Privacy Policy

1. Data Controller

Finacode Oy (SisuLift service), Business ID 3205871-7, domiciled in Turku, Finland
Contact: See the contact page

2. Data We Collect

We collect the following personal data:

• Email address (registration and login)
• Name (optional, profile information)
• Date of birth, gender, weight (optional, training personalization)
• Body composition: waist, chest and hip circumference measurements and body fat percentage (optional)
• Health restrictions and physical limitations (optional)
• Training data (workouts, sets, weights, reps, RPE values)
• Pre-workout readiness self-assessments: sleep, stress and energy level you log (optional, used for workout lightening suggestions and recovery assessment)
• Nutrition data: food diary, calories, macros and water intake (optional)
• Goals and preferences (training customization)
• Health and wearable data from Apple Health or Google Health Connect: heart rate, heart rate variability (HRV), sleep, resting heart rate and steps, as well as workouts logged on your watch (if you enable workout import), read only with the permission you grant on your device
• Menstrual cycle data (optional, only with your separate consent): the period start dates and cycle length you log. Used only to show your cycle phase, suggest workout lightening and inform the AI coach. This data is never used for analytics or shared with third parties, and you can delete it at any time in settings
• Progress photos: before/after photos you upload (optional, private)
• Device information and usage statistics (service improvement)
• Email address for our marketing list, if you leave it on our website (we also store the source page and country level for statistics). You can unsubscribe via the link in every message
• On our public comparison, coach and competitor comparison pages: IP address, browser identifier, referring page and country. We use these for competitor monitoring and abuse detection (legitimate interest). This data is never linked to your account and is deleted within 90 days

3. AI Coach Chat Messages

Regarding AI chat, we store:

• All messages and questions you send
• AI coach responses
• Conversation times and durations
• AI tokens used (for cost tracking)

Note: Do not send sensitive personal information to the AI chat, such as social security numbers, health information (except training-related), financial information, or other confidential data.

4. Purpose of Data Processing

We use your data for the following purposes:

• Providing the service and managing user accounts
• Creating personalized training programs
• Personalizing AI coach responses based on your training history
• Progress tracking and weekly analyses
• Showing recovery, calorie expenditure and workout heart rate based on your wearable and health data (Apple Health / Google Health Connect)
• Service development and improvement
• Customer communication and support
• Preventing misuse

5. Data Retention Periods

We retain your data as follows:

• User account and profile: For the duration of the account, deleted immediately upon account deletion
• Training history: For the duration of the account, deleted immediately upon account deletion
• AI conversations: For the duration of the account or 24 months (whichever comes first)
• AI analyses and programs: For the duration of the account or 24 months (whichever comes first)
• Log data: 12 months, anonymized upon account deletion
• Comparison page hit log: 90 days, then deleted automatically
• Billing information: 6 years as required by accounting law

You can delete your account and all your data at any time from the app settings. Deletion is immediate and cannot be undone.

6. Data Storage and Security

Your data is stored on secure servers in the EU/EEA (Supabase, AWS Stockholm, eu-north-1). We use GDPR-compliant service providers. All data transfer is encrypted (TLS 1.3). Databases are protected with Row Level Security (RLS) policies that ensure you can only see your own data. Health and wearable data read from Apple Health and Google Health Connect (heart rate, HRV, sleep, resting heart rate, steps) is processed only with the permission you grant on your device, used solely to provide app features (recovery, calorie expenditure, workout heart rate), is never used for advertising and is never sold or disclosed to third parties, and you can revoke the permission at any time in your device's health settings. Some of our service providers (OpenAI, Google, Microsoft) also process data outside the EU/EEA, primarily in the United States. These transfers are based on transfer mechanisms approved by the EU (EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses).

7. AI Services and Third Parties

We use OpenAI's AI services for creating training programs, weekly analyses, AI coach functionality, and nutrition AI features (e.g. meal photo analysis, nutrition label scanning and the recipe generator).

Data sent to OpenAI:

• Your training history (workouts, weights, reps)
• Your goals and preferences
• Your profile information (age, gender, experience level) - no email
• Messages you write to the AI chat
• Your nutrition data (food diary, targets) when you use nutrition AI features
• Meal and nutrition label photos you take when you use AI photo analysis. Photos are used only to produce the analysis
• Your free-form training diary text if you use AI-assisted data import

OpenAI does not use API queries for model training. We have signed a Data Processing Agreement (DPA) with OpenAI.

8. Access to Data

The following parties have access to your data:

• You: Full access to all your data through the app
• Your coach (only if you link your account to a coach): If you enable coaching by entering a coach's invite code, your coach can see your training history, nutrition logs, progress statistics, recovery and readiness data, your profile and the restrictions you have logged, and can edit your program and message you. Your coach can see your progress photos only if you separately allow it in settings. You can end the coaching relationship at any time, which ends the coach's access to your data
• SisuLift administration: Limited access for technical support and service maintenance purposes
• Subcontractors: Supabase (database), OpenAI (AI services), Stripe (payments), Resend (email delivery), Google Firebase (push notifications), Vercel (hosting), Cloudflare (security and bot protection). With your consent also analytics: PostHog (EU), Google Analytics, Microsoft Clarity, Vercel Analytics

For technical reasons, administration has access to the database, including AI conversations. Data is processed only to ensure service operation, provide technical support, or investigate misuse. We do not read your private conversations without a justified reason.

9. Data Disclosure

We do not sell or disclose your personal data to third parties for marketing purposes. Data may only be disclosed to service providers processing data on our behalf (see section 8), upon lawful request from authorities (e.g., court order), or with your explicit consent. If you take part in community features such as workout challenges, your first name and the first letter of your last name are visible to other participants of the same challenge on the leaderboard. If you invite a friend with your referral code, we store the link between the inviter and the invitee in order to grant rewards.

10. Your Rights (GDPR)

You have the following rights:

• Right of access (Art. 15): You can request a copy of all your data
• Right to rectification (Art. 16): You can correct inaccurate data
• Right to erasure (Art. 17): You can request deletion of all your data
• Right to data portability (Art. 20): You can export your data in JSON format
• Right to object (Art. 21): You can object to the processing of your data
• Right to restriction (Art. 18): You can request restriction of processing

You can exercise your rights from the app settings (Settings > Privacy and data) or by contacting us. We respond to requests within 30 days.

11. Cookies and Local Storage

We use the following technologies:

• Essential cookies: Login and session management (httpOnly, secure)
• LocalStorage: Theme selection (dark/light), UI settings
• Analytics (consent only): With your consent we use the following tools to improve the product: PostHog (EU), Google Analytics, Microsoft Clarity and Vercel Analytics. They collect e.g. page views, clicks and sessions pseudonymously (your account identifier, not your name or email). PostHog includes session replay, in which all text and inputs are automatically masked, we do not see sensitive values (weights, health metrics, nutrition), and AI coach conversations are fully excluded from recording. PostHog is used both on the web and in the app; Google Analytics, Microsoft Clarity and Vercel Analytics only on the web. You can turn analytics off at any time (on the web via the cookie banner, in the app via Profile → Account and privacy).

Analytics are off by default until you give consent. You can decline by selecting "Essential only" in the cookie banner. We do not use third-party advertising cookies and we do not sell your data.

12. Data Breaches

If a data breach occurs that affects your personal data, we will notify you without delay by email. We will also notify the data protection authority within 72 hours in accordance with GDPR.

13. Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email at least 14 days before they take effect. Change history is available upon request.

14. Contact and Complaints

For privacy-related questions, contact us: see the contact page.

Office of the Data Protection Ombudsman (Finland)
tietosuoja.fi | tietosuoja@om.fi | 029 566 6700