Legal

Privacy Policy

Last updated: 2026-10-13

1. Who we are

Fix My Fit ("we", "us", "our") is operated by Fd Consult BV, a company incorporated in Belgium with registered office at de Tilbourgstraat 19, 1981 Zemst, enterprise number BE 0689.803.127 (RPR Brussel, Nederlandstalige afdeling). Contact: privacy@fixmy.fit.

We are the data controller for personal data processed via fixmy.fit (the "Service"). This policy explains what we collect, why, how long we keep it, and your rights under the GDPR (Regulation (EU) 2016/679) and the Belgian Data Protection Act of 30 July 2018.

2. What we process

Account data

  • Email address and login credentials (or a Google identifier if you sign in with Google).
  • Account metadata: created-at, last login, subscription tier.

Content you upload

  • Cycling videos. Videos may show your face, body, surroundings.
  • Bike configuration data, rider measurements (height, inseam — optional).
  • Annotations, masks, share links you create.

Derived data

  • Pose-estimation keypoints (joint coordinates per frame) and computed joint angles. These keypoints, together with your video, may qualify as biometric data within the meaning of GDPR Art. 4(14) and Art. 9(1) when processed to identify or uniquely characterise a natural person. We do not use them for identification — only for biomechanical analysis you explicitly request.

Technical data

  • IP address, user-agent, request timestamps (server logs, kept 30 days for security/abuse).
  • Error reports when something fails on our servers: the error, the page or API call involved and the app version. They contain no email address, IP address or request contents.
  • Strictly necessary cookies (see Cookie Policy).

Payment data

  • Handled by our payment processor (acting as Merchant of Record). We receive limited billing metadata (subscription status, billing country, order ID). We do not see or store card numbers.

3. Why we process it (purposes & lawful bases)

  • Provide the Service. Account creation, video storage, pose analysis, sharing. Lawful basis: performance of a contract (Art. 6(1)(b)).
  • Process biometric/video data for analysis. Lawful basis: explicit consent (Art. 9(2)(a)) given on upload. You can withdraw consent at any time by deleting the analysis.
  • Billing and subscription management. Lawful basis: performance of a contract + legal obligation (Belgian VAT/accounting law).
  • Security, fraud prevention, abuse handling, fixing errors. Lawful basis: legitimate interest (Art. 6(1)(f)) in protecting the Service.
  • Service emails (transactional). Password reset, billing receipts. Lawful basis: contract.
  • Product improvement (aggregated, non-identifying). Lawful basis: legitimate interest. We do not use your videos to train third-party AI models.

4. Sharing & recipients

Pose detection runs in your browser; we do not send your video to a third-party AI inference service. We share data only with processors that help us run the Service:

  • A cloud hosting and object-storage provider, for the database and uploaded videos.
  • A payment processor acting as Merchant of Record, for billing and VAT.
  • A sign-in provider, only when you choose to sign in with Google.
  • An email delivery provider, for verification, password-reset and account emails.
  • An error-monitoring provider, for the error reports described above, stored in the EU.

Each processor is bound by a Data Processing Agreement under GDPR Art. 28. The current names of these processors are available on request to privacy@fixmy.fit.

Share links. When you create a share link, anyone holding the link can view that one analysis, with the height and inseam its fit recommendations are based on. You can revoke the link at any time.

We do not sell personal data and we do not share it with advertisers.

5. International transfers

Primary storage and compute are located in the EU. Where a processor is headquartered outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c)) together with encryption in transit and at rest.

6. Retention

  • Videos & analyses: until you delete them. Automatically deleted 30 days after account closure.
  • Account data (email, hashed password, profile): for the lifetime of the account; deleted within 30 days of closure.
  • Billing records (invoices, payment metadata): 7 years (Belgian accounting and VAT law — Art. 60 §4 VAT Code, Art. III.86 Code of Economic Law).
  • Withdrawal-right consent records: 7 years alongside billing records, as proof of compliant sale.
  • Server logs (IP, user-agent, request timestamps): 30 days, then deleted or anonymised.
  • Error reports: up to 90 days, then deleted by the error-monitoring provider.
  • Backups: rolling 30 days. Deleted content is purged from backups within 30 days of deletion.

7. Your rights

Under GDPR you have the right to:

  • Access your data (Art. 15).
  • Rectify inaccurate data (Art. 16).
  • Erase your data ("right to be forgotten") (Art. 17).
  • Restrict or object to processing (Art. 18, 21).
  • Data portability (Art. 20).
  • Withdraw consent at any time (Art. 7(3)) without affecting prior lawful processing.
  • Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be.

To exercise any of these, email privacy@fixmy.fit. We respond within 30 days (extendable by 60 days for complex requests, Art. 12(3)).

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, and audit logging. No system is perfectly secure; we will notify you and the supervisory authority of a personal data breach within 72 hours where required (Art. 33–34).

9. Children

The Service is not directed at children under 16. Belgium applies the GDPR default age of 13 for information-society services with parental consent below that age — but we do not market to or knowingly process data of users under 16. If you believe a child has registered, contact us and we will delete the account.

10. Automated decision-making

We do not perform automated decision-making with legal or similarly significant effects on you (Art. 22). Joint-angle measurements are tools you interpret yourself — we do not score, diagnose, or recommend on your behalf.

11. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app at least 14 days before they take effect. The "Last updated" date at the top reflects the current version.

12. Contact

Privacy questions: privacy@fixmy.fit.
General contact: support@fixmy.fit.
Postal: [Company name], [Street, postcode, city], Belgium.