Privacy policy

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more detail about each topic in the sections below.

What personal information do we process? Your email address, your questionnaire answers, your subscription status, and technical information about how you use the Services. Learn more in "WHAT INFORMATION DO WE COLLECT?"

Do we process any sensitive personal information? Yes. Some of your questionnaire answers (for example, where you feel pain or stiffness) are health information. We only process them with your explicit consent, which you give before the questionnaire starts. Learn more in "WHAT LEGAL BASES DO WE RELY ON?"

Do we collect any information from third parties? We do not collect information about you from third parties. Our payment provider, Stripe, tells us whether your payment succeeded and the status of your subscription.

How do we process your information? To provide, personalise and administer our Services, communicate with you, keep the Services secure, and comply with law. Learn more in "HOW DO WE PROCESS YOUR INFORMATION?"

Who do we share it with? Only with the service providers that help us run Bodyfold, such as our hosting, payment, email and analytics providers. We do not sell your personal information or use it for targeted advertising. Learn more in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

How long do we keep it? If you never subscribe, we delete your data 12 months after your last questionnaire. If you subscribe, we keep it while you are subscribed and delete it 12 months after your subscription ends. Learn more in "HOW LONG DO WE KEEP YOUR INFORMATION?"

What are your rights? Depending on where you live, you may have rights to access, correct, delete or move your information, and to object to or restrict how we use it. Learn more in "WHAT ARE YOUR PRIVACY RIGHTS?"

How do you exercise your rights? Use the "Delete my data" option in your account, or email us at support@bodyfold.com.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you complete our questionnaire, subscribe, sign in, or contact us. The personal information we collect may include the following:

• email address
• contact preferences (for example, whether you agreed to receive promotional emails)
• sign-in (authentication) data
• questionnaire answers about your stretching needs and wellbeing
• age range
• desk-work details, such as how long you sit each day
• stretching preferences, such as routine length and focus areas
• how you heard about Bodyfold

Sensitive Information. With your explicit consent, we process the following category of sensitive information:

• health data (for example, areas where you feel pain or stiffness)

Payment Data. All payments are processed by Stripe. Bodyfold does not collect, receive or store your payment card details. Stripe collects your payment details and billing information directly, and sends us a customer reference and your subscription status (for example, active or cancelled). Stripe acts as an independent controller for payment fraud prevention and its legal obligations, and keeps payment records for about six years as required by law. You can read Stripe's privacy notice here: https://stripe.com/gb/privacy.

All personal information that you provide to us must be true, complete, and accurate.

Information automatically collected

In Short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs and campaign tags, country, information about how and when you use our Services, and other technical information. This information is mainly needed to keep the Services secure and working, and, if you accept analytics cookies, for our internal analytics.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services. This may include your IP address, device information, browser type and settings, and information about your activity in the Services (such as date/time stamps, pages viewed, and features used), and error reports.
• Device Data. Information about your computer, phone, tablet, or other device you use to access the Services, such as your IP address, browser type, operating system, and screen size.
• Security data. To limit repeated requests and block bots, we store hashed (scrambled) versions of your IP address and email address for a short period. We also use Cloudflare Turnstile to check that form submissions come from a person.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, personalise and administer our Services, communicate with you, keep the Services secure, and comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for the following reasons:

• Personalised stretch routines. We use your questionnaire answers (including health-related answers, with your explicit consent) to build your routine. (Retention period: Non-subscribers: 12 months after your last questionnaire. Subscribers: while subscribed and 12 months after it ends.)
• To create and manage your account and sign you in. We use your email address to send secure sign-in links and identify your account. (Retention period: While you are subscribed, and for 12 months after your subscription ends. If you never subscribe, 12 months after your last questionnaire.)
• To deliver the Services to you. (Retention period: While you are subscribed, and for 12 months after your subscription ends.)
• To manage your subscription and payments. We keep your subscription status and Stripe customer reference. Stripe processes payment, and we never see or store your card details. (Retention period: While you are subscribed, and for 12 months after it ends. Stripe keeps payment records for about 6 years as required by law.)
• To respond to your enquiries and offer support. (Retention period: 12 months after your last message to us.)
• To send you service information, such as sign-in links, receipts, subscription notices, and changes to our terms and policies. (Retention period: While you are subscribed, and for 12 months after your subscription ends.)
• To send you promotional emails, only if you have agreed to receive them. You can unsubscribe at any time. (Retention period: Until you unsubscribe or your data is deleted under the periods above.)
• To protect our Services, including preventing abuse, bots and fraud. (Retention period: 2 days for hashed rate-limit data. Security logs are kept for up to 30 days.)
• To identify usage trends, only if you accept analytics cookies, so we can understand how the Services are used and improve them. (Retention period: 12 months from collection.)
• To save or protect an individual's vital interest, such as to prevent harm.
• To comply with our legal obligations.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we have a valid legal reason (legal basis) to do so under applicable law.

If you are located in the UK or EU, this section applies to you.

The UK GDPR and the EU GDPR require us to explain the legal bases we rely on to process your personal information. We rely on the following:

• Consent. We rely on your consent to process your health-related questionnaire answers, to send you promotional emails, and to run analytics cookies. You can withdraw your consent at any time (see "Withdrawing your consent" below).
• Performance of a Contract. We process your email address, account and subscription information where this is necessary to provide the Services you have asked for, or to take steps at your request before you subscribe.
• Legitimate Interests. We process technical and security information where this is reasonably necessary to keep the Services secure, diagnose problems and prevent abuse and fraud, and those interests are not outweighed by your interests and fundamental rights and freedoms.
• Legal Obligations. We process information where necessary to comply with our legal obligations, such as tax and accounting rules, responding to lawful requests from authorities, or exercising or defending our legal rights.
• Vital Interests. We may process information where necessary to protect your vital interests or those of another person, such as situations involving potential threats to someone's safety.

Health information (special category data). Health information is a special category of personal data. We process it only on the basis of your explicit consent (Article 9(2)(a) UK GDPR), which you give before you start the questionnaire. We use it only to build and adjust your routine. You can withdraw your consent at any time by using "Delete my data" in your account or emailing support@bodyfold.com. Without this information we cannot personalise a routine for you.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, for example for investigations and fraud detection and prevention, or to comply with a subpoena, warrant or court order.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers that help us run Bodyfold, and in the specific situations described in this section. We do not sell your personal information.

We use the following service providers, who process personal information on our behalf under written contracts:

We may also share your information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business to another company. We would tell you before your information became subject to a different privacy notice.
• Legal requirements. Where we are required to by law, or to protect our rights or the safety of others.

5. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Some of our service providers process information outside the UK. When they do, we make sure appropriate safeguards are in place.

Your account and questionnaire data are stored in the United Kingdom. Some of our service providers (listed in section 4) process information in the United States or the EU. Transfers to the EU are covered by the UK's adequacy regulations. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the provider is certified, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards by emailing support@bodyfold.com.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use cookies and similar technologies that are needed to run the Services, and analytics cookies only if you accept them.

We use cookies and similar technologies (such as browser storage) to keep you signed in, protect forms from bots, prevent payment fraud, and remember your cookie choice. These are strictly necessary for the Services to work.

With your consent, we also use PostHog analytics to understand how the Services are used. Analytics only runs after you accept it in our cookie banner, and you can change your choice at any time.

We do not use cookies for advertising, and we do not allow third parties to use tracking technologies on our Services for advertising.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as we need it for the purposes in this Privacy Notice, unless the law requires us to keep it longer.

• If you never subscribe: we delete your questionnaire answers, email address and related data 12 months after your last questionnaire.
• If you subscribe: we keep your data while you are subscribed, and delete it 12 months after your subscription ends (whether you cancel or it lapses).
• If you use "Delete my data": we delete your data straight away (see section 10).
• Security data: hashed IP addresses and email addresses used for rate limits are deleted after 2 days.
• Analytics: 12 months from collection.
• Support emails: 12 months after your last message to us.
• Payment records: Stripe keeps these for about 6 years as required by law.

When we have no ongoing legitimate need to process your personal information, we delete or anonymise it. If this is not possible (for example, because it is held in backup archives), we securely store it and isolate it from any further processing until deletion is possible.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through organisational and technical security measures.

We have implemented appropriate technical and organisational security measures designed to protect the personal information we process, including encryption in transit, access controls, and passwordless sign-in links. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never be able to defeat our security. You should only access the Services within a secure environment.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: Bodyfold is only for adults aged 18 or over.

We do not knowingly collect data from, or market to, anyone under 18. By using the Services, you confirm that you are at least 18. If we learn that we have collected personal information from someone under 18, we will deactivate the account and promptly delete the data. If you become aware of any data we may have collected from someone under 18, please contact us at support@bodyfold.com.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you have rights that give you greater access to and control over your personal information.

In some regions (like the UK, EEA, Switzerland, and Canada), you have rights under data protection law. These may include the right (i) to request access to and a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) to data portability, and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make a request by emailing support@bodyfold.com. We will respond within one month.

Complaints (UK). If you are unhappy with how we have handled your personal information, please complain to us first at support@bodyfold.com.

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without undue delay.
• We will keep you informed of progress and explain the outcome.

If you are not happy with our response, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA, you also have the right to complain to your local data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent. You can withdraw your consent at any time:

• Health information: use "Delete my data" in your account, or email support@bodyfold.com.
• Promotional emails: click the unsubscribe link in any promotional email.
• Analytics cookies: change your choice in the cookie settings link in the site footer.

Withdrawing consent does not affect the lawfulness of processing before you withdrew it.

Opting out of promotional emails. You can unsubscribe from promotional emails at any time by clicking the unsubscribe link in the emails we send, or by emailing support@bodyfold.com. We will still send you service messages that are needed to run your account, such as sign-in links and receipts.

Deleting your account and data. You can delete your data at any time using "Delete my data" in your account. This deletes your account, questionnaire answers and related data from our systems, and cancels any active subscription immediately (see our Terms of Service). Stripe keeps its own payment records as required by law.

Cookies. You can change your analytics choice at any time using the cookie settings link in the site footer. You can also set your browser to block or delete cookies, but some parts of the Services, such as signing in, will not work without strictly necessary cookies.

If you have questions about your privacy rights, email us at support@bodyfold.com.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognising and implementing DNT signals has been finalised, so we do not currently respond to DNT browser signals. We do not use tracking for advertising, and analytics only runs if you accept it. If a standard for online tracking is adopted that we must follow, we will explain it in a revised version of this Privacy Notice.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to access, correct, get a copy of, or delete your personal information, and to withdraw your consent. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. For a full list of what we process, see "WHAT INFORMATION DO WE COLLECT?"

We only collect sensitive personal information as permitted by applicable law or with your consent. We do not collect or process sensitive personal information to infer characteristics about you.

We use and retain the personal information in categories A, B, C, D, F and L for the periods set out in "HOW LONG DO WE KEEP YOUR INFORMATION?"

Sources of Personal Information. See "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information. See "HOW DO WE PROCESS YOUR INFORMATION?" and "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" We disclose personal information to our service providers under written contracts. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, and we will not sell or share personal information in the future.

Your Rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data for targeted advertising, sale, or profiling (we do not do any of these)

Depending on the state where you live, you may also have the right to obtain a list of the categories of, or specific, third parties to which we have disclosed personal data, and the right to limit the use and disclosure of sensitive personal data.

How to Exercise Your Rights

Email us at support@bodyfold.com, or use "Delete my data" in your account. You can designate an authorised agent to make a request on your behalf. We may deny a request from an agent who does not provide proof that they have been validly authorised.

Request Verification

When we receive your request, we will need to verify your identity, usually by confirming you control the email address on your account. We will only use the information provided in your request to verify your identity.

Appeals

If we decline to take action on your request, you may appeal by emailing support@bodyfold.com. We will tell you in writing what action we took or did not take in response, and why. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 lets California residents request, once a year and free of charge, information about any personal information we disclosed to third parties for direct marketing purposes in the previous calendar year. We do not disclose personal information to third parties for their direct marketing. To make a request, email support@bodyfold.com.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will email subscribers or show a prominent notice on the Services before the changes take effect.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, email us at support@bodyfold.com.

Uzayr Wani, trading as Bodyfold United Kingdom

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You can delete your data at any time using "Delete my data" in your account. To request access to, a copy of, or a correction to your personal information, email support@bodyfold.com. We will respond within one month.