Privacy
Privacy policy
Last updated: 3 October 2026
This policy explains what personal data SpottAI processes, why, on what legal basis, for how long, with whom, and what your rights are. It covers the SpottAI mobile application and the spottai.app website.
1. Data controller
The data controller is Florian Duboc, sole trader (auto-entrepreneur), registered under SIREN 835 165 101. For any question about your data: contact@spottai.app.
2. Data we process
We limit collection to what is necessary for coaching and for running the service.
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail (sign in by code or with Google) | Create and secure your account | Performance of the contract |
| First name (if provided) | Coach personalization | Performance of the contract |
| Preferred language | Coach and interface language | Performance of the contract |
| Training profile (goal, level, age, optional height and body weight, equipment, preferences, known loads) | Build a suitable program | Performance of the contract |
| Injuries and sensitive areas (health data) | Adapt training to your physical constraints | Contract and explicit consent |
| Pain reported during a session (health data) | Adjust the session in real time | Contract and explicit consent |
| Session history (sets, loads, effort) | Track your progress | Performance of the contract |
| Conversations with the AI coach | Contextual coaching and memory | Contract, and consent if health |
| Device time-zone offset | Give the AI coach dates and times in your local time | Performance of the contract |
| IP address | Security and abuse prevention (rate-limiting) | Legitimate interest |
Technical telemetry of AI calls (account identifier, situation, model, cost, latency) is kept for security and cost control. It contains no conversation content, no prompt and no response.
3. Health data
Declaring an injury or pain is health data within the meaning of Article 9 of the GDPR. We process it in two cases, and only these:
- With your explicit consent (the "health memory" consent, asked before anything is kept): your sensitive areas and injuries (area, status, exercises to avoid) are kept to adapt your next sessions. This consent covers their storage and their transmission to the AI providers required for coaching.
- Without this consent: if you mention a pain or an injury yourself in a message to the coach, that message is sent to our AI provider only to adapt the current session, as you ask. We keep nothing of it, and the app erases it at the latest when it next starts.
You can withdraw this consent at any time from the app settings, as easily as you gave it. Withdrawal erases the health data concerned, without deleting your account.
SpottAI is not a medical device. It provides no diagnosis and does not replace the advice of a health professional.
4. Retention periods
- Account and profile data: as long as your account is active. An account inactive for more than 18 months is purged.
- Health data: as long as the "health memory" consent is valid. Erased upon its withdrawal.
- Conversations with the coach: 90 days, then automatic purge, on our servers and in the app.
- Technical logs of AI calls (no conversation content): 90 days.
- Reports of a coach message (reported message and reason): 180 days, for moderation.
- Login codes and sessions: deleted as soon as they expire.
- Device time-zone offset: not stored. Sent with each coach request and used only to express dates and times in your local time; our AI provider receives only these local dates, never the offset itself.
- IP address: not stored. It is used only transiently, in memory, for rate-limiting and abuse prevention, and is never written to a database (our reverse proxy keeps no access logs).
5. Recipients and processors
We do not sell your data. Our processors below are each bound by a data processing agreement (Article 28 GDPR). Google is an exception: when you sign in with Google, Google acts as an independent controller under its own privacy policy, not as our processor.
| Provider | Role | Location |
|---|---|---|
| OVH | Application server and database | France |
| Scaleway | Sending sign-in e-mails | France |
| OpenAI (contract with OpenAI Ireland Ltd.) | Coach AI models | United States |
| Google sign-in | United States and EU | |
| Cloudflare | Website hosting | United States |
6. Transfers outside the European Union
Your data (database and application server) is hosted in France. Some coach functions rely on an AI provider located in the United States, and Google sign-in involves Google. These transfers are governed by the mechanisms provided for in the GDPR (the adequacy decision known as the "Data Privacy Framework" or standard contractual clauses), and, for health data, by your explicit consent.
7. Artificial intelligence and model training
Coaching relies on language models provided by OpenAI, called directly from our server. By contract (our data processing agreement) and by OpenAI's default policy for its API, the data sent is not used to train any model. Your conversations train no model. We do not include your e-mail or your last name in the messages sent to the models.
8. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time. You can delete your account and withdraw your consent directly in the app. To obtain a copy of your data or exercise your right to portability, email us at contact@spottai.app from your account's e-mail address (so we can verify your identity); we reply within one month.
You may also lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
9. Cookies and trackers
The mobile app contains no analytics or tracking SDK. On the website only, we use cookieless, privacy-friendly audience measurement; any measurement that would require cookies is subject to your prior consent through a banner. The website uses only the cookies strictly necessary for its operation and security.
10. Security
Exchanges are encrypted in transit (HTTPS). Access to your data is isolated per account and enforced by technical controls. Secrets and access keys are never exposed publicly.
11. Minors
SpottAI is intended for an adult audience (18 and over) and is not directed at minors. We do not knowingly collect data about minors.
12. Changes
This policy may change. In case of a material change affecting your health data or a new recipient, your consent will be requested again.
13. Contact
For any question: contact@spottai.app. See also our legal notice.