Privacy Policy
Last updated: 24 September 2026(version 2026-09-24)
Health-related answers — read this first
The quiz asks about your weight, body goals, joint or back discomfort, energy and sleep. Some of that counts as data concerning health, which the GDPR treats as a special category (Article 9).
We process it only with your explicit consent, given when you choose to answer, and only to build and adapt your programme. We never use it for advertising, and we never sell it. You can withdraw consent at any time by deleting your account or emailing us — withdrawal does not affect processing already carried out.
What we collect
- Identity & contact
- First name, email address
- Quiz answers
- Goals, activity level, height, current and target weight, age, and the wellbeing questions you choose to answer
- Programme data
- Completed workouts, weight logs, daily check-ins (mood, water, steps and an optional note), achievements, reminder time, and your time zone, language and units
- Purchase data
- Plan, price, currency, country, subscription status, Stripe customer and subscription identifiers
- Technical data
- IP address (used to determine country and currency, and by Stripe for tax), device and browser information
- Acceptance records
- Each time you accept our Terms, Subscription Policy, Money-Back Policy or this Privacy Policy: the date and time, the exact wording you were shown, the version of each document, the page, your IP address and your browser's user-agent string
- Product analytics
- Which screens you reach and in what order, and how far you get through the sign-up flow, together with a session recording of that flow. Typed input is masked and never recorded, no recording is made inside the member app, and your quiz answers are never sent to our analytics provider
We never receive or store your full card number. Card details go directly to Stripe.
In the iPhone and Android apps, a daily reminder is scheduled on your phone itself; we store only that reminders are on and the time you chose. The apps make no session recordings and send nothing to Meta.
Why we process it, and on what legal basis
- To provide the service you bought — creating your account, building your programme, tracking progress, sending service emails. Basis: performance of a contract.
- To process payments and meet tax duties — charging, refunding, invoicing, accounting records. Basis: contract and legal obligation.
- To personalise your programme using health-related answers — Basis: your explicit consent (Art. 9(2)(a)).
- To measure and improve marketing— understanding which campaigns bring people to TaiPace. This includes sending Meta (Facebook) a record of when you submit your email, start a checkout or buy: your email address and name hashed before they leave us, your IP address and browser, and Meta's own advertising identifiers where your browser carries them. The browser half of that measurement is controlled by the switch on our e-Privacy Settings page; the half we send from our own servers is not, and you can ask us to stop it by writing to us. Basis: legitimate interests, and consent where cookies or similar technologies are involved.
- To understand and improve the sign-up flow — measuring where people stop, and recording that flow so we can see why. This runs on our own domain and is not shared for advertising. Basis: legitimate interests. It is not covered by the marketing switch on the e-Privacy Settings page; if you would rather we excluded you, write to us and we will.
- To prove what you agreed to — keeping the acceptance records described above, so that a payment dispute can be answered with evidence rather than assertion. Basis: legal obligation and legitimate interests (Art. 7(1) accountability, and the establishment or defence of legal claims).
- To keep the service secure — rate limiting, abuse prevention. Basis: legitimate interests.
Who processes it for us
We do not sell your data. These providers process it on our behalf, under contracts that limit them to doing so:
- Supabase
- Database and sign-in (hosted in Ireland)
- Vercel
- Hosting of the website and the servers the apps talk to
- Stripe
- Payments, including Apple Pay and Google Pay, invoicing and tax
- Mux
- Streaming of the workout videos
- Resend
- Delivery of service emails and sign-in codes
- PostHog
- Product analytics (hosted in the EU)
- Meta
- Advertising measurement from the website, as described above
Some of these providers are based outside the European Economic Area. Where your data leaves it, the transfer relies on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. Apple and Google distribute the apps, and handle app downloads and Apple Pay or Google Pay payments under their own privacy policies.
How long we keep it
- Quiz answers from visitors who never purchase: 12 months, then deleted
- Account and programme data: while your account exists, and 12 months after you delete it in case you return
- Invoices and payment records: 10 years, as Lithuanian accounting law requires
- Acceptance records: 10 years, alongside the payment they relate to. These survive an erasure request — Art. 17(3)(e) permits us to keep what we need to defend a legal claim, and a chargeback can arrive long after an account is closed. The record is reduced to the acceptance itself: the wording, the timestamp, the IP address and the browser string.
- Session recordings and analytics events: 6 months
- Support emails: 24 months
Your rights
Under the GDPR you can ask us to:
- give you a copy of your data, in a portable format
- correct anything inaccurate
- delete your data (“right to be forgotten”)
- restrict or object to certain processing
- withdraw consent you previously gave
You can delete your account yourself in the app, under Profile → Delete my account; our account deletion page explains what that removes.
For anything else, email support@taipace.com from your account address. We respond within one month, free of charge.
Complaints
If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, https://vdai.lrv.lt, or to the authority in your own country of residence.
Automated decisions
Your programme and projected timeline are generated automatically from your quiz answers. This has no legal or similarly significant effect on you, and a human will review any outcome you disagree with if you ask.
Children
TaiPace is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.