Privacy Notice

This privacy notice is provided by EightyTwenty — AI Workout Builder ("EightyTwenty", "we", "us"), the operator of the EightyTwenty web application and the data controller for the personal data described below. If you have questions, contact us at privacy@8020app.ai.

• Account data — email address, display name, and profile picture when you sign in with Google or email.
• User content — workouts you upload as a creator (title, description, muscle/goal/equipment tags, and the video URL you paste).
• Workout inputs — the training type, time, muscles, goal, level, and equipment you submit to the AI generator. We send these to our AI provider to produce your routine.
• Technical data — IP address, device/browser type, and basic usage telemetry needed to operate the service and prevent abuse.
• Payment metadata — subscription status, plan, and Paddle customer/subscription identifiers received from Paddle. We do not receive or store your full card details; Paddle processes payments as Merchant of Record.

• To create and authenticate your account (contract performance).
• To generate personalized workouts from your inputs using our AI provider (contract performance).
• To host, display, and moderate content you publish as a creator (contract / legitimate interests).
• To provide, maintain, and improve the service and prevent fraud and abuse (legitimate interests).
• To process subscriptions and comply with tax and accounting obligations (contract / legal obligation).
• To respond to customer support requests (contract / legitimate interests).

We share personal data only with the following categories of recipients:

• Paddle — our reseller and Merchant of Record for all sales. Paddle handles checkout, billing, tax, invoicing, refunds, and subscription management, and processes your payment data under its own privacy notice.
• Hosting and backend providers — Lovable Cloud (which uses Supabase) for authentication, database, and file hosting; and the Lovable AI Gateway for generating workouts (currently routed to Google Gemini).
• Video platforms you embed — YouTube, Instagram, TikTok, and Vimeo when you paste a video URL to publish as a creator. Their own privacy notices apply to the embedded content.
• Professional advisers — legal, accounting, and compliance advisers, where necessary.
• Authorities — where we are legally required to disclose data.

We do not sell your personal data.

Some recipients (including Paddle, our hosting provider, and our AI provider) may process your data outside the UK/EEA. Where required, transfers rely on adequacy decisions or Standard Contractual Clauses, together with additional safeguards.

We keep account data while your account is active and for a reasonable period after (typically up to 24 months) to satisfy legal, accounting, and dispute-resolution needs. Payment records are kept for the period required by applicable tax law. Workout content you publish as a creator is retained until you delete it or we delete it under our terms.

Subject to applicable law you have the right to:

• Access, rectify, or delete the personal data we hold about you.
• Restrict or object to certain processing, and request data portability.
• Withdraw any consent you gave us.
• Lodge a complaint with your local data-protection authority.

To exercise these rights, email privacy@8020app.ai. We aim to respond within one month.

We apply appropriate technical and organizational measures — including encryption in transit, access controls, and least-privilege database access — to protect personal data. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

We use strictly necessary cookies and similar technologies to sign you in and remember your language preference. We do not use advertising cookies. Paddle and embedded video providers may set their own cookies when their content is loaded.

We may update this notice from time to time. Material changes will be highlighted on this page and, where appropriate, notified to registered users.