KARU legal
Privacy Policy
Version 2026-08-06 · Effective 6 August 2026
Who is responsible?
The controller is [LEGAL ENTITY NAME TO BE CONFIRMED]. Registered office and registration details are [LEGAL ENTITY NAME TO BE CONFIRMED]. Privacy enquiries should be sent to [PRIVACY CONTACT EMAIL TO BE CONFIRMED]. These legal identity fields are intentionally visible placeholders until the verified company details are supplied.
What we collect
At account registration KARU collects your email address, display name, preferred language, password hash, required acceptance of these Terms and acknowledgement of this Policy, plus an optional marketing preference. We do not collect health information, age, sex, height, weight, phone number, profile image, goals or training history at registration.
Why we use it
We use account data to create and secure your account, verify your email, provide the client or administration portal, remember consent choices, respond to support and fulfil legal obligations. Security metadata such as session IP address, user-agent and audit events is used for fraud prevention, access control and incident investigation.
Legal bases and choices
Account operation is necessary to provide the service. Terms acceptance is contractual. Privacy acknowledgement records that you received this information. Optional marketing consent is separate, never preselected, and can be withdrawn from account settings without affecting the account.
Processors and transfers
Current infrastructure uses PostgreSQL for account data and Resend only when production email delivery is configured. Docker, Nginx, application hosting and any additional processor must be confirmed in the deployment register before production launch. No analytics or advertising scripts are currently loaded.
Retention and rights
Retention decisions are documented in the repository deployment records and will be finalised with the controller. You may request access, correction, deletion, restriction, portability or objection by contacting [PRIVACY CONTACT EMAIL TO BE CONFIRMED]. Account deletion requests revoke active sessions immediately and enter a controlled deletion workflow; legally required records may be retained.