Privacy policy

Moveat (wemoveat.app) is published by Metropole Inv. SRL, a company registered in Belgium under company and VAT number 0633.543.622, with its registered office at Avenue Charles Woeste 119, 1090 Brussels, Belgium. Metropole Inv. SRL also trades under the name Pixel Noir.

For any question about this policy or about your data, write to contact@wemoveat.app. We answer at that address.

Moveat is used by two kinds of people, and the law does not treat them the same way. Read this section first: everything else follows from it.

For the coach account itself (email address, name, login, subscription and billing), Metropole Inv. SRL is the controller. We decide what is collected and why, and you deal directly with us.

For everything a coach records about a client (questionnaire, check ins, weight, measurements, photos, diet, training programme, messages), the coach is the controller and Metropole Inv. SRL is a processor within the meaning of article 28 of the GDPR. The coach decides which clients to invite, what to ask them and what to write. We only store and display that data on the coach's behalf. We never use it for our own purposes.

In practice: if you are a client and you want to see, correct or delete your data, ask your coach first. If your coach does not answer, write to us and we will help.

Body photos, weight, body measurements, injuries, allergies and how a client feels are health data. Article 9 of the GDPR treats them as a special category and forbids processing them unless a specific condition applies.

The condition we rely on is the explicit consent of the client, under article 9.2.a of the GDPR. That consent is given to the coach, not to us.

This is the coach's responsibility, and it is not a formality. Before inviting a client, the coach must clearly tell that client which data will be collected, including the three body photos, and obtain a free, specific, informed and explicit consent. The coach must be able to prove that consent, and must allow the client to withdraw it at any time. A coach who invites a client without that consent is in breach of the GDPR and of our terms.

A client may refuse the photos and still be tracked on weight and measurements. Consent can be withdrawn at any time, which stops any further processing and, on request, leads to erasure.

We collect only what is needed to open and run the account.

• Identification: email address and name, plus a password stored as a cryptographic hash by Supabase Auth. We never see the password itself.
• Subscription: plan (free or paid), status, start and end of the current period, and the customer and subscription identifiers issued by Stripe.
• Payment: the payment is made on Stripe. We never receive and never store card numbers.
• Technical logs: connection and error logs needed to keep the service running and secure.
• How you use Moveat: whether it is opened as an installed app or in the browser, and on a phone or a computer. Nothing else about the device, no model and no address. It tells us whether installing the app is understood.
• Where you came from: the channel that brought you to Moveat before you created your account (for example “google-ads” or “tiktok/bio”) and, if you came from a Google ad, the keyword of that ad. Never the click identifier, never your browsing history.
• Demo videos: the links to your own videos (YouTube, Vimeo, Instagram or TikTok) that you attach to an exercise. We store the link, never the video, which stays with the host you chose.

This data is entered by the client or by the coach. The coach is the controller. We list it in full so that nobody is surprised.

• Identity: first name, last name, email address used for the invitation.
• Questionnaire: age, sex, height, current weight, goal, activity level, experience, number of training days, food preferences, number of meals, allergies, disliked foods, injuries, free notes.
• Check ins: date, weight, body measurements, fatigue, stress, motivation, sleep, adherence to the diet and to the training, free comments.
• Photos: up to three body photos per check in (front, side, back).
• Coaching: the diet, the macros and the training programme written by the coach.
• Messages exchanged between the coach and the client inside the application.
• Push subscription, only if the person turned notifications on.

Each purpose has one basis, and only one.

• Running the coach account and giving access to the application: performance of the contract, article 6.1.b.
• Charging the subscription and issuing invoices: performance of the contract, article 6.1.b, and legal obligation for accounting records, article 6.1.c.
• Storing and displaying the client's check ins, photos, diet and programme: on the coach's instructions, on the basis of the explicit consent the coach obtained from the client, article 9.2.a.
• Keeping the service secure, preventing abuse, fixing bugs: legitimate interest, article 6.1.f.
• Knowing which channels bring new accounts, to decide where to spend our advertising budget: legitimate interest, article 6.1.f.
• Announcing a new Moveat option to coaches by email, one email per option, which can be turned off in one click from the email or the settings: legitimate interest, article 6.1.f.
• Sending push notifications: consent, given by turning them on.

Photos are the most sensitive thing in this application, and they are treated as such.

They live in a private storage bucket. There is no public URL. They are not indexed by search engines and they cannot be found by guessing an address.

When a coach or a client opens a photo, the server issues a signed link that works for a short time and then stops working. Nobody else can open that link once it has expired.

Only the client who uploaded the photo and the coach who invited that client can see it. No other coach and no other client can, because every database read is filtered by row level security rules that check who is asking.

We do not use photos to train any model. We do not publish them. We do not show them to anyone outside the coach and the client.

We use four service providers, and only four. They are our subprocessors within the meaning of article 28.4 of the GDPR, and they act only for the purposes below.

• Supabase: database, authentication and photo storage. The data is hosted in the Frankfurt region, in Germany, inside the European Union.
• Vercel: hosting, delivery of the application and cookieless audience measurement (aggregated page-view counting, with no visitor identification). Vercel Inc. is a US company, but the application's functions are configured to run in the Frankfurt (EU) region. Any transfer to the United States is framed by the Standard Contractual Clauses and the EU-US Data Privacy Framework, to which Vercel adheres.
• Stripe: payment and subscription management, Stripe Payments Europe, Limited, established in Ireland, inside the European Union.
• Infomaniak: sending of service emails, such as a client invitation or a check-in reminder. Infomaniak is established in Switzerland, a country recognised by the European Commission as offering an adequate level of protection. Only the recipient address and the content of the message pass through it. No photo, no measurement, no health data is ever sent by email.

Moveat can be connected to an AI assistant such as ChatGPT, so that you can ask questions about your own clients instead of retyping their numbers. This connection does not exist unless you create it. It is off by default, no client data leaves Moveat because of it, and a coach who never connects anything is not concerned by this section.

The distinction matters, and it is why the four providers above are still four. When you connect ChatGPT, you are connecting YOUR OWN account with that provider. You choose the recipient, you accept its terms, and it is not our subprocessor: we do not decide what it does with what it receives, and we have no contract with it on your behalf. What we do is send it, on your instruction, the data you authorised on the consent screen.

That screen lists, before you approve anything, exactly what will be read, what can be written and what is never touched. It is worth reading rather than clicking through.

• What is sent when the assistant asks for it: your clients' first names, their goal and check-in schedule, their check-ins (weight, measurements, how they felt, what they wrote), the diets and programmes you have written, and their history.
• What is never sent, under any circumstance: body photos, not even a preview, email addresses, last names, phone numbers, and your private coach notes.
• What it can write: diet and programme DRAFTS, in your editor only. Nothing reaches your client until you review and publish it yourself. It cannot publish, cannot delete, and cannot write a single calorie, because macros always come from the Moveat database.
• Where it goes: the assistant you connect may process this data outside the European Union, under the terms of the account you connected. This is the one case where data can leave the EU on your instruction, and it is your decision, taken account by account.
• How to stop it: the access expires on its own after 90 days, and you can revoke it at any time from your settings, under Connected apps. Revoking it takes effect immediately.
• Because your clients did not choose this, it is on you as the controller to tell them if you turn it on. We give you the facts above so that you can.

A coach can attach to an exercise the link of one of their videos, published on YouTube, Vimeo, Instagram or TikTok. Their client then sees a “Watch the demo” button under that exercise.

As long as the client does not press this button, nothing loads: no request goes to the video host, and none of its cookies or trackers are set. This action, and only this action, loads the player.

When the client presses it, the host's player opens inside Moveat. As with any video watched online, the host then receives the IP address and technical information about the device, and may set its own cookies under its own policy: Google for YouTube, Vimeo, Meta for Instagram, TikTok. For YouTube we use its privacy enhanced player (youtube-nocookie.com), and for Vimeo the “do not track” mode.

These hosts are not our sub-processors, which is why the four providers listed above are still four. The coach chooses where they publish their videos, and no Moveat data is sent to them: no name, no check-in, no photo, nothing from the account. They only receive what any website receives when you watch one of its videos.

A client who prefers not to load these players simply does not press the button: the rest of their program works exactly the same.

The database, the authentication service and the photo bucket are hosted in the Frankfurt region, in Germany, inside the European Union.

Your data is stored and processed in the European Union: Supabase and the application's functions both run in the Frankfurt region. Our hosting provider Vercel Inc. is a US company, so a transfer to the United States cannot be entirely excluded; where it happens, it is governed by the Standard Contractual Clauses and the EU-US Data Privacy Framework.

We do not sell data, we do not rent it, and we do not share it with advertisers. There is no advertising in Moveat.

For client data, these commitments form the processing agreement between the coach, as controller, and Metropole Inv. SRL, as processor, under article 28 of the GDPR. Accepting the terms of use makes them binding on both sides.

• We process client data only on the documented instructions of the coach. Using the application is the instruction. We do not use client data for our own purposes, ever.
• Everyone with access to the data is bound by confidentiality.
• We apply appropriate technical and organisational security measures, as required by article 32.
• We use only the subprocessors listed above. If we add one, we tell coaches before it starts processing, and a coach who objects may terminate the subscription without penalty.
• We help the coach answer requests from clients who exercise their rights, and we help the coach comply with articles 32 to 36, in particular in the event of a personal data breach.
• We notify the coach without undue delay if we become aware of a personal data breach affecting client data.
• When the contract ends, we delete the client data as described under retention. We keep no copy beyond what the law requires of us.
• We make available the information needed to demonstrate compliance with article 28, and we allow audits carried out by the coach or by an auditor the coach appoints, within a reasonable scope and frequency.

We do not keep data because it might be useful one day.

• Active account: the data stays as long as the account exists.
• Deleted account: everything is erased within 30 days of the deletion request.
• Coach account left empty: an account with no client and no sign in for 30 days is erased. The coach is warned by email 7 days before, and signing in once is enough to keep it.
• Inactive coach account: a free account with clients, where the coach has not signed in for 3 months, is closed with everything it holds (its clients, their check-ins, photos, diets and programs). The coach is warned by email 30 days before, and signing in once is enough to keep it. A paying account is never affected.
• Deleted client: the client first goes to the coach's trash, where the record stays for 30 days and can be restored. After that, or if the coach asks for immediate deletion, the check ins, the diet, the messages and the photos are erased with the client, with no way back.
• Photos: they never outlive the client record they belong to.
• Where you came from: 30 days at most in your browser. Once attached to your account, it is kept as long as the account.
• Demo video links: kept until the coach removes them or deletes their account.
• Billing records: kept for 7 years, because Belgian accounting law requires it. This retention cannot be waived.

The measures below are the ones actually in place. We do not claim any certification we do not hold, and Moveat does not use end to end encryption.

• All traffic between your device and Moveat travels over HTTPS.
• Passwords are never stored in clear text. They are hashed by Supabase Auth.
• Data at rest is encrypted by the Supabase infrastructure.
• Row level security rules isolate every coach and every client at the database level. A coach cannot read another coach's clients even if a bug reaches the database.
• Photos sit in a private bucket, served only through short lived signed links.
• Every write goes through a server route that validates the input and checks who is asking. The browser never writes to the database directly.
• API routes are rate limited to slow down abuse.

Moveat uses only essential cookies. There are two of them.

The first is the authentication session cookie set by Supabase, which keeps you logged in. Without it, the application cannot know who you are.

The second stores your language preference, so the interface opens in the right language.

There is no analytics cookie, no advertising cookie and no third party tracker. Our audience measurement, provided by Vercel, works without cookies: it counts page views in aggregate, without identifying you.

One piece of information is kept in your browser (local storage, not a cookie): if you arrive on the site through an ad or a tagged link, we remember that channel and, for a Google ad, its keyword, for 30 days at most. It only leaves your device if you create an account, to be attached to it. It is for us alone, it is never sent to any advertiser, and you can erase it by clearing this site's data in your browser.

One exception, and it depends on your action: if you press “Watch the demo” under an exercise, the video player of the host chosen by your coach loads and may set its own cookies. Nothing loads before that. See the section on demo videos.

That is why Moveat shows no cookie banner: there is no advertising cookie and no third party tracker to accept, and the only third party player loads only when you ask for it.

Push notifications are optional and turned off by default. Nothing is sent unless you explicitly turn them on and your browser or phone asks you to confirm.

If you turn them on, we store the subscription your browser gives us, which identifies the device to notify. It is used only to send Moveat notifications, for example when a check in arrives or a diet is updated.

You can turn notifications off at any time, in the application or in the settings of your browser or phone.

Under the GDPR you have the following rights. They are free to exercise, and we answer within one month.

• Access: obtain a copy of the data we hold about you.
• Rectification: correct data that is wrong or out of date.
• Erasure: have your data deleted, subject to our legal duty to keep billing records.
• Restriction: ask us to freeze processing while a point is being settled.
• Portability: receive your data in a structured, commonly used, machine readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw your consent at any time, without affecting what was lawfully done before you withdrew it.

If you are a coach, write to contact@wemoveat.app. We are the controller for your account, so we handle your request ourselves.

If you are a client, your coach is the controller. Ask your coach, who has the tools to correct or delete your data inside the application. If the coach does not answer, or refuses without a reason, write to contact@wemoveat.app and we will act to make the right effective.

We may ask for a reasonable proof of identity before acting, so that nobody else can obtain or delete your data in your name.

If you believe your data is being handled unlawfully, you can lodge a complaint with the Belgian supervisory authority: Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, Belgium. Its website is autoriteprotectiondonnees.be.

You can also lodge a complaint with the supervisory authority of the country where you live.

We would rather hear from you first. Write to contact@wemoveat.app and we will try to settle the matter.

If we change this policy in a way that matters, for example by adding a subprocessor or a new purpose, we inform coaches by email before the change takes effect.

The date at the top of this page always shows the current version.