Privacy Policy

Last updated: 18 June 2026

This policy describes how AdCoach AI, operated by Fitness Vendor SAS, processes your personal data in accordance with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679).

1. Data Controller

Fitness Vendor SAS

• RCS Cherbourg: 921 713 418
• SIRET: 921 713 418 00025
• Intra-EU VAT number: FR66921713418
• Share capital: €1,000
• Registered office: 41 Les Bertrands, 50470 Tollevast, France
• Publication director: Nils Mazeaud
• Contact: contact@fitness-vendor.com

2. Platform Role in Data Processing

AdCoach AI processes two categories of data under distinct GDPR roles:

Scope A - User's Meta Advertising Data

For the synchronization and analysis of the User's Meta advertising data (campaigns, insights, leads), AdCoach AI acts as a data processor within the meaning of Article 4.8 of the GDPR. The User (the club) is the data controller. AdCoach AI only accesses this data on the User's instructions (OAuth connection, sync initiation, dashboard viewing).

Scope B - Authentication, Account, and Service Data

For data necessary for the service itself (authentication email, technical logs, billing data), AdCoach AI acts as a data controller within the meaning of Article 4.7 of the GDPR.

Scope C - CRM Import and Connection (Prospect Data)

For client contact data provided by the User, whether by file import (CSV/XLSX) or by automated connection to their CRM software (e.g. Virtuagym), AdCoach AI acts as a data processor. The User remains the data controller and is responsible for the lawfulness of that data. See Article 5.2 below.

3. Data Collected

Account Data (Scope B)

• Professional email address (authentication via magic link)
• Unique Supabase identifier
• Billing data: payment information processed directly by Stripe (Fitness Vendor SAS retains no raw banking data)

Meta Advertising Data (Scope A)

Collected via Meta OAuth after the User's explicit authorization:

• Ad account identifiers, campaigns, ad sets, ads
• Performance data (insights): impressions, clicks, spend, conversions, ROAS
• Ad creatives (headlines, visuals, descriptions)
• Leads (Meta Lead Ads forms): name, email, phone number of the club's prospects

AI Coach Conversations (Scope B)

• Messages exchanged with the AI Coach (plain text of questions and answers)
• Pseudonymized before transmission to the Anthropic API (no direct user identifier is sent to Anthropic)

CRM Data, by import or connection (Scope C)

• Client contact data provided by the User, either by file import (CSV/XLSX) or by connecting their CRM software (e.g. Virtuagym): names, emails, phone numbers, subscription and conversion data of their clients

Technical Data

• IP addresses, user-agent, login timestamps (security and abuse detection only)
• Error logs (Sentry, with automatic PII scrubbing)

No special category data within the meaning of Article 9 of the GDPR is collected (health data, political opinions, biometric data, etc.).

4. Processing Activity Table

5. Specific Processing Activities

5.1. Data Processed via the AI Coach (Anthropic)

The AI Coach is powered by Anthropic's Claude API (United States), accessed via the centralized backend service integrations.fitness-vendor.com. Messages transmitted to Anthropic are pseudonymized: no direct user identifier (email, name, UUID) is included in API requests.

Anthropic commitments:

• Anthropic contractually commits not to use data transmitted via the API to train its AI models (Anthropic Commercial Terms)
• Maximum retention period on Anthropic's side: 30 days per their policies
• Legal framework: Standard Contractual Clauses (SCCs) + EU-US Data Privacy Framework

5.2. CRM Import and Connection - Your Clients' Data

When you import a client contact file (CSV/XLSX) or connect your CRM software (e.g. Virtuagym), you act as the data controller of that data. AdCoach AI is your data processor for this processing.

Connecting a third-party CRM takes place on your explicit instruction (activation from Settings → Integrations) and transits through the centralized backend service integrations.fitness-vendor.com. AdCoach AI then reads, automatically and periodically, the member and conversion data strictly necessary to match your advertising prospects and compute ROAS. You can disable this connection at any time from Settings → Integrations.

By importing data, you declare and warrant that:

• You have a valid GDPR legal basis for this processing
• You have informed data subjects in accordance with Articles 13 and 14 of the GDPR
• You will not import special category data (Article 9 GDPR) without the explicit consent of the data subjects

CRM data (imported or synced via connection) is stored on the dedicated AdCoach Supabase project (eu-west-3 Paris region) and is not shared with any third party beyond the listed technical subprocessors.

5.3. Meta Integration - Read Only

AdCoach AI accesses Meta advertising data exclusively in read-only mode via the following OAuth permissions:

• ads_read: read advertising performance
• business_management: read Business Manager and ad accounts
• leads_retrieval: retrieve Lead Ads leads
• pages_show_list: list of Facebook Pages linked to the account
• pages_read_engagement: read engagement metrics of Pages associated with the ads
• public_profile: name and profile picture of the connected account (connection identification)

No Meta data is resold to any third party. Data is exclusively used for display within AdCoach AI for the benefit of the User who owns the account.

Meta data deletion: the User may request deletion of synchronized Meta data at any time by contacting contact@fitness-vendor.com or via Settings - My Data. Deletion occurs within 30 days.

6. Subprocessors and Transfers Outside the EU

A consolidated copy of DPAs and Standard Contractual Clauses can be obtained on request to contact@fitness-vendor.com with the subject "AdCoach AI SCCs Request". Response time: 7 business days.

Analytics and marketing: AdCoach AI uses a cookieless audience measurement solution (Vercel Web Analytics, no cookies, exempt from consent) and, only after obtaining your consent via the cookie banner, Microsoft Clarity (usage analytics, heatmaps) as well as the Meta Pixel (measuring the performance of our own ad campaigns, with advanced matching using hashed data). The cookies set are detailed in the Cookie Policy. These tools measure traffic on our public website: no business data from our logged-in Users (campaigns, leads, CRM data, AI Coach conversations) is shared with them.

7. Retention Periods

8. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate data
• Right to erasure (Art. 17): delete your account from Settings - My Data
• Right to portability (Art. 20): export your data in CSV/JSON format from Settings
• Right to object (Art. 21): object to certain processing based on legitimate interest
• Right to restriction (Art. 18): request restriction of processing

Response deadline: 30 days. Contact: contact@fitness-vendor.com

For requests to exercise rights relating to imported CRM data, contact the club that is the data controller directly.

9. Security

Fitness Vendor SAS implements the following technical and organizational measures in accordance with Article 32 of the GDPR:

• Encryption at rest: Meta OAuth tokens encrypted in Supabase Vault (AES-256)
• Encryption in transit: TLS 1.3 on all communications
• Data isolation: Postgres Row-Level Security (RLS) - each user only accesses their own data
• Authentication: magic link without password, single-use tokens
• Monitoring: Sentry error monitoring with automatic PII scrubbing
• EU hosting: personal data stored in AWS eu-west-3 Paris region
• HMAC nonces: Upstash Redis 6-minute cache to prevent replay attacks
• Restricted access: production data access limited to authorized technical personnel

Data Breach Notification (Articles 33-34 GDPR)

In the event of a personal data breach, Fitness Vendor SAS commits to:

1. Notify the CNIL within 72 hours of becoming aware of the breach, pursuant to Article 33 of the GDPR, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons;
2. Notify affected Users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, pursuant to Article 34 of the GDPR;
3. Document any breach (facts, effects, corrective measures) in an internal register for potential CNIL audit.

10. AI Act Compliance

Pursuant to Article 50 of Regulation (EU) 2024/1689 (AI Act), applicable since 2 August 2026, AdCoach AI informs its Users that:

• The AI Coach is a generative artificial intelligence system (Claude, Anthropic)
• Responses are generated automatically and may contain errors
• The interface clearly identifies AI-generated content, from the first interaction
• A "Report" button allows flagging of any problematic response

Classification: as AdCoach AI places an AI system built on a third-party model on the market under its own brand, the Publisher acts as a provider within the meaning of Articles 3(2) and 25 of the Regulation. The system presents minimal risk: it falls under none of the uses listed in Annex III (high-risk systems). The obligations deferred to 2 December 2027 by the Digital Omnibus package, adopted on 29 June 2026, are therefore inapplicable to AdCoach AI.

No automated decision-making: the AI Coach recommends, the User decides. Access to Meta data is read-only, and no campaign, budget or ad is created, modified or paused automatically. No decision producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR is based on automated processing.

Protection of data sent to the model: messages are pseudonymised, and a server-side safeguard rejects, before storage in the Coach's memory, any content containing an email address, a phone number or an IBAN.

The full classification, the inventory of systems and the internal usage rules are documented in the Publisher's artificial intelligence usage policy, available on request at contact@fitness-vendor.com.

11. Cookies

See our dedicated Cookie Policy.

12. Policy Changes

Any material modification to this policy is notified by email at least 30 days before it takes effect. The version in force is always the one published on this site.

13. Complaints

In case of disagreement about how your data is processed, you may contact the supervisory authority in your country. In France: Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Phone: +33 (0)1 53 73 22 22