Privacy Policy — OptiPeak

This Privacy Policy explains how Kevin Terrier (“OptiPeak”, “we”, “us”), operating as a sole trader in France, collects, uses and protects your personal data when you use the OptiPeak web application (“Service”). We comply with the EU General Data Protection Regulation (“GDPR”) and the French Data Protection Act.

1. Data controller

Kevin Terrier — France
Contact for privacy requests: terrierkevin406@gmail.com

2. Data we collect

Onboarding data: age, sex, height, weight, training goal, experience level, equipment, dietary restrictions, injuries.
Fitness & biofeedback data: workout logs, sets, weights, RIR/RPE, daily readiness (sleep, stress, soreness, motivation), body-weight logs, race times.
Coach conversations: messages exchanged with the AI coach.
Form-check media: short exercise video clips are processed in your browser; only 5 low-resolution JPEG keyframes are sent to our servers for analysis.
Account & billing data: display name, subscription tier, Stripe customer ID and subscription ID (we never store your card details).
Technical data: IP address, browser type, timestamps of API calls.

3. Legal bases (GDPR Art. 6)

Performance of a contract (Art. 6(1)(b)) — to provide the coaching service you subscribed to.
Explicit consent (Art. 9(2)(a)) — for processing health-related data such as injuries, biofeedback and body composition. You can withdraw consent at any time by deleting your account.
Legitimate interest (Art. 6(1)(f)) — to secure the service, prevent abuse and improve product quality (aggregate, non-identifying analytics).
Legal obligation (Art. 6(1)(c)) — to retain billing records under French tax law.

4. How we use your data

Generate hyper-personalised training and nutrition plans.
Adapt weekly macros and progression based on your logs.
Analyse your form-check keyframes.
Send AI-generated coach responses.
Process subscription payments and billing.

5. Third-party processors

We share strictly-necessary data with these vetted sub-processors:

Anthropic PBC (United States) — Claude Sonnet 4.5 for AI plan & coach responses. Prompts do not include your name, email or payment data. Transfers rely on Standard Contractual Clauses.
Stripe, Inc. (United States / Ireland) — subscription billing & payment processing (PCI-DSS). See Stripe's privacy policy.
MongoDB Atlas — encrypted database hosting inside the EU where available.
Google Fonts — the Inter typeface is loaded via Google's CDN.

6. International transfers

Some processors are established outside the EU/EEA (mainly the United States). We rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework to ensure an adequate level of protection.

7. Retention

Account & training data: for as long as your account is active, then deleted 12 months after cancellation unless you request earlier erasure.
Billing records: retained for 10 years to comply with French commercial law (Art. L123-22 du Code de commerce).
Form-check keyframes: deleted 30 days after upload.
AI coach conversations: kept while your account is active, deleted on account closure.

8. Your rights

Under GDPR you have the right to:

Access your personal data (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure (“right to be forgotten”, Art. 17).
Restriction of processing (Art. 18).
Data portability in a machine-readable format (Art. 20).
Object to processing based on legitimate interest (Art. 21).
Withdraw consent at any time.
Lodge a complaint with the French supervisory authority (CNIL, www.cnil.fr).

To exercise any right, email terrierkevin406@gmail.com. We reply within 30 days.

9. Cookies & local storage

OptiPeak uses browser localStorage to remember your user identifier and preferences. We do not use advertising or cross-site tracking cookies. Stripe may set its own strictly-necessary cookies during checkout.

10. Children

OptiPeak is not intended for users under 15 (the minimum age for consent to information-society services under French law). If you become aware that a minor has provided us data without parental consent, please contact us and we will delete it.

11. Security

We use TLS in transit, encrypted database storage, environment-variable secret management and role-based access. No system is 100% secure; if we ever discover a breach affecting your data we will notify you and CNIL within 72 hours as required by GDPR Art. 33/34.

12. Health disclaimer

OptiPeak provides educational fitness guidance generated by artificial intelligence. It is not medical advice. Always consult a qualified healthcare professional before starting a new training or nutrition programme, especially in the presence of injury, pregnancy or medical conditions.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app and by email at least 30 days before taking effect.