Privacy Policy

1. Data controller

MavoraFit
mavorafit.com

Privacy and rights requests: privacy@mavorafit.com.

2. Data we process

• Account: identifier, name, email, authentication method and language.
• Health and physical profile: age, sex, height, weight, activity level, goal, calculated targets, body measurements and training preferences.
• Nutrition and training: foods, quantities, calories, macronutrients, plans, exercises, sets, repetitions, load and history.
• Subscription: technical identifiers, product, store, entitlement and trial, renewal or expiry dates. We do not receive full card details.
• Device and security: app version, platform, authorised notification tokens and minimised technical information about failures and abuse.
• Optional usage: pseudonymised product events and masked visual diagnostics only after consent in the app.
• Newsletter: email provided voluntarily and proof of consent pseudonymised with HMAC.

The production MVP does not include meal photography or AI photo analysis and does not request camera access for that purpose.

3. Purposes and legal bases

• Contract: create and authenticate the account, provide the service, validate premium access, save user-requested records and provide support (GDPR Article 6(1)(b)).
• Explicit consent: process health data to calculate targets and personalise training and nutrition (Articles 6(1)(a) and 9(2)(a)). Without this consent, the personalised product cannot be provided.
• Optional consent: product analytics, visual diagnostics, marketing and newsletter. These options start disabled and can be withdrawn at any time.
• Legitimate interests: security, fraud prevention, stability and minimised technical reports, after balancing the user's rights (Article 6(1)(f)).
• Legal obligation: retain records required by tax, accounting, consumer or security law (Article 6(1)(c)).

4. Providers and recipients

We use Supabase (authentication, database and storage), Vercel (site and APIs), RevenueCat and Google Play/App Store (subscriptions), Expo (mobile infrastructure and notifications), Sentry (technical errors), PostHog (consented analytics) and Resend (newsletter and transactional email). Each provider receives only the data required for its function and acts under applicable contracts and instructions.

We may disclose data to authorities where there is a valid legal obligation. We do not sell personal data.

5. International transfers

We prioritise European regions. When a provider processes data outside the European Economic Area, we verify an adequacy decision or Standard Contractual Clauses and suitable supplementary measures. You can request information about the applicable mechanism through the privacy contact.

6. Retention and deletion

• Account, profile, nutrition, training and progress: while the account exists; deleted when the account is deleted, unless a specific legal obligation applies.
• Newsletter: until you withdraw consent or request deletion.
• Consent, transaction and security evidence: only for the period needed to demonstrate compliance, resolve disputes or meet legal requirements, with periodic review.
• Backups and caches: deleted within each provider's technical cycle, with restricted access and no reuse for other purposes.

Deleting the account does not cancel a store subscription or automatically remove an email separately provided for the newsletter.

7. Rights and complaints

You may request access, rectification, erasure, restriction, portability or objection, and withdraw consent without affecting the lawfulness of prior processing. We will respond without undue delay and generally within one month after confirming identity. Where applicable, we will explain any extension or legal reason for refusal.

You may also complain to the Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, 134 - 1st floor, 1200-651 Lisbon, or through cnpd.pt.

8. Children and automated decisions

MavoraFit is intended for people aged at least 16. Minors without sufficient legal capacity must use the service only with authorisation from their legal representative.

Calorie, macronutrient and training targets are automated estimates that support the user. They do not produce legal or similarly significant effects and can be reviewed or adjusted by the user.

9. Security and changes

We use HTTPS/TLS, per-user access policies, private media with temporary URLs, secret segregation, telemetry minimisation and incident response processes. No system is infallible; if a breach presents risk, we will meet applicable assessment, notification and communication obligations.

We may update this policy when the product, providers or law change. Material changes will be communicated appropriately and, where required, we will request consent again.