Privacy Policy

1. Data controller

The controller of your personal data is the Operator identified above. For any privacy request, use the contact details listed there.

2. What data we collect

• Account data: name, email, phone, password (stored hashed by our identity provider), gender (used to apply the women-only studio rule).
• Booking and membership data: plans, payment status, bookings, attendance.
• Payment data: processed by Stripe; we receive limited details (e.g. status, last digits), not your full card number.
• Wellness-coach data: your goals, dietary preferences and allergies, food log, body metrics (e.g. height, weight), workouts and chat messages with Wyla, and any photos you choose to send.
• Technical data: limited local storage needed to keep you signed in; basic logs for security and reliability.

3. Health-related data (special category)

Some wellness-coach data (e.g. allergies, body data, sleep, workouts, food log) is special-category data under GDPR art. 9. We process it only with your explicit consent, given via a separate checkbox at account creation (or, for existing accounts, in the app), recorded with the date and the version of the text you accepted. You can withdraw consent at any time by deleting your account from the app or writing to us — withdrawal does not affect prior processing.

4. Why we use your data and legal bases

• To provide the studio, café, bookings and account — performance of a contract (Art. 6(1)(b)).
• To process payments and meet accounting and tax duties — legal obligation (Art. 6(1)(c)).
• To provide the wellness coach and store your preferences and health inputs — your consent (Art. 6(1)(a) and Art. 9(2)(a)).
• To keep our services secure and improve them — our legitimate interests (Art. 6(1)(f)).
• To send service or, with consent, marketing messages — contract or consent.

5. Who we share data with (processors)

We use trusted providers acting on our instructions: Amazon Web Services (hosting, in the EU), Stripe (payments) and OpenAI (to power the wellness-coach AI). They process data only as needed to provide their service.

6. International transfers

Most processing takes place in the EU. Where a provider (e.g. OpenAI) processes data outside the EEA, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep data

We keep account, booking and wellness-coach data for as long as your account is active and as needed afterwards to meet legal obligations (e.g. accounting records, generally for the periods required by law). You can ask us to delete data sooner where no legal duty requires us to keep it.

Fiscal records of payments (invoices, transactions) are retained by our payment processor, Stripe, for the legally required period; when you delete your account, the in-app payment history is deleted along with the rest of your data.

After account deletion we may retain fully anonymous aggregate statistics (e.g. account lifetime in months, workout counts, churn month) — no name, email, identifiers or conversation content, so they cannot be linked to any person.

8. Your rights

• Access, rectification and erasure — the account can be permanently deleted directly from the app (Account → Privacy & data).
• Data portability — a full JSON export, straight from your account.
• Control over the assistant’s memory: in “Wyla’s memory” you can see everything she has remembered and delete any individual item.
• Restriction of or objection to processing; proactive messages and the automatic weekly plan can be turned off in settings.
• Withdrawing consent at any time, without affecting prior processing.
• Lodging a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro).

9. Automated processing

The wellness coach generates suggestions automatically from the inputs you give it. These are non-binding suggestions and do not produce legal or similarly significant effects; you decide whether to act on them.

10. Cookies and local storage

We use only the storage strictly necessary to operate the site and keep you signed in. We do not use third-party advertising cookies.

11. Security

We use technical and organisational measures to protect your data, including encryption in transit, hashed credentials, access controls, and automatic redaction of sensitive identifiers (e.g. card-like numbers) before they reach the AI or storage.

12. Children

Our services are intended for adults (18+). We do not knowingly collect data from children.

13. Changes and contact

We may update this Policy; the current version is published here. For any question or to exercise your rights, contact us using the details above.