you agreed.
Mistral processes this in the EU under a data processing agreement, keeps it only for a limited period to detect abuse, and doesn't use it to train its models. We keep a short-term working copy of each conversation in memory for up to 24 hours. More on how the coach works: AI coach.
4. Profiling and automated decisions
The coach tailors your program to your data. That is profiling. It never makes decisions with legal or similarly significant effects for you, and you can always ignore or change its suggestions.
5. Who else receives your data
- Hetzner Online GmbH (Gunzenhausen, Germany) hosts our servers in Germany (EU) as our processor.
- Mistral AI SAS (Paris, France) generates the AI answers as our processor.
- Google processes your sign-in under its own privacy policy if you sign in with Google. If you press "Play" on an exercise video, the video loads from YouTube (Google) through youtube-nocookie.com; Google then receives your IP address and may set cookies. We load nothing from YouTube before you press "Play".
- Authorities, only when the law requires it.
6. Transfers outside the EEA
We store and process your data in the EU. Google may process sign-in and video data in the United States under the EU-US Data Privacy Framework.
7. Your rights
You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interest, and to withdraw your consent at any time. Withdrawing consent doesn't affect processing that happened before.
- In the app: Account & privacy lets you download your data (JSON), edit your answers, withdraw health consent and delete your account.
- By email: privacy@fitentrepreneur.nl. We reply within one month.
- Waitlist: to leave the list, email privacy@fitentrepreneur.nl from the address you signed up with.
- Complaints: you can complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or to the data protection authority where you live.
8. Age
FitEntrepreneur is for people aged 16 and over. If we learn that we hold data of someone under 16, we delete it.
9. Security
We protect your data with HTTPS encryption, access controls, least-privilege database accounts, encrypted off-site backups kept for 14 days, and security monitoring with alerts. Your chat messages, workout notes and stress and sleep answers are also encrypted inside our database, so a copy of the database alone can't be read. When you delete your account, its data also disappears from our backups within 14 days.
10. Cookies and browser storage
We only use what the app needs to work, so we don't ask for cookie consent and there is no cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
__Host-fe.auth | Cookie | Keeps you signed in | 14 days, renewed while you use the app |
.AspNetCore.Antiforgery.* | Cookie | Protects forms against cross-site attacks | Browser session |
.AspNetCore.Correlation.* | Cookie | Secures the Google sign-in handshake | 15 minutes |
fe.guest | sessionStorage (encrypted by our server) | Guest ID for this tab | Until the tab closes |
PreferredUnit | localStorage | kg or lb, saved only when you switch units | Until you clear your browser data |
YouTube (Google) sets its own cookies and storage only after you press "Play".
We count views of the home page without cookies: we store only the time, the link tag you arrived with (for example "reddit") and whether it was your first visit that day. To tell that, we turn your IP address and browser name into a code that changes every day and stays in our server's memory; it is never saved (see section 2).
11. Changes
We announce material changes in the app at least 30 days before they apply.