Privacy Policy

Draft, not yet in force.

Who is responsible

Bolide Labs LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, US, runs fitvee (fitvee.com) and is responsible for your personal data. Contact: support@fitvee.com.

[Counsel: appoint and name an EU representative (GDPR Art. 27) and a UK representative.]

What we collect, and why

• Your quiz answers, such as your age, first name, goals, how active you are and anything you type in your own words: to build your plan and your results. (Needed to provide the service.) Answers about your body are health data: see "Consumer health data" below.
• Your email address: to send your receipts, the reminders the law requires, and links to your account. (Needed to provide the service.) Marketing emails: only if you say yes when we ask. Pressing unsubscribe in any of them stops them all. (Consent.)
• Your purchases: what you bought and when, and the amounts and status of your payments, refunds and disputes. Your card number goes to Stripe; we never see it. From Stripe we keep the card's network (for example Visa), last four digits, expiry date and the network's reference for its first payment, so a membership can go on being charged if we ever move to another payment processor. (Needed to provide the service; tax and accounting law.)
• Where you are: your country and, in the US, your state, worked out from your IP address when you visit, so we apply local rules (age, cancellation, health data). We don't store your IP address. (Legitimate interests; legal obligations.)
• How you found us: if you came from an ad, the campaign, ad set and ad numbers and the click identifier in the link, to see which ads work. (Legitimate interests.)
• Which quiz screens are seen: counted per screen, without the count being tied to you, to improve the quiz. (Legitimate interests.)
• Ad measurement: none. We don't tell Meta or any other advertising platform about your visit, your sign-up or a purchase.
• How you use your account: the days you open your account page and your plan, and which sessions you mark as done. If you dispute a payment with your bank, we send it, through Stripe, these facts, the terms you agreed to (with their fingerprints) and the dates of the emails we sent you, never your answers, your health information or your messages. (Legitimate interests: showing a payment was authorised and the service delivered.)
• Messages you send us: to answer you. We keep the text of your emails and our replies; attachments are listed by name but not kept. (Needed to provide the service; legitimate interests.)
• Voicemails you leave on our support line: your phone number and what you say, as a written transcript, to answer you. The recording itself is deleted from our phone provider once it is transcribed. We keep the transcript like your emails. (Needed to provide the service; legitimate interests.)

We don't put advertising pixels or session recorders on our pages.

[Counsel: before any ad measurement is added (#163: the purchase event only, after your review), this section and "Who we share it with" are rewritten: what is sent, on what basis, and whether telling an ad platform that someone signed up for or bought a fitness plan is itself consumer health data.]

Consumer health data

Your quiz answers about your body, such as your height, weight, goal weight and any health conditions, are health data. We collect them only with a separate consent, which we ask for in the quiz and which you can withdraw at any time in your account ("Your health information") or by writing to support@fitvee.com; withdrawing deletes them. We store them apart from your other answers. We use them only to build and run your plan, and they go only to the service providers that run fitvee for us, under contract. We never share them with advertising platforms or use them for ads. Our Consumer Health Data Privacy Policy says more.

[Counsel: review the Consumer Health Data Privacy Policy draft (Washington My Health My Data Act and similar state laws); confirm the consent wording, which quiz answers count as health data, the rights to access and delete, and the limits on sale and on location-based targeting.]

Cookies and storage on your device

• A cookie (named arm_ and the test's name) keeps you in the same version of the quiz for 30 days while we compare versions.
• Your browser's storage keeps your quiz progress until you finish, and the link to your account while the tab is open.

[Counsel: whether the comparison cookie needs consent in EU countries.]

Who we share it with

Only the providers that run fitvee for us, under contracts that limit what they may do with it:

• Cloudflare: hosting, our database, and receiving the emails you send us.
• Stripe: payments.
• Postmark: email.

[Founders and counsel: add any provider that receives personal data for personalising plans; none is listed yet.]

We don't sell your personal data or share it for advertising, and your health data is never shared with advertising platforms. We give it to authorities only when the law requires it.

Transfers outside the EU and UK

We and our providers are in the United States. Transfers rely on the EU-US Data Privacy Framework where a provider is certified, or on the European Commission's standard contractual clauses.

[Counsel: confirm the transfer basis for each provider.]

How long we keep it

• Payment and tax records (what you bought and paid, refunds and disputes), the terms you agreed to, and the reminders and receipts we sent: as long as your account exists, and after you delete it as described below.
• Emails you send to support@fitvee.com and our replies: 24 months after the conversation's last message, then deleted automatically.
• Everything else: until you delete your account or ask us to.

[Founders and counsel: set a retention period for accounts nobody deletes (for example 24 months after your last visit or purchase); the engine will then delete automatically. Set one for health data too.]

Deleting your account

You can delete your account yourself: open your account from the link in any of our emails and press "Delete my account". To make sure it's you, we email you a link to confirm. It works for 72 hours, and nothing is deleted until you press it. Then:

• every membership stops at once and nothing more is charged (deleting doesn't refund what you've already paid);
• we delete your email address, your quiz answers including your health data, your plan progress and check-ins, your emails to support and the ad identifiers from your visit;
• we keep what the law and the card networks require, without your email address: your orders and payments, refunds and disputes, the terms you agreed to (with a fingerprint of their exact wording), the reminders and receipts we sent, the days you used your account, and a record of your request and when we carried it out. In place of your address we keep a scrambled code made from it, so that if your bank asks about a payment later, or you write to us again, we can find these records. We delete them, and the code, 10 years after your account was deleted: EU tax law asks sellers like us to keep sales records for 10 years.

If you can't open your account, write to support@fitvee.com from the address you signed up with and we'll send the confirmation link to it.

[Counsel: whether 10 years suits every kept record or only the tax records (card-network dispute evidence is needed for up to about 18 months, consent records in California for 3 years, or 1 year after the contract ends if later); Stripe keeps its own payment records under its own legal duties.]

Your rights

You can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable form. You can download everything we hold about you yourself: open your account and press "Download my data" for a file other services can read. You can withdraw a consent at any time, including your consent to health data; that doesn't affect what we did before. If you live in the EU or the UK, you can complain to your data protection authority. If you live in a US state with a privacy law (such as California or Washington), you can ask to know, delete or correct your data; we don't sell it or share it for ads. For anything else, write to support@fitvee.com: we answer within a month (in California, within 45 days), and we never treat you differently for using your rights. Your plan starts at the level your quiz answers point to, which our software sets. We don't take decisions about you that have legal or similarly significant effects by automated means.

[Counsel: confirm that setting a starting level from quiz answers, some of them health data, needs no further notice or consent.]

Children

fitvee is for adults. The quiz doesn't accept an age under 18, and we keep nothing of it: it goes on only with an age of 18 or more.

Security

Connections are encrypted. Your data is stored with Cloudflare, and only people who need it for their work can see it, after signing in, with every change recorded.

Changes

We post changes here and email you about important ones.