Privacy
Privacy policy
Last updated: 13 August 2026
This policy explains what personal data SpottAI processes, why, on what legal basis, for how long, with whom, and what your rights are. It covers the SpottAI mobile application and the spottai.app website.
1. Data controller
The data controller is Florian Duboc, sole trader (auto-entrepreneur), registered under SIREN 835 165 101. For any question about your data: contact@spottai.app.
2. Data we process
We limit collection to what is necessary for coaching and for running the service.
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail (sign in by code or with Google) | Create and secure your account | Performance of the contract |
| Preferred language | Coach and interface language | Performance of the contract |
| Training profile (goal, level, equipment, preferences) | Build a suitable program | Performance of the contract |
| Injuries and sensitive areas (health data) | Adapt training to your physical constraints | Contract and explicit consent |
| Pain reported during a session (health data) | Adjust the session in real time | Contract and explicit consent |
| Free-text notes and feedback | Personalized coaching | Contract and explicit consent |
| Session history (sets, loads, effort) | Track your progress | Performance of the contract |
| Conversations with the AI coach | Contextual coaching and memory | Contract, and consent if health |
| Payment token | Manage your subscription | Performance of the contract |
| IP address and technical information | Security and abuse prevention | Legitimate interest |
| Audience measurement | Understand how the service is used | Consent |
Technical telemetry of AI calls (account identifier, situation, model, cost, latency) is kept for security and cost control. It contains no conversation content, no prompt and no response.
3. Health data
Declaring an injury or pain is health data within the meaning of Article 9 of the GDPR. We process this data only on the basis of your explicit consent, collected at the moment of collection (the "health memory" consent). This consent covers both the storage of this data and its transmission to the AI providers required for coaching.
You can withdraw this consent at any time from the app settings, as easily as you gave it. Withdrawal erases the health data concerned, without deleting your account. Without this consent the coach stays usable: it adapts to a pain reported during the current session, but does not keep it from one session to the next.
SpottAI is not a medical device. It provides no diagnosis and does not replace the advice of a health professional.
4. Retention periods
- Account and profile data: as long as your account is active. An account inactive for more than 18 months is purged.
- Health data: as long as the "health memory" consent is valid. Erased upon its withdrawal.
- Conversations with the coach: 90 days, then automatic purge.
- Billing data: 10 years, under accounting obligations.
- IP address and technical logs: 13 months at most.
5. Recipients and processors
We do not sell your data. It is processed by strictly bound providers:
| Provider | Role | Location |
|---|---|---|
| Neon | Database | European Union |
| OVH | Application server | France |
| Scaleway | Sending sign-in e-mails | France |
| OpenRouter, OpenAI, Anthropic | Coach AI models | United States |
| AI model and Google sign-in | United States and EU | |
| Stripe | Payment | United States and EU |
| Cloudflare | Website hosting | United States |
6. Transfers outside the European Union
Your data is hosted in the European Union (database) and in France (server). Some coach functions rely on AI providers located in the United States. These transfers are governed by the mechanisms provided for in the GDPR (the adequacy decision known as the "Data Privacy Framework" or standard contractual clauses), and, for health data, by your explicit consent.
7. Artificial intelligence and model training
Coaching relies on language models. Every server call is configured to forbid reuse of your data for training the models. Your conversations are used to train no model. We do not include your e-mail or your last name in the messages sent to the models.
8. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time. You can exercise these rights from the app (data export and account deletion) or by writing to contact@spottai.app.
You may also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
9. Cookies and trackers
The website uses only the cookies strictly necessary for its operation and security. Any audience measurement is done without cookies, or subject to your prior consent through a banner.
10. Security
Exchanges are encrypted in transit (HTTPS). Access to your data is isolated per account and enforced by technical controls. Secrets and access keys are never exposed publicly.
11. Minors
SpottAI is intended for an adult audience and is not aimed at people under 16. We do not knowingly collect data about minors.
12. Changes
This policy may change. In case of a material change affecting your health data or a new recipient, your consent will be requested again.
13. Contact
For any question: contact@spottai.app. See also our legal notice.