Privacy Policy

1.Controller

Luís Correia, sole trader, identified in the Legal notice: rummo.app/en/legal-notice.

Contact for exercising your rights and for any question about personal data: hello@rummo.app.

Rummo is not required to appoint a data protection officer. Should that obligation arise, the contact is published here.

2.Rummo's two roles

This policy covers the data for which Rummo is the CONTROLLER: that of whoever creates an account — name, email, and the billing details of whoever subscribes.

For the data a space keeps about ITS members — attendance, plans, payments, notes, training results — the space decides. Rummo is only a processor, and the terms are in the «Data processing» document.

In practice: if you train at a gym that uses Rummo and want to know what is held about you, ask the gym first. Rummo cannot delete or change that data on its own initiative.

3.What we process, and why

Only what the service needs. Nothing is collected for advertising, and no data is sold to anyone.

• a)Account identity — name and email. Basis: performance of the contract (art. 6(1)(b) GDPR). Without it there is no account.
• b)Authentication — single-use sign-in codes and session records. Basis: performance of the contract and legitimate interest in account security (art. 6(1)(b) and (f)).
• c)Date of birth — asked at athlete sign-up, to apply age rules: anyone under 18 needs a parent or guardian, and the age groups in leaderboards and events depend on it. Basis: performance of the contract.
• d)Birthday — only if the person chooses, in the app, to show their birthday to fellow members. Then fellow members see the day, and the space can wish them a happy birthday. Basis: consent (art. 6(1)(a)), withdrawn by turning the same option off.
• e)Billing details of subscribers — name, tax number, address, charge history. Basis: legal obligation (art. 6(1)(c)) and performance of the contract.
• f)Payment data — handled by Stripe. Rummo receives only the card brand, last four digits and expiry. The full number never reaches our servers.
• g)Technical logs — IP address, time, route and outcome of requests, for diagnosis and security. Basis: legitimate interest (art. 6(1)(f)).
• h)Sales contacts — when you request a demo or write to us. Basis: pre-contractual steps at your request (art. 6(1)(b)). No consent is asked for this, and the contact is not used for advertising.

4.What we do not do

We do not sell personal data.

INSIDE THE APPLICATION — the space dashboard, the athlete account, payments, classes — there is no third-party measurement, no advertising or social cookies, and no profiles are built for ads. What is measured there is done by us and serves to make the service work. The only exception is the page after creating a space, which tells Google Ads, and only with the yes to advertising given on the website.

ON THE MARKETING WEBSITE there are two separate questions. A yes to measurement loads Google Analytics. A yes to advertising loads the Meta pixel and Google Ads, which are used to show ads to people who visited the site and know which ad brought them. All of them set cookies and send data to the United States. They are described on the “Cookies” page, and each loads only with its own yes.

There is no automated decision-making producing legal or similarly significant effects within the meaning of article 22 GDPR. Bookings, payments, attendance and invoicing are deterministic rules, and any suggestion from an assistant is put to a person who decides.

Our own visit counting is cookieless and identifies nobody: events are counted, not people. Name, email, phone, member id and space id never leave in those events.

5.For how long

Account data: while the account exists. Once deleted, it is anonymised or erased, save what the law requires us to keep.

Billing data and tax documents: 10 years, under article 123 of the Portuguese Corporate Income Tax Code and article 52 of the VAT Code.

Technical logs: 12 months.

Sign-in codes: minutes. They expire and are invalidated.

6.Who else touches the data

We use the processors below, all under a data processing agreement. Clause 7 says which ones transfer outside the European Economic Area, and under what.

• a)Hostinger International Ltd. (Cyprus) — server and database hosting, in a data centre in the European Union, and transactional email.
• b)Stripe Payments Europe, Limited (Ireland) — payment processing and subscription management.
• c)Google Ireland Limited — Google Analytics, on the marketing website only and only with your yes to measurement. Receives the IP address, the page viewed and a cookie identifier.
• d)Anthropic Ireland, Limited (Ireland) — the app's «Agent», on paid plans and only when a space's team asks it something. It receives the question and figures from the space, with people as references («Member 17»), and never names, contacts, notes or health data. It does not use them to train models. It deletes them within 30 days, except what its safety systems flag as a usage policy violation, which it may keep for up to 2 years.
• e)Functional Software, Inc., which operates Sentry (United States) — error logging, when enabled. Receives technical error messages with sensitive keys already removed.
• f)Slack Technologies Limited (Ireland) — internal notices to our team, when enabled. Receives account events and error messages, with email addresses masked.
• g)A cookieless usage measurement service, when enabled — receives event counts and no personal data.

6.1.

Some parties process data as controllers in their own right, not on our behalf:

• a)Google Ireland Limited — Google Ads, only with your yes to advertising, on the marketing website and on the page after creating a space. Receives the IP address, the page, the ad click identifier and a cookie identifier. Google processes them as a controller in its own right, under the Google Ads controller-to-controller data protection terms.
• b)Meta Platforms Ireland Limited — the Meta pixel, on the marketing website only and only with your yes to advertising. Receives the IP address, the page viewed and a cookie identifier. We are joint controllers with Meta for collecting and sending that data; what Meta does with it afterwards, including advertising, is Meta's responsibility.
• c)Google Ireland Limited, when you choose to sign in with a Google account. It receives the sign-in request, under its own relationship with you.
• d)Stripe, for payments you make to a space, for the purposes the law imposes on it, such as fraud prevention.

7.Transfers outside the European Union

Application data — accounts, members, classes, payments, billing, documents — is stored in the European Union.

There are transfers to the United States in these cases. When the «Agent» is used, the question and the figures it needs go to Anthropic, without names or contacts, under the European Commission's standard contractual clauses.

Stripe may transfer to Stripe, Inc. Error logging and internal notices, when enabled, are processed in the United States by Sentry and Slack. These three are certified under the EU-U.S. Data Privacy Framework, the European Commission adequacy decision of 10 July 2023, and also have standard contractual clauses.

Hostinger may use sub-processors of its own outside the European Economic Area, under the standard contractual clauses in its agreement.

On the marketing website, Google Analytics, Google Ads and the Meta pixel transfer to the United States, and both companies are certified under the same Data Privacy Framework. Each loads only with its own yes; without it, nothing is sent. The answer can be changed at any time on the “Cookies” page.

8.Your rights

You have the rights of access, rectification, erasure, restriction of processing, portability and objection, under articles 15 to 22 GDPR.

Several of these you exercise yourself, inside the application: you can export your data and request deletion of your account from your profile.

For the rest, write to hello@rummo.app. We answer within one month, extendable by two in complex cases, with notice.

Where processing rests on consent, you may withdraw it at any time, without affecting what was done before.

9.Complaining

You may complain to the Portuguese data protection authority — www.cnpd.pt — without prejudice to any other remedy.

For consumer complaints there is an electronic complaints book at https://www.livroreclamacoes.pt/inicio.

10.Security

Access is decided in the database itself, with isolation per space: whoever does not belong to a space neither reads nor writes its data, and it is the database that refuses, not an application check someone can forget to write.

Connections are encrypted in transit. There are no passwords: sign-in is by single-use code or Google account.

In the event of a personal data breach, we notify the Portuguese supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms (article 33 GDPR).

If the breach is likely to result in a high risk, we also inform the people affected without undue delay (article 34 GDPR).

11.Changes

A material change to this policy is notified by email to account holders at least 30 days in advance.

The date of the version in force appears at the top of this page.

12.Language

This English text is a translation provided for convenience. In case of divergence, the Portuguese version prevails.