Privacy Policy

ritme ("ritme") is the controller of the data of trainers who create an account and of visitors of this website.

For the data about clients that each personal trainer enters in ritme (names, contacts, schedules, workouts, payments), the trainer is the controller and ritme acts as a processor on the trainer's behalf, following the trainer's instructions. If you are a client of a trainer who uses ritme, your trainer is your first point of contact for your rights.

Depending on how you use ritme:

• Trainer account: name, email, password (stored only in hashed form by our authentication provider), phone, country, photo, short bio, languages, business details, optional tax identification, address, and professional credential documents you choose to upload.
• Clients (entered by the trainer): name, email, phone, optional birth date, goals and notes, group memberships, schedule, assigned workouts and loads, plans, charges and payment status.
• Payments: card and bank details never reach ritme. They are handled by the payment provider the trainer connects (Stripe, or Asaas in Brazil). ritme stores payment records (amount, date, status, method) and the provider connection key, which is stored encrypted.
• Messages: the email address and content of messages you send us.
• Technical data: session cookies, language and theme preferences, and server logs (such as IP address and browser type) kept by our hosting provider for security and operation.

The current version of ritme is not designed to collect health data. Please do not enter health information in free-text fields (notes, goals). If a trainer needs to record such data, they must first make sure they have a valid legal basis and the client's explicit consent, and they are responsible for it.

• To provide the service you asked for: accounts, schedule, workouts, charges, reminders and notices (performance of a contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interest).
• To answer your messages and contact you about ritme (consent or legitimate interest, and you can opt out at any time).
• To comply with legal obligations, such as accounting and tax records (legal obligation).

We use providers that process data on our behalf, under contracts that require them to protect it:

• Hosting and delivery: Vercel.
• Database, authentication and file storage: Supabase.
• Payments: Stripe, and Asaas for accounts in Brazil. They act on behalf of the trainer, under their own terms.
• Email delivery: an email service provider (Resend) for reminders, payment links and notices.
• Address search: when a trainer searches for a place, the search text is sent to Google Places or OpenStreetMap.

We do not sell personal data and we do not use it for advertising.

Some providers may process data outside your country or outside the European Economic Area. When this happens we rely on safeguards recognised by law, such as the European Commission's standard contractual clauses.

We keep data while the account is active. When an account is deleted, we remove its data within a reasonable period, except what we must keep by law (for example accounting records). Backups are overwritten in regular cycles. Trainers decide how long to keep their clients' data and can archive or delete it in the panel.

We apply measures that fit the risk, including encrypted connections, separation of each trainer's data from all others, encryption of payment provider keys, verification of the signature of payment notifications, and restricted access to production systems. No system is perfectly secure, and we will notify you of relevant incidents as required by law.

You may ask for access, correction, deletion, restriction, portability and objection, and withdraw consent when processing is based on it. To exercise a right regarding data a trainer entered about you, contact your trainer first; we will help them respond. For anything else, write to us. You may also complain to your data protection authority, for example the CNPD (Luxembourg or Portugal), the CNIL (France) or the ANPD (Brazil).

We use only what is strictly necessary: a session cookie to keep you signed in, and local storage for preferences such as language and light or dark mode. We do not use advertising or analytics trackers.

ritme is aimed at professionals. If a trainer works with minors, the trainer is responsible for obtaining the authorisation of parents or guardians required by law.

We may update this policy. When the changes are relevant, we will tell you by email or in the product before they take effect. The date at the top shows the latest version.

Questions or requests about privacy: privacy@ritme.me.