Last updated: September 2026
Viraly Marketing Management, United Arab Emirates, is the controller of personal data processed through fitatspeed.com. Privacy contact: mx235797@gmail.com.
Account data (email, display name, password hash held by our authentication provider); purchase data (order, product, amount, currency, status, payment provider customer and session identifiers — we never receive or store full card numbers); program data you enter voluntarily such as goal, sex, age, height, weight, measurements, body-fat estimates, dietary style, allergies, workout and food logs, check-ins and coach messages; legal records (the documents you sign, with timestamp, IP address, browser string and document hash); and technical data such as device, browser, approximate location derived from IP, and usage events.
To perform our contract with you: create your account, deliver purchased programs, generate plans, run coaching features, provide support. For our legitimate interests: security, fraud and refund-abuse prevention, service improvement, aggregated analytics, defending legal claims. To comply with legal obligations: accounting, tax and dispute records. With your consent: optional marketing emails and the health-related data you voluntarily submit. You can withdraw consent at any time, without affecting processing already carried out.
Weight, measurements, body-fat estimates, food logs and check-ins are provided by you voluntarily and used solely to generate general fitness content and show your progress. We do not use them for any medical purpose, do not sell them, and do not share them for advertising. You can delete them or request account deletion from your account page at any time.
We use carefully selected providers acting on our instructions: hosting and application platform; database and authentication provider; payment processing (Stripe) for checkout, billing portal, receipts and dispute handling; transactional email delivery (Resend); AI model providers used to generate program and coaching content, which receive only the context needed to produce a reply and are not permitted to use it to train models; and product analytics. We do not sell personal data and do not share it with data brokers.
We operate from the United Arab Emirates and our providers may process data in other countries, including the EEA, the UK and the United States. Where required we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision. By using the service you understand your data may be transferred outside your country of residence.
Account and program data are kept while your account exists and for up to 24 months after closure to handle disputes, then deleted or anonymised. Purchase, tax and signed-agreement records are retained for the period required by applicable law and for the duration of any limitation period for legal claims. Aggregated, non-identifying statistics may be kept indefinitely.
Subject to applicable law you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests, and you may withdraw consent or unsubscribe from marketing at any time. Submit a request from your account page or by email to mx235797@gmail.com; we may need to verify your identity and will reply within 30 days. If you believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority.
We use encryption in transit, row-level access controls scoped to your user account, least-privilege service credentials, hashed passwords managed by our authentication provider, and restricted administrative access. No online service can be guaranteed absolutely secure; you are responsible for keeping your password confidential and for the security of your own devices.
We use strictly necessary cookies and local storage for authentication, session persistence and security, plus limited analytics to understand which pages convert. See our Cookie Policy for details and how to control them in your browser.
The service is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy; the current version is always published on this page with its date. Material changes will be communicated by email or in-app notice where required.
Legal bases are set out in section 3. You have the rights listed in section 8, including the right to lodge a complaint with your national data protection authority (or the UK ICO). We do not carry out solely automated decision-making producing legal effects; plan generation is content creation, not a decision about you. Our EU/UK-facing requests are handled directly by mx235797@gmail.com. Transfers out of the EEA/UK rely on standard contractual clauses or the UK addendum with our processors.
In the last 12 months we collected the categories described in section 2: identifiers, commercial information, internet activity, approximate geolocation, and health/fitness information you voluntarily provide (which we treat as sensitive personal information used only to provide the service you requested). We do not sell personal information and do not share it for cross-context behavioural advertising. You may request to know, delete, or correct your information, and to limit the use of sensitive personal information, by emailing mx235797@gmail.com or using your account page. We will not discriminate against you for exercising these rights. You may use an authorised agent; we may verify their authority. Other US state residents (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and similar) have equivalent access, correction, deletion, portability and opt-out rights, plus an appeal right if we deny a request.
We collect, use and disclose personal information only for the purposes identified above, with your knowledge and consent, and retain it only as long as necessary. Our privacy officer can be reached at mx235797@gmail.com. Personal information may be processed outside Canada, including in the United States and the EEA, and may therefore be accessible to courts and authorities of those jurisdictions. Quebec residents may request the transfer of computerised personal information they provided to us, and may lodge a complaint with the Commission d'accès à l'information; other residents may complain to the Office of the Privacy Commissioner of Canada.
We handle personal information in accordance with the Australian Privacy Principles. We collect only what is reasonably necessary for our functions, do not use government identifiers, and take reasonable steps to keep information accurate and secure. Overseas recipients are described in section 5, principally in the United States and the EEA. You may request access or correction, or complain about a breach of the APPs, by writing to mx235797@gmail.com; we will respond within 30 days, and if you are not satisfied you may escalate to the Office of the Australian Information Commissioner. Eligible data breaches will be notified in line with the Notifiable Data Breaches scheme.
Transactional messages (access links, receipts, renewal reminders, security notices) are part of the service and are sent for as long as you hold an account or an active purchase. Marketing messages are sent only where permitted, always identify us, and can be stopped from the unsubscribe link in any such email or by replying to ask us to stop.