Privacy Policy

This Privacy Policy explains how ooblee Alpine GmbH ("we") processes personal data when you use the Celulit App (the "App"). It is written to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Austrian Data Protection Act (DSG) and, for users in Montenegro, the Montenegrin Personal Data Protection Act.

1. Controller and contact

The controller responsible for processing your personal data is:

• ooblee Alpine GmbH
• Am Tabor 36, 1020 Vienna, Austria
• Commercial Register: Handelsgericht Wien, FN [number — to confirm]
• VAT number: ATU80851534
• Data protection contact: support@celulitapp.com

We respond to requests about your rights within one month of receipt; for complex requests we may extend this by up to two further months and will tell you if we do.

2. Which data we process

We process only the data the App needs to work. We do not ask for your name, address, date of birth or photos.

• Account data. Email address; time the account was created; short-lived sign-in link tokens and session data (session identifier, sign-in time, time of last activity).
• Program progress. Which program day you started and completed and when; the date you started the program.
• Answers to questions in the program. Answers to the daily questions, "myth or fact", food checks and the weekly check-in (for example how you feel in your body this week). Answers are stored as a choice among the offered options, never as free text.
• Settings and the onboarding questionnaire. Reminder time and days; your onboarding answers (goal, areas, activity, pace), and about physical limitations only with your consent (section 4).
• Subscription data. Chosen plan, subscription status (trial, active, payment failed, cancelled), start and next-charge dates, customer and subscription identifiers at the payment service provider. We do not receive or store card data; it is processed solely by Stripe.
• Technical data. IP address, browser and device type, request times and errors, in the server logs needed for security and troubleshooting.
• Communication. Messages you send to the support address and our replies.

Some check-in and questionnaire answers may reveal information about your health (for example pregnancy, an injury or pain). We treat such data as a special category of personal data and process it only with your explicit consent (Section 4).

3. Purposes and legal bases

For each purpose we name the legal basis under Article 6 GDPR.

1. Running your account and sign-in by link (sending the sign-in link, keeping the session, signing out everywhere): performance of a contract (Art. 6(1)(b)).
2. Providing the program (showing today's day, saving progress and answers, unlocking the next days): performance of a contract (Art. 6(1)(b)); for answers that reveal health data: your explicit consent (Art. 9(2)(a)).
3. Billing the subscription (trial, charges, renewal, failed payment, cancellation): performance of a contract (Art. 6(1)(b)) and statutory accounting obligations (Art. 6(1)(c)).
4. Service emails (sign-in link, subscription confirmation, failed payment, changes to terms): performance of a contract (Art. 6(1)(b)).
5. Daily reminder email, if you turn it on: your consent (Art. 6(1)(a)), which you can withdraw at any time in the App (Account → My details → Edit → No reminder).
6. Security, abuse prevention and troubleshooting (server logs, limiting sign-in attempts): our legitimate interest in keeping the App secure and working (Art. 6(1)(f)).
7. Answering your messages: performance of a contract or our legitimate interest in replying (Art. 6(1)(b) and (f)).
8. Aggregate usage statistics (how many users complete a day, which days are skipped), without identifying individuals: our legitimate interest in improving the program (Art. 6(1)(f)).
9. Establishing and defending legal claims, responding to authorities: legitimate interest or legal obligation (Art. 6(1)(f) and (c)).

We make no decisions based solely on automated processing that would have legal or similarly significant effects on you. We do not use your data for advertising and do not sell it.

4. Health data and your consent

One question of the onboarding questionnaire, about physical limitations (back pain, knees, an injury, pregnancy or the postpartum period, varicose veins, skin problems), may reveal your state of health. Before that question we ask for your explicit consent to process such answers. Consent is not a condition of using the App: without it we skip that question and store nothing about your health, and the program and everything else works the same.

You can give or withdraw the consent at any time in the App (Account → My details → Consents); withdrawing deletes your answers about limitations right away. You can also withdraw it by writing to support@celulitapp.com or by deleting your account. Withdrawal does not affect the lawfulness of processing before it.

The other questionnaire answers (goal, areas, activity, pace) and the check-in questions during the program (how your day went, food, how your body feels) are data about habits and following the program, not about health; we process them to provide the program (section 3, item 2). The answers to a day's required questions are needed to mark the day as completed.

The answers are not medical records, no doctor interprets them, and we give no diagnosis or therapy based on them. If you have a health problem, see a doctor, not the App.

5. Processors and recipients

We share personal data only with service providers that process it on our instructions under a data processing agreement, and only as far as necessary:

• Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland): subscription billing. Stripe receives your email address and the payment details you enter on its page; for card data Stripe is an independent controller and its own privacy policy applies.
• Vercel (Vercel Inc., USA): hosting and running the App; server logs.
• Neon (Neon, Inc., USA): the database that holds your account, progress, answers and settings. The database is located in an EU region (Frankfurt, Germany).
• Resend (Resend, Inc., USA): sending emails (sign-in link, reminders, subscription messages).
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): storing and delivering the videos. When you watch a video, AWS sees your IP address.

Beyond these, we may disclose data to professional advisers (legal, accounting) bound by confidentiality, to authorities where the law obliges us, and to a legal successor in a corporate transaction, with the same protection maintained.

The program author does not receive your personal data. She receives only aggregate, anonymous information about use of the program (for example how many users completed a week).

6. Transfers to third countries

Your data is stored in the European Union (database in Frankfurt). Some of our service providers are based in the United States and may access data from the US (for example for support or to send email). For such transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified providers) and on the Commission's Standard Contractual Clauses, with supplementary measures where needed. You can request a copy of the safeguards at support@celulitapp.com.

If you are in Montenegro, your data is transferred from Montenegro to the EU, where it is processed with the protection the GDPR provides.

7. How long we keep data

• Account, progress, answers and settings: for as long as you have an account. When you delete the account in the App, this data is deleted from the live database immediately and disappears from backups within 30 days at the latest.
• Sign-in link tokens: 15 minutes, or until used. Sessions: until you sign out, and at most 180 days after the last activity.
• Subscription and billing records: 7 years from the end of the year of the charge, under Austrian tax and accounting law (§ 132 BAO, § 212 UGB), also after account deletion, in pseudonymised form.
• Server logs: up to 30 days, longer only if needed to investigate a security incident.
• Support messages: up to 24 months after the request is resolved.
• Reminders: reminder settings are deleted when you turn them off or delete the account.

8. Cookies and similar technologies

The App uses only strictly necessary cookies: the session cookie (so you stay signed in) and a short-lived cookie during sign-in by link. These need no consent. We use no advertising cookies, no third-party tracking tools and do not follow you on other sites. If we later introduce usage measurement that requires consent, we will update this policy first and ask for it.

9. Your rights

Under the GDPR and Montenegrin law you have the right to:

1. access your data and get a copy;
2. rectification of inaccurate or incomplete data;
3. erasure ("right to be forgotten"): you can delete your account and all data yourself in the App (Account → Delete account), without our involvement;
4. restriction of processing in certain cases;
5. portability of the data you gave us, in a structured, machine-readable format;
6. object to processing based on legitimate interest;
7. withdraw consent at any time where processing is based on consent (reminders, health data).

To exercise your rights, write to support@celulitapp.com. We may ask you to confirm your identity before replying (for example by sending the request from the account's email address).

You also have the right to lodge a complaint with a supervisory authority:

• in Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at;
• in Montenegro: Agency for Personal Data Protection and Free Access to Information (AZLP), Podgorica, azlp.me.

10. Security

We apply technical and organisational safeguards: encryption in transit (HTTPS), password-less sign-in with a single-use link of limited validity, restricted database access, access logs and regular review of service providers. No internet service is completely secure. If a personal data breach occurs that poses a risk to you, we will notify you and the competent supervisory authority in accordance with Articles 33 and 34 GDPR.

11. Children

The App is intended for adults only (18+). We do not knowingly collect data from persons under 18. If we learn that a child has created an account, we will delete the account and its data; tell us at support@celulitapp.com.

12. Changes to this policy

We may change this policy. The date of the last change is at the top. We will notify you of material changes by email or by a notice in the App before they take effect, and where required we will ask for new consent.

13. Contact

• ooblee Alpine GmbH, Am Tabor 36, 1020 Vienna, Austria
• support@celulitapp.com

Other documents: Terms of Use, Health Notice, Imprint.