Privacy Policy

The controller of your personal data is:

Grzegorz Walencik
Correspondence address: Tuwima 2/5, 82-300 Elbląg, Poland
Email: kontakt@ultrasoul.pl
Website: https://ultrasoul.pl

The UltraSoulAI project is run on a sole-proprietor basis. We have not appointed a formal Data Protection Officer (DPO), because the scale of processing does not require one under Article 37 of the GDPR. Direct any data-protection matters straight to kontakt@ultrasoul.pl — we respond within 30 days. UltraSoulAI is operated from Poland. To the extent Article 27 of the UK GDPR requires a UK representative for users in the United Kingdom, we will appoint one and publish their contact details here before any general launch to UK users; until then you can raise any data-protection matter with us directly at the address above.

2.1 Data provided directly by the user

If you attach a screenshot to a feedback report, we also process the contents of that image to handle the report. The file is stored in private Supabase storage. We use file links that expire after 72 hours to handle reports; expiry of a link does not delete the file.

2.2 Data from sports integrations

A note about GPS:
GPS coordinates are received from Strava (and, in future, Garmin Connect) while activity data is being fetched, but they are not saved in our database. We store only the aggregated numeric streams (heart rate, pace, elevation, cadence, distance) in JSONB format. We also do not store raw FIT/GPX files.

A note about the activity description:
If you describe a run in Strava, we fetch that text together with the activity data and pass it to the AI model (sections 4 and 5) as context for the analysis of that run. It goes there twice: once for the analysis itself and once when your athlete profile is updated — facts remembered from the description live as long as your account, not as long as the single activity. The description is deleted together with the activity and with the whole account (section 8). This field is free text, so if you put information about your health or about other people into it, we process it on the terms set out in section 2.3.

2.3 Health data (Art. 9 GDPR)

Some data may qualify as „health data” within the meaning of Art. 9(1) GDPR:

• Heart rate (HR), heart-rate variability (HRV), Body Battery
• Physical symptoms reported in the form (nausea, cramps, vomiting, dizziness)
• The Strava run description (section 2.2), if you write in it about how you felt, about symptoms, or about substances you took
• Biometric data: weight, sex, age

This data is processed solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), given by actively ticking a checkbox before the analysis begins. It is used only to generate the analysis and is not shared with third parties other than the entities listed in section 5.

2.4 Data collected automatically

We do not use advertising pixels or advertising tracking. In the mobile app, only after your voluntary consent, we use PostHog for product analytics. Events are pseudonymous: they are linked to your account identifier (UUID), so they are not anonymous. They include screen names, event and feature types, offer clicks, product identifiers and categories, the app version and platform. We do not send your email, conversations, notes, health data or training data. We do not record sessions or screens; automatic interaction capture is disabled. Withdrawing consent in your Profile stops further collection; deleting your account also requests deletion of the person and their events in PostHog. PostHog processes deletion in the background. Website PostHog analytics runs only after voluntary consent. We record a random browser identifier, public page visits (without URL parameters), download-page views and APK download clicks. We do not link this identifier to an app account or send form content. Events are pseudonymous; session recording and automatic interaction capture are disabled. The IP address technically reaches PostHog, but IP storage and IP-based geolocation are disabled. Consent can be withdrawn using “Analytics settings” in the footer.

Server technical logs (including the IP address and diagnostic messages) are retained for a maximum of 7 days at our hosting provider, after which they are automatically deleted. We do not store the raw content of analyses or GPS data in them.

Data from the forms and sports integrations is processed by the Claude AI model (provider: Anthropic, PBC) in order to generate the nutrition analysis.

How it works:

• Your data is sent to the Anthropic API as context for the query to the AI model
• The model generates an analysis, which is returned to the app and saved in the UltraSoulAI database
• We use the commercial Claude API — under the Anthropic policy in force from 14 September 2025, data sent to the API is retained by Anthropic for a maximum of 7 days and then deleted automatically
• Data sent to the Claude API is not used to train AI models — this is a separate regime from Anthropic’s consumer products (Claude.ai), which have a different policy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — the analysis is the essence of the service) + Art. 9(2)(a) GDPR (explicit consent for health data).

We do not share data with: advertising agencies, data brokers, social media platforms or any third parties for commercial purposes.

If you connect a Garmin Connect account to UltraSoulAI (once the integration is live):

• OAuth2 authorisation means selected data from your Garmin account is transferred to UltraSoulAI
• Once transferred, processing of that data is governed solely by this UltraSoulAI Privacy Policy — not by Garmin’s policy
• Garmin is not responsible for the processing of data by UltraSoulAI after it has been transferred
• You can disconnect the integration at any time in the app or by writing to kontakt@ultrasoul.pl
• Disconnecting immediately deletes the authorisation tokens and the data synced from Garmin Connect

The production Supabase database and private file storage are located in London, in the United Kingdom, outside the European Economic Area. Transfers to this region rely on Art. 45 GDPR and Commission Implementing Decision (EU) 2021/1772, as amended by Decision (EU) 2025/2574. The decision recognising adequate protection of personal data in the United Kingdom is valid until 27 December 2031.

Some data may be transferred to the USA (Anthropic, Resend, Railway, Vercel, and the PostHog and Sentry providers). EU event hosting in PostHog and EU Sentry ingestion do not mean the providers never use subprocessors or support outside the EEA. Any transfers outside the EEA are governed by data processing agreements. For users in the United Kingdom, transfers of personal data to the United States and other countries outside the UK are made under the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and — for transfers to certified US recipients — the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”). For users in the EEA, transfers rely on the EU Standard Contractual Clauses (Decision 2021/914) and the EU-US Data Privacy Framework. In both cases we apply technical safeguards: AES-256 encryption at rest and TLS 1.3 in transit.

For users in the United Kingdom, the rights and obligations in this policy apply under the UK GDPR (the retained EU General Data Protection Regulation as it forms part of UK law) and the Data Protection Act 2018; for users in the EU they apply under the EU GDPR. The article numbering used in this policy is the same under both regimes.

You have the right to:

1. Access your data (Art. 15)
2. Rectification of your data (Art. 16)
3. Erasure of your data (Art. 17, the „right to be forgotten”)
4. Restriction of processing (Art. 18)
5. Portability of your data in JSON format (Art. 20)
6. Object to processing (Art. 21)
7. Withdraw consent at any time (Art. 7(3))

How to exercise your rights

• Email: kontakt@ultrasoul.pl
• In the app: disconnecting the Strava/Garmin integration immediately deletes the tokens + synced data
• Unsubscribing from emails: the „Unsubscribe” link in the footer of every email

We respond to requests within 30 days (Art. 12(3) GDPR).

You have the right to lodge a complaint with the data-protection supervisory authority in your country of residence. If you are in the United Kingdom, this is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. If you are in Poland or another EU country, it is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl, or your local supervisory authority.

The UltraSoulAI mobile app does not use cookies.

The website (ultrasoul.pl) stores essential preferences. Only after consent does it also store an analytics identifier in browser localStorage. Analytics is off by default:

We do not use advertising cookies or remarketing pixels.Declining does not restrict access. Withdrawal stops future events and removes the identifier from the stored choice. It does not automatically delete events already delivered, which we retain for a maximum of 12 months. Contact us about your rights. The previous informational cookie acceptance is not consent to this analytics.

UltraSoulAI is intended for adults (18+). The reason: the nutrition analysis may suggest supplementation strategies, calorie intake and effort intensity that require mature health judgement and full legal capacity.

We do not knowingly collect data from anyone under 18. If you learn that a minor has provided us with data, please get in touch — we will delete it without delay.

We will notify you of material changes:

• By a notice in the app
• By email (if you provided an address)

A change to the policy’s content does not change its URL (ultrasoul.pl/polityka-prywatnosci) — if a URL change is technically necessary we will use a 301 redirect.

Email: kontakt@ultrasoul.pl
Website: ultrasoul.pl