Privacy Notice

1. Who we are

This Privacy Notice describes how ClayFit ("ClayFit", "we", "us") collects and processes personal data when you use our website and application available at clayfitness.app (the "Service"). ClayFit acts as the data controller for the personal data described below.

2. Data we collect

• Account data: email address, display name, hashed password, and authentication identifiers.
• Fitness data you submit: workouts, lifts, sets, reps, weights, cardio sessions, body metrics, and notes.
• Usage and device data: IP address, browser type, device identifiers, log timestamps, pages viewed, and basic telemetry.
• Support communications: messages you send us and any attachments.
• Email preferences: subscription and suppression status for transactional and marketing email.

Payment card details are not collected or stored by ClayFit. Paddle.com Market Limited ("Paddle"), our Merchant of Record, collects payment information directly from you when you check out.

3. Why we use your data and legal basis

• Provide the Service (contract): create your account, store your training history, deliver features.
• Process payments and subscriptions (contract): share order data with Paddle to take payment and manage your subscription.
• Send transactional email (contract / legitimate interests): welcome, receipts, account, and security notifications.
• Protect the Service (legitimate interests): prevent fraud, abuse, and unauthorized access.
• Improve the Service (legitimate interests): aggregate analytics and bug diagnostics.
• Comply with law (legal obligation): tax, accounting, and lawful requests.

4. Who we share data with

• Paddle — our Merchant of Record. Paddle handles checkout, payments, subscription billing, refunds, invoicing, and sales-tax compliance. See Paddle's Privacy Notice.
• Infrastructure providers — hosting, database, authentication, and email delivery providers that process data on our behalf under written agreements.
• Professional advisers — legal, accounting, and tax advisers where necessary.
• Authorities — when required by law, court order, or to protect rights and safety.

We do not sell your personal data.

5. International transfers

Our service providers may process your data outside your country of residence, including in the United States and the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep account and training data for as long as your account is active. If you delete your account or are inactive for an extended period, we delete or anonymize the data within a reasonable timeframe, except where we must retain records to meet legal, tax, or accounting obligations (typically up to 7 years for billing records).

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, to withdraw consent, and to lodge a complaint with your local data protection authority. To exercise these rights, contact us at privacy@clayfitness.app. We will respond within one month.

8. Security

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and least-privilege database policies. No system is perfectly secure, but we work to keep your data safe.

9. Cookies

We use only the cookies and similar local-storage technologies that are strictly necessary to operate the Service (authentication session, preferences). We do not currently use third-party advertising or cross-site tracking cookies.

10. Changes to this notice

If we make material changes, we will update the "Last updated" date and, where required, notify you by email or in-app.

11. Contact

ClayFit — privacy@clayfitness.app