🔒 Privacy Policy

Last Updated: January 2025

1. Introduction

ActivityLab ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains our data handling practices and your rights regarding your personal information.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email, password, first name, last name, phone number
• Profile Information: Age, height, gender, fitness level, training goals
• Activity Data: Runs, routes, GPS data, exercise schedules, performance metrics
• Health Data: Body metrics, recovery entries, sleep records, heart rate data
• Support Communications: Messages sent to our support team

2.2 Information Collected Automatically

• Device Information: Device type, browser, operating system
• Usage Information: Pages visited, features used, interaction patterns
• Technical Information: IP address, session duration, access times
• Location Data: GPS coordinates from activities (only if you grant permission)

3. How We Use Your Data

We use your information for:

• Providing and improving our service
• Processing payments and managing subscriptions
• Sending transactional emails (account confirmations, password resets)
• Responding to support requests
• Analyzing usage patterns to improve functionality
• Complying with legal obligations
• Detecting and preventing fraud or abuse

4. Data Retention

• Active Account: Data retained while your account is active
• After Deletion: Data permanently deleted within 7 days of account deletion request
• Backup Data: Deleted from backups within 90 days
• Audit Logs: Retained for 12 months for compliance purposes
• Legal Hold: Data retained if required by law

5. Your Privacy Rights (GDPR)

You have the following rights regarding your personal data:

• Right to Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your account and data (subject to legal holds)
• Right to Restrict Processing: Limit how we use your data
• Right to Portability: Export your data in a structured format
• Right to Object: Opt-out of certain data processing
• Right to Lodge a Complaint: File a complaint with your data protection authority

6. Data Security

• HTTPS/TLS encryption for data in transit
• AES-256 encryption for sensitive data at rest
• Password hashing using industry-standard algorithms
• Regular security audits and penetration testing
• Access controls and role-based permissions
• Two-factor authentication available

7. Third-Party Services

We use the following third-party services:

• Stripe: Payment processing and subscription management
• Email Service: Transactional email delivery
• Analytics: Usage analytics (anonymized)
• Cloud Hosting: Data hosted on secure cloud infrastructure

These providers are GDPR compliant and have data processing agreements in place.

8. Data Sharing

We do not sell your personal data. We only share data when:

• Required by law or legal process
• Necessary to provide our service (e.g., payment processors)
• You explicitly consent
• Protecting safety or preventing fraud

9. Your Account

• Update Information: Change your profile at /Account/Settings
• Export Data: Download a copy of your data at /Account/Settings
• Delete Account: Initiate deletion at /Account/Settings (24-hour grace period)
• Privacy Controls: Manage visibility and sharing in account settings

10. Children's Privacy

ActivityLab is not intended for children under 13. We do not knowingly collect data from children under 13. If we become aware of such data collection, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or prominent notice on our site. Your continued use constitutes acceptance of changes.

12. Contact Us

For privacy questions or to exercise your rights, contact:

• Email: privacy@activitylab.co.uk
• Support: Use the contact form at Account Settings