This Privacy Policy for Ambymon OÜ (doing business as Aizy — "we", "us", or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://aizy.fit, or any website of ours that links to this Privacy Policy;
- Download and use our mobile application (Aizy), or any other application of ours that links to this Privacy Policy;
- Use Aizy — an AI fitness coaching app that creates personalised workout and meal plans, guides you through training sessions with a voice coach, and adapts to your heart rate, your training history, and any injuries, allergies, or medical conditions you choose to share with it;
- Engage with us in other related ways.
Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at [email protected].
Summary of key points
- What personal information do we process? We process the information you provide when you register, use the app, and interact with the AI coach — including your name, email, workout logs, and messages to the coach.
- Do we process sensitive information? Yes. We process health data (such as heart rate during workouts, and any injuries, allergies, or medical conditions you choose to share) and any sensitive information you volunteer in free-text chat, only with your consent or as permitted by law.
- Do we collect information from third parties? No. We do not collect any information from third parties.
- How do we process your information? To provide and improve the Services, communicate with you, protect the Services, and comply with law. We process your information only when we have a valid legal reason to do so.
- With whom do we share information? Only with the service providers who help us run the Services (our AI, hosting, storage, and email providers), listed in full in Section 4.
- Do we sell your information? No. We do not sell or share your personal information for advertising, and we do not use your data — including your health data — to train AI models. See Section 15.
- How do you exercise your rights? The easiest way is to visit aizy.fit/support or contact us at [email protected].
Table of contents
- What information do we collect?
- How do we process your information?
- What legal bases do we rely on?
- When and with whom do we share your information?
- Do we use cookies and other tracking technologies?
- Do we offer artificial intelligence-based products?
- How do we handle your social logins?
- Is your information transferred internationally?
- How long do we keep your information?
- How do we keep your information safe?
- Do we collect information from minors?
- What are your privacy rights?
- Controls for do-not-track features
- Do United States residents have specific rights?
- AI processing and model training
- Do we make updates to this policy?
- How can you contact us?
- How can you review, update, or delete your data?
1. What information do we collect?
Personal information you disclose to us
We collect personal information that you voluntarily provide when you register on the Services, use the app, or otherwise contact us. This may include:
- names;
- email addresses;
- passwords;
- contact or authentication data;
- chat messages you send to the AI coach;
- workout logs (exercises, weights lifted, reps, and perceived exertion);
- coaching preferences (trainer persona, coaching style, language, and units).
Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:
- health data — including your heart rate during workouts and any injuries, allergies, or medical conditions you choose to tell the coach about;
- sensitive information you choose to volunteer in free-text chat with the AI coach (for example, dietary restrictions that may reveal religious or philosophical beliefs).
Social media login data. We offer you the option to register using your existing Google account (Google Sign-In). If you choose to register this way, we receive basic profile information — your name and email address — from Google, as described in Section 7.
Application data. If you use our mobile app, we may collect the following if you grant permission:
- Mobile device access. We may request access to your device's Bluetooth (to connect to a heart-rate sensor such as a chest strap) and to Apple Health / Android Health Connect (to read your heart rate during a workout and to save your completed workout back to the health app). You can change these permissions in your device settings at any time.
Information automatically collected
Like most online services, our servers automatically collect certain technical information in log files when you access the Services. This log and usage data may include your IP address, device and browser characteristics, operating system, language preferences, the pages or features you use, and timestamps. We use it to keep the Services secure and operational, to troubleshoot, and to diagnose problems. We do not use analytics or advertising tracking.
2. How do we process your information?
- To create and manage your account so you can log in and use the Services.
- To deliver the Services — generating your workout and meal plans, running your training sessions, and adapting your coaching.
- To respond to your inquiries and provide support.
- To send you administrative information — such as account confirmation, password resets, and changes to our terms or policies.
- To protect the Services — including keeping them secure and preventing fraud and abuse.
- To protect an individual's vital interests — for example, to help prevent harm.
3. What legal bases do we rely on?
If you are in the EU or UK, the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on. These are:
- Consent — where you have given us permission to process your information for a specific purpose (including your explicit consent to process your health data). You can withdraw your consent at any time.
- Performance of a contract — to provide the Services you have signed up for.
- Legitimate interests — to diagnose problems, keep the Services secure, and prevent fraud, where those interests are not overridden by your rights.
- Legal obligations — where processing is necessary to comply with the law.
- Vital interests — where processing is necessary to protect someone's life or safety.
If you are in Canada, we process your information with your express or implied consent, except in the limited cases permitted or required by law.
4. When and with whom do we share your information?
We do not sell your personal information and we do not share it for advertising. We share it with the following categories of third-party service providers ("sub-processors"), each of which is bound by a data processing agreement:
- Google (Google Cloud / Vertex AI) — powers the Aizy AI coach. Your inputs and outputs, including any health information you share, are processed here to generate your coaching. Google is contractually prohibited from using this data to train its models (see Section 15).
- Amazon Web Services (AWS) — hosts our application and database, and stores our configuration and secrets. Our servers are located in the United States.
- Cloudflare — provides our content delivery network and edge security, and (via Cloudflare R2) stores media such as the coach's audio and workout content.
- Resend — sends our transactional email (account confirmation, password reset, and similar). We do not send marketing email.
We may also share your information in connection with a business transfer — for example, a merger, financing, or acquisition of all or part of our business.
5. Do we use cookies and other tracking technologies?
Our website and app rely on a small number of strictly necessary cookies and similar technologies to keep the Services secure and functioning — for example, to maintain your session, secure our infrastructure, and support basic site functions provided by our content delivery network (Cloudflare).
We do not use cookies or tracking technologies for analytics, advertising, profiling, or to track you across other websites, and we do not permit third parties to do so on our Services. Because these cookies are strictly necessary to deliver the Services you request, they do not require your consent under EU/UK ePrivacy rules. Most browsers let you remove or reject cookies; doing so may affect some features of the Services.
6. Do we offer artificial intelligence-based products?
As part of the Services, we offer features powered by artificial intelligence and machine learning ("AI Products"). We provide these through a third-party AI service provider, Google Cloud AI (Vertex AI). Your input, output, and related personal information are shared with and processed by this provider so that we can deliver your coaching.
Our AI Products provide the following functions:
- natural language processing (understanding and responding to your messages);
- an AI coaching assistant (conversational bots).
How to opt out. Because AI-based coaching is central to the Services, you cannot use Aizy without it. To stop this processing, you can discontinue use of the AI coaching features or delete your account. You can also contact us at [email protected]. See also Section 15 on model training.
7. How do we handle your social logins?
Our Services let you register and log in using Google Sign-In. When you do, we receive basic profile information from Google — typically your name and email address. We use it only for the purposes described in this Privacy Policy. We do not control, and are not responsible for, other uses of your information by Google; we recommend you review Google's privacy notice to understand how it processes your data.
8. Is your information transferred internationally?
We are established in Estonia, but our servers are located in the United States, and some of the providers with whom we share information (see Section 4) are located in the United States and other countries. If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, these countries may not have data-protection laws as comprehensive as those in your country.
Where we transfer personal information out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK equivalent) with our providers, to ensure your information receives an equivalent level of protection. A copy of these safeguards can be provided on request.
9. How long do we keep your information?
We keep your personal information only for as long as necessary to provide the Services — no longer than the period during which you have an account with us — unless a longer retention period is required or permitted by law (such as for tax or accounting). When we no longer need your information, we delete it, or securely isolate it from further processing where deletion is not immediately possible (for example, in backups that roll off on their normal cycle).
10. How do we keep your information safe?
We have implemented appropriate technical and organisational measures designed to protect your personal information, including encryption in transit (TLS) and hashing of credentials. However, no method of transmission or storage is completely secure, so we cannot guarantee absolute security. You should access the Services within a secure environment.
11. Do we collect information from minors?
We do not knowingly collect, solicit, or market to children under 18 years of age (or the equivalent age of majority in your jurisdiction). By using the Services, you represent that you are at least 18. If we learn that we have collected personal information from a user under 18, we will deactivate the account and delete the data. If you believe we may have collected such information, contact us at [email protected].
12. What are your privacy rights?
In some regions (including the EEA, UK, Switzerland, and Canada) you have rights under applicable data-protection law. These may include the right to: (i) request access to and a copy of your personal information; (ii) request correction or erasure; (iii) restrict processing; (iv) data portability; and (v) not be subject to solely automated decision-making that produces legal or similarly significant effects. You may also object to processing in certain circumstances. To exercise these rights, contact us at [email protected] or visit aizy.fit/support.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time by contacting us. This does not affect the lawfulness of processing before withdrawal.
Complaints. If you are in the EEA or UK and believe we are processing your information unlawfully, you have the right to complain to your local data-protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk/make-a-complaint). In Switzerland, the Federal Data Protection and Information Commissioner.
Account information. You can review or change your account information in the app, and you can request that we delete your account and associated data at aizy.fit/delete-account. On deletion we remove your account and associated data from our active systems, except where we must retain limited information to comply with legal obligations or resolve disputes.
13. Controls for do-not-track features
Most browsers and some operating systems offer a Do-Not-Track ("DNT") setting. No uniform standard for recognising DNT signals has been finalised, so we do not currently respond to them. If a standard is adopted, we will update this policy.
14. Do United States residents have specific privacy rights?
The table below shows the categories of personal information we have collected in the past twelve months.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, account name, unique and online identifiers, IP address | YES |
| B. Personal information (California Customer Records) | Name, contact information, and medical information you provide | YES |
| C. Protected classification characteristics | Gender, age, race, national origin | NO |
| D. Commercial information | Transaction and purchase history, payment information | NO |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other network activity | Log and usage data, interactions with the Services | YES |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory information | Recordings created with our Services | NO |
| I. Professional or employment information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences drawn to create a profile | Inferred preferences or characteristics | NO |
| L. Sensitive personal information | Account login information and health data | YES |
We collect sensitive personal information only as permitted by law or with your consent, and we use it only to provide the Services. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not sell or share personal information for targeted advertising.
In the preceding twelve months we have not sold or shared any personal information. We have disclosed the following categories to service providers for a business purpose: Category A (Identifiers), Category B (California Customer Records), and Category F (Internet activity). The categories of third parties are listed in Section 4.
Your rights under US state laws may include the right to know whether we process your data, to access and correct it, to delete it, to obtain a copy, to opt out of sale/share/targeted advertising and certain profiling, and to non-discrimination for exercising your rights. To exercise these rights, visit aizy.fit/support or email [email protected]. You may use an authorised agent. We will verify your identity before acting on your request.
Appeals. If we decline to act on your request, you may appeal by emailing [email protected]. If your appeal is denied, you may contact your state attorney general.
California "Shine the Light". California residents may request, once a year and free of charge, information about the personal information (if any) we disclosed to third parties for their direct marketing purposes. We do not disclose personal information for third-party direct marketing.
15. AI processing and model training
The Aizy AI coach is powered by Google's Gemini models, accessed through Google Cloud's Vertex AI. When we send your information — including any health information you choose to share, such as your heart rate, training history, injuries, or medical conditions — to this service to generate your coaching, it is processed under Google Cloud's enterprise terms, which do not permit Google to use your data to train or improve its generative AI models. We also do not use your personal information or health information to train any artificial intelligence models of our own. We do not sell your personal information.
16. Do we make updates to this policy?
We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last updated" date at the top. If we make material changes, we will notify you by posting a prominent notice or by contacting you directly. We encourage you to review it periodically.
17. How can you contact us?
If you have questions or comments about this policy, email us at [email protected] or write to us at:
18. How can you review, update, or delete your data?
Depending on the laws of your country or US state, you may have the right to request access to the personal information we hold about you, to correct it, or to delete it, and to withdraw your consent. To make a request, visit aizy.fit/support. To delete your account, visit aizy.fit/delete-account.