Last updated: April 2026
This Privacy Policy explains how KEJ SASU ("we", "us", "KEJ") collects, uses, and protects your personal data when you use the Fitntial mobile application and the website fitntial.tech (together, the "Service").
We comply with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act ("Loi Informatique et Libertés").
The data controller is:
When you create an account, we collect:
To provide you with a personalized experience, you may enter:
If you upload a profile picture, it is stored in Firebase Storage and associated with your account. You can replace or delete it at any time from the app.
Fitntial can integrate with Health Connect (Android) and the Samsung Health SDK, but only if you explicitly grant permission in the app. When you do:
If you use the community features, we process friends lists, friend requests, challenge invitations, and any comments or messages you post. Some of this data is visible to other Fitntial users (see section 2.8).
Certain features are social by design. The following may be visible to other Fitntial users:
Sensitive data (weight, BMI, meals, exact workouts) is not visible to other users by default.
Subscription payments are processed by Google Play Billing. We do not collect or store your payment card details. We receive from Google Play: your order ID, subscription status (active, cancelled, grace period), and the associated Google account email for invoicing and support.
Under GDPR Article 6, we process your personal data based on the following legal grounds:
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account; authenticate you | Email, UID, password, Google Sign-In data | Performance of a contract (Art. 6(1)(b)) |
| Deliver the core Service: workouts, nutrition tracking, AI plans | Profile, fitness, activity, preferences data | Performance of a contract (Art. 6(1)(b)) |
| Community & leaderboards | Display name, profile picture, points, public comments | Performance of a contract (Art. 6(1)(b)) |
| Import Health Connect / Samsung Health data | Steps, calories, health metrics | Explicit consent (Art. 6(1)(a) & 9(2)(a) for health data) |
| Process subscription payments | Google Play order ID, subscription status | Performance of a contract (Art. 6(1)(b)) |
| Maintain invoices and accounting records | Subscription and payment records | Legal obligation (Art. 6(1)(c) — French Code de commerce L.123-22) |
| Analytics, service improvement, bug fixing | Crash reports, pseudonymised usage events, technical data | Legitimate interest (Art. 6(1)(f)) — improving reliability and UX |
| Prevent fraud, abuse, security incidents | IP address, device info, abnormal activity logs | Legitimate interest (Art. 6(1)(f)) |
| Respond to your requests (support, rights) | Contact details, message content | Legitimate interest & legal obligation |
Health data (from Health Connect or Samsung Health) is considered a special category under GDPR Article 9. We process it exclusively based on your explicit consent, which you can withdraw at any time without affecting the lawfulness of prior processing.
To operate Fitntial, we rely on carefully selected providers. Each acts as a processor or sub-processor bound by a data processing agreement (DPA).
| Provider | Role | Location |
|---|---|---|
| Google Ireland Ltd. (Firebase) | Authentication, Realtime Database, Firestore, Storage, Cloud Functions, Crashlytics, Analytics | EU; some sub-processors in the US (under EU-US Data Privacy Framework) |
| Google LLC (Google Sign-In) | Third-party authentication | US (under EU-US Data Privacy Framework) |
| Google LLC (Google Play Billing) | Subscription payments | US (under EU-US Data Privacy Framework) |
| Samsung Electronics Co., Ltd. | Samsung Health SDK integration (if you enable it) | South Korea — data stays on your device; only aggregated metrics are imported into Fitntial if you grant permission |
| OVH SAS | Website hosting (fitntial.tech) |
France (EU) |
We do not sell your data, and we do not share it with advertising networks or data brokers.
Firebase services are primarily hosted in the European Union. However, some Google sub-processors may be located in the United States. Such transfers are covered by:
You can request a copy of the safeguards in place by contacting support@fitntial.com.
We retain your personal data only for as long as necessary for the purposes described above:
| Data category | Retention period |
|---|---|
| Account and profile data | Until you delete your account |
| Fitness, nutrition, and activity data | Until you delete your account |
| Profile picture | Until you delete it or your account |
| Health Connect / Samsung Health data | Until you revoke the permission or delete your account |
| Crashlytics reports | 90 days (Google default) |
| Firebase Analytics events | Up to 14 months (pseudonymised) |
| Support correspondence | 3 years after last contact |
| Invoices and accounting records | 10 years (French Code de commerce L.123-22) |
| Encrypted backups after deletion | Up to 7 days (Firestore point-in-time recovery) |
For more details on account deletion, see our account deletion page.
We implement appropriate technical and organizational measures to protect your data, including:
No system is 100% secure. In case of a personal data breach likely to create a risk to your rights and freedoms, we will notify the CNIL within 72 hours and, where required, inform you directly without undue delay (GDPR Art. 33–34).
Under the GDPR, you have the right to:
You can exercise most of these rights directly from the app (edit profile, delete account) or by contacting support@fitntial.com. We will respond within one month (extendable by two months for complex requests).
We may ask you to verify your identity (e.g. confirm from the email address associated with your account) to protect your data from unauthorized access.
Fitntial is not intended for children under 16 years old. We do not knowingly collect personal data from minors under that age. If you believe a child under 16 has provided us with personal data, please contact support@fitntial.com and we will promptly delete the information.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. The "Last updated" date at the top of this page indicates the latest revision.
For material changes (new processing, new sub-processor, new purpose), we will notify you through the app or by email at least 30 days before they take effect. Continued use of the Service after that date constitutes acceptance of the revised Policy.
For any question or request regarding your personal data, please contact:
KEJ SASU
229 rue Solférino, 59000 Lille, France
Email: support@fitntial.com
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In France, this is the:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 place de Fontenoy — TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr