Privacy Policy – OktaHub
Last Updated: October 1, 2026
1. Controller
Vitor Augusto GorlaLenkersheimerstr. 10A
90431 Nürnberg, Germany
Email: support@oktahubapp.pro
2. What Data We Collect
- Account data: email address, name (from sign-up via Clerk)
- Training profile: age, weight, height, sport, belt level, goals, injury history, training schedule, competition dates, sleep quality, stress level, available equipment
- Generated content: AI-generated training programs and meal plans stored in your account
- Usage data: pages visited, features used, subscription status
- Payment data: billing information processed by Stripe (we never store card numbers)
- Technical data: IP address, browser type, device type, session cookies
3. Lawful Basis for Processing (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)): Account creation, authentication, delivering training programs, meal plans, and subscription services
- Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement, error logging
- Consent (Art. 6(1)(a)): Non-essential cookies where applicable — you may withdraw at any time
- Legal obligation (Art. 6(1)(c)): Tax records, statutory compliance
The table below maps specific processing activities to their legal basis:
| Processing Activity | Legal Basis | Details |
|---|---|---|
| Account authentication | Art. 6(1)(b) — Contract | Required to provide the service |
| Training program generation | Art. 6(1)(b) — Contract | Core feature you signed up for |
| Sending your profile, including health data (weight, injuries, sleep, stress), to the AI providers in Section 4 for plans and Okta Coach replies | Art. 9(2)(a) — Explicit consent | Asked in the app before the first AI request (unticked checkbox). Withdraw any time in Settings → AI features; AI features then stay off. Withdrawal does not affect processing before it. |
| Payment processing | Art. 6(1)(b) — Contract | Required to process your subscription |
| Error monitoring | Art. 6(1)(f) — Legitimate interest | Keeping the service stable; overridden by your opt-out right |
| Email notifications | Art. 6(1)(b) — Contract | Service-critical communications only |
4. Data Processors & Third Parties
We use the following sub-processors (GDPR Art. 28). All US-based transfers are protected by Standard Contractual Clauses (SCCs) pursuant to EU Commission Decision 2021/914.
- Supabase, Inc. (USA) — PostgreSQL database. Data: all user and training data. SCCs apply. Privacy Policy
- Clerk, Inc. (USA) — Authentication and session management. Data: email, name, session tokens. SCCs apply. Privacy Policy · DPA
- Stripe, Inc. (USA) — Payment processing and subscription management. Data: billing information. SCCs apply. Privacy Policy
- OpenRouter, Inc. (USA) — AI inference gateway. Your training profile and goals are transmitted to OpenRouter, which forwards them to OpenAI or Anthropic (both below) to generate personalised coaching programs. Our account restricts serving to those two providers only and excludes any provider that retains prompt data. SCCs apply. Privacy Policy · Terms
- OpenAI, L.L.C. (USA) — AI model inference (GPT), reached via OpenRouter as a sub-processor. Used first for meal plans and Okta Coach chat replies, and as the fallback for training programs and weight-cut plans when the Anthropic request fails. OpenAI does not use data submitted through its API to train its models. SCCs apply. Privacy Policy · DPA
- Anthropic, PBC (USA) — AI model inference (Claude), reached via OpenRouter as a sub-processor. Used first for training programs and weight-cut plans, and as the fallback for meal plans and Okta Coach chat replies when the OpenAI request fails. Anthropic does not retain or train on this data beyond the scope of the individual API request. SCCs apply. Privacy Policy · DPA
- Vercel, Inc. (USA) — Web hosting and CDN. Processes request logs and static assets. SCCs apply. Privacy Policy · DPA
- Upstash, Inc. (USA) — Rate limiting for AI features, to prevent abuse of the service. Data: pseudonymous request counters keyed to your account ID. SCCs apply. Privacy Policy / DPA
- Google Ireland Ltd. / YouTube — Exercise demonstration videos. Nothing is sent to YouTube when a training plan loads: the player is only requested after you press play on a specific exercise, and it is served from youtube-nocookie.com. Once you do, YouTube receives your IP address and device information under its own privacy policy. Privacy Policy
- Functional Software, Inc. d/b/a Sentry (USA) — Error and crash diagnostics, used solely to detect and fix faults and attacks on the service. Data: error message (with identifiers removed), stack trace, browser and page path, and security events such as a rejected sign-in token. We do not transmit your account ID, email, IP address, request contents, or any training or health data. SCCs apply. Privacy Policy · DPA
5. International Data Transfers
Except Google Ireland Ltd. (EU), the processors listed above are based in the United States. Transfers to them are protected by Standard Contractual Clauses (SCCs) pursuant to EU Commission Implementing Decision (EU) 2021/914. We additionally apply supplementary technical measures — including encryption in transit (TLS 1.2+) and at rest (AES-256) — to maintain an equivalent level of protection.
6. AI Transparency Notice
OktaHub uses artificial intelligence (OpenAI GPT and Anthropic Claude models, reached through OpenRouter; see Section 4) to generate personalised training programs, meal plans and weight-cut plans, and the Okta Coach chat replies. These are generated based on the profile data you provide during onboarding. The AI does not make decisions with legal effect on you. You can always request human review by contacting support. (EU AI Act Art. 52 transparency obligation.)
7. Data Retention
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data | Until account deletion (immediate) | Service delivery |
| Training & meal plans | Until account deletion | Core feature data |
| Payment records | 10 years | § 147 AO (German tax law) |
| Chat history | Until account deletion or manual clear | User preference |
| Error logs | 90 days | Debugging only |
| Cookie consent record | 1 year | Consent audit trail |
8. Your Rights under GDPR (Art. 15–22)
- Access (Art. 15): Request a copy of all data we hold about you
- Rectification (Art. 16): Correct inaccurate data via Settings
- Erasure (Art. 17): Delete your account and all data via Settings → Delete Account. See Delete your account for what is deleted and what is kept
- Portability (Art. 20): Export your training data in JSON format via Account settings
- Object (Art. 21): Object to processing based on legitimate interests
- Restrict processing (Art. 18): Request temporary restriction of data processing
- Automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. OktaHub's AI-generated programs are recommendations only, not automated decisions with such effect — see Section 6
- Withdraw consent: Where processing is based on consent, you may withdraw at any time without affecting prior lawful processing
To exercise any right, email support@oktahubapp.pro. We will respond within 30 days (GDPR Art. 12(3)).
9. Cookies
We use essential cookies for authentication (Clerk session tokens) and a consent preference cookie. No advertising or cross-site tracking cookies are used. See our Cookie Policy for full details.
10. Security
- All data encrypted in transit (TLS 1.2+)
- Database encrypted at rest (AES-256)
- Row-level security enforced on all database tables
- JWT authentication on all API endpoints
- API keys never exposed to client-side code
11. Children
OktaHub is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with data, contact us immediately and we will delete it.
12. Changes to This Policy
We will notify registered users of material changes by email at least 14 days in advance. Continued use after the effective date constitutes acceptance.
13. Supervisory Authority
You have the right to lodge a complaint with your local data protection authority. In Bavaria, Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.
14. Contact
Email: support@oktahubapp.pro
Vitor Augusto Gorla · Lenkersheimerstr. 10A · 90431 Nürnberg · Germany