Privacy Policy | My Movement Lab

My Movement Lab ("we", "us", "our") is operated by My Movement Lab, based in Amsterdam, Netherlands. We are committed to protecting your personal data in accordance with the GDPR.

This policy applies to the website mymovementlab.fit and to the My Movement Lab apps for iPhone (App Store) and Android (Google Play). The apps show the same platform as the website, so the same data and the same rules apply.

Who We Are

My Movement Lab is a Pilates learning platform operated as a sole trader (ZZP/eenmanszaak) under Dutch law. Contact: info@mymovementlab.fit

What Data We Collect

Account data: email address, first and last name, password (stored encrypted), language and time zone
Profile photo: only if you choose to upload an avatar
Learning data: quiz answers, XP, streak, badges, lives, session progress and study preferences
Purchase data: which plan or product you bought, from which store (App Store or Google Play), the purchase and renewal dates and the transaction number. We never see or store your card or bank details.
Access codes you redeem, and when
Technical data: IP address and browser or device type in our hosting provider's server logs

We do not collect your location, contacts, photos other than an avatar you upload, health data or advertising identifiers.

Why We Collect It

To create and secure your account
To provide and personalize your learning experience
To track progress and award XP, streaks, and badges
To unlock Pro access or extra lives after a purchase in the app, and keep them in line with your subscription
To send account and service emails (for example, sign-up confirmation or password reset)
To answer your support requests
To keep the platform safe and prevent fraud and abuse

Legal Basis (GDPR)

Contract: processing account, learning and purchase data to deliver the service you signed up for
Legitimate interest: keeping the platform secure and preventing fraud
Consent: an avatar you choose to upload, and any marketing emails (withdrawable at any time)

Payments in the Apps

Pro subscriptions and extra lives are sold only inside the apps, through Apple (App Store) on iPhone and Google (Google Play) on Android. Apple or Google takes the payment, handles VAT and manages your subscription. They process your payment details under their own privacy policies, and we never receive your card details.

We use RevenueCat to check purchases with Apple and Google and tell our system which access to unlock. RevenueCat receives your My Movement Lab account ID (a random code, not your name or email) together with the purchase details from the store.

Who We Share Data With

We only share data with the service providers below, and only what each one needs to do its job:

Supabase (database, authentication and file storage), EU servers. Processes your account data, learning progress and uploaded avatar.
Lovable (hosting and application infrastructure). Processes technical request data such as IP address and browser type in server logs.
RevenueCat (in-app purchase validation). Receives your account ID and purchase details, as described above.
Apple and Google, as the app stores. They process payments, refunds and subscriptions made in the apps.
Google (optional "Sign in with Google"). If you choose it, Google shares your email and name with us and processes the sign-in itself. Not used if you register with email and password.
Anthropic (AI sequence generator, when this feature is available to you). Receives only the class settings you pick from fixed menus (duration, level, equipment, focus, sections). Never free text, names, emails, account identifiers or other personal data. Only called when you generate a sequence.

Some of these providers may process data outside the EU. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

We never sell your data. We do not use analytics, advertising or social media tracking services, and we do not track you across other apps or websites. Fonts are hosted on our own servers, so no font or CDN provider receives your IP address.

How Long We Keep Data

Account and learning data: as long as your account is active
After you ask to delete your account: permanently deleted after 30 days
Payment records for purchases in the apps are kept by Apple or Google, under their own rules

How to Delete Your Account

You can delete your account and data yourself, at any time, on the website or in the app:

Sign in to My Movement Lab (mymovementlab.fit, or the iPhone or Android app).
Open Settings.
Scroll to Delete account and confirm.

Your account and all its data (profile, avatar, progress, purchases linked to it) are permanently deleted 30 days later. During those 30 days you can change your mind: sign in again and cancel the deletion in Settings. After 30 days, deletion cannot be undone.

Important: deleting your account does not cancel a subscription bought in the app. Apple or Google keeps charging until you cancel it in your App Store or Google Play subscription settings. Please cancel your subscription there first.

If you cannot sign in anymore, email info@mymovementlab.fit from the address on your account and we will delete it for you.

Your Rights (GDPR)

Access, correct, delete, export, object, withdraw consent.

Email info@mymovementlab.fit, response within 30 days.

Cookies and Local Storage

We use strictly necessary cookies and local storage only: your login session, your sound and consent preferences, and your last quiz position. These are required for the platform to work and are exempt from consent under the ePrivacy Directive. The apps use the same storage on your device.

We currently load no analytics, advertising or tracking cookies and no third-party scripts. The consent banner lets you accept or reject non-essential cookies. Nothing non-essential is loaded before you accept, and rejecting keeps it switched off. To change your choice, clear this site's data in your browser and the banner reappears.

Sessions expire automatically after 30 days of inactivity for your security.

Security

All data is sent over an encrypted connection (HTTPS). Passwords are stored encrypted, and access to your data is limited to your own account.

Children

Not directed at under-16s. Contact us if you believe a child has registered.

Changes to This Policy

If we change this policy in a meaningful way, we will update the date at the top and tell you in the app or by email.

Contact & Complaints

info@mymovementlab.fit
Autoriteit Persoonsgegevens: www.autoriteitpersoonsgegevens.nl