Privacy Policy
This Privacy Policy explains how Velka collects, uses, and protects your personal data when you use Velka Coach, the Velka client app, and the Kilo assistant. We are committed to protecting your privacy and handling your data in line with the EU General Data Protection Regulation (GDPR).
1. Who we are (Data Controller)
The data controller is Velka, [TODO: registered legal entity + address], established in Italy. For any privacy question or to exercise your rights, contact us at privacy@velka.fit.
2. Data we collect
We collect the following categories of personal data:
- Account and identity data: name, email address, optional phone number, and billing address.
- Health and fitness data (special category, GDPR Article 9): wellness profile (birth date, height, gender, training experience, goal, medical conditions), check-ins (body weight, energy), training and diet plans, training sessions, and medical certificates.
- Photos and images: check-in and session images you upload.
- Communications: messages between coaches and clients, threads, and your chat history with the Kilo AI assistant.
- Audio (Velka Coach only): voice you dictate to Kilo. Audio is transcribed in real time and is not stored as a recording.
- Diagnostics data: crash reports and named operational events (for example, how long an in-app operation took) from the apps, sent to our own EU Application Insights resource and not linked to your account identity. They carry no persistent device identifier and write nothing to your device's storage (no cookies, no local or session storage). The only identifiers left are session and user ids that the diagnostics library creates in memory for each launch and never stores. Diagnostics that have not been sent when the app reloads or crashes may be lost.
- Push notification token: if you allow notifications on Velka Coach or the Velka app, we store a device push token tied to your account so we can deliver a notification (for example a new message or an updated training plan) to your device. This token is linked to your account — unlike the diagnostics data above — because it has to be, to reach your device specifically. Signing out removes it from your device.
3. Why we use your data (purposes)
- To deliver the coaching service and its core features.
- To provide AI assistance through Kilo.
- To keep the service secure and to maintain audit logs.
- To send you transactional email related to your account and the service.
4. Legal bases
We rely on the following legal bases under the GDPR:
- Article 6(1)(b), performance of a contract: to provide the service you sign up for.
- Article 6(1)(f), legitimate interests: to keep the service secure and audited.
- Article 9(2)(a), explicit consent: to process special-category health and fitness data. You can withdraw this consent at any time.
5. Who we share data with (recipients and subprocessors)
We do not sell your data. We share it only with the service providers we need to run Velka:
- Microsoft Azure (European Union, West Europe / Amsterdam): hosting, database, file storage, secrets, and crash and performance diagnostics telemetry from our backend and apps.
- OpenAI (United States): AI features and voice transcription. Medical conditions are excluded from the prompts sent to OpenAI.
- Resend (United States): transactional email delivery.
- Firebase Cloud Messaging (Google): delivery of push notifications to your device, using the device push token described in Section 2. No message content, health, or training-plan data is sent to Google — only the token and the platform (iOS or Android).
6. International transfers
Azure processing stays within the European Union. OpenAI, Resend, and Firebase Cloud Messaging (Google) are US-based services; these transfers are protected under the EU-US Data Privacy Framework and Standard Contractual Clauses as applicable.
7. Retention
We keep your data while your account is active and for as long as needed for the purposes above or to meet legal obligations (for example, accounting). When you delete your account in-app, we delete your data. Security audit logs are retained for security purposes. A push notification token is removed from our records 30 days after it stops being used (for example after you sign out or uninstall the app). See our account deletion page for step-by-step instructions and what is retained.
8. How we protect your data (security measures)
- Encryption in transit (TLS) and encryption at rest.
- PBKDF2 password hashing.
- Access controls and multi-tenant isolation.
- Rate limiting and private file storage.
- Audit logging and bearer-token authentication (no cookies).
- No third-party analytics SDK or cross-app tracking — only first-party crash reports and named operational events sent to our own EU Azure Application Insights resource, with no persistent device identifier, no cookies, nothing written to your device's storage, and URLs scrubbed before anything leaves your device.
9. Your rights
Under the GDPR (Articles 15 to 22) you have the right to access, rectification, erasure, restriction, data portability, objection, and to withdraw your consent. To exercise these rights, email privacy@velka.fit or delete your account in-app. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (the Garante).
10. Children
Velka is intended for users aged 18 and over. We do not knowingly process data of minors.
11. Changes to this policy
This is Version 1.3, effective 18 September 2026. If we make material changes, we will notify you by email and/or with an in-app notice. Continued use of the service after the effective date of a change constitutes acceptance of the updated policy.
12. Contact
Questions about this policy or your data: privacy@velka.fit.