Privacy Policy

Version: 2026-01-01

This Privacy Policy explains how we collect, use, store and protect personal information when you use the Powerlifting Coach AI service.

1. Data we collect

• Account data: email, name, hashed password, subscription state.
• Video uploads: videos you submit for analysis. These contain biometric information (your body posture and movement) which qualifies as special category data under GDPR Art. 9. We process this only with your explicit consent given at sign-up.
• Analysis outputs: rep counts, joint angles, form-fault flags, AI coaching transcripts.
• Operational logs: request IDs, IP addresses, user agents, error reports — used to operate, secure, and debug the Service.

2. How we use it

We use your data to (a) provide the Service to you, (b) improve the underlying ML pipeline, and (c) prevent abuse. We do not sell or rent personal data. We do not use your videos for advertising or to train third-party models.

3. Sharing

We share data only with sub-processors necessary to operate the Service: cloud hosting (Microsoft Azure), payment processing (Stripe), error tracking (Sentry). Each is bound by a data-processing agreement.

4. Storage & retention

• Videos: retained 90 days after upload, then permanently deleted unless you opt to keep them. You may delete a video at any time from your dashboard.
• Analysis outputs: retained for the lifetime of your account.
• Logs: rolling 30-day retention.
• Account data: until you delete your account; then purged within 30 days of the deletion request.

5. Your rights

You can at any time:

• Export your data: GET /api/v2/me/data-export.
• Delete your account and all associated data: POST /api/v2/me/delete.
• Withdraw consent for video processing: this will stop further analyses and delete existing video files.
• Object to processing or request restriction: email privacy@example.com.

EU/UK residents may lodge a complaint with their national supervisory authority; California residents have the rights described under CCPA.

6. Security

Data in transit is encrypted via TLS. Passwords are hashed with bcrypt. Secrets (JWT keys, Stripe keys, DB credentials) are stored in Azure Key Vault. Access to production systems is limited and logged.

7. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

8. Contact

Privacy questions: privacy@example.com