Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

For trainers and studios using Scraler to manage their clients, the trainer/studio acts as the data controller for their clients' data, and Scraler acts as a data processor on their behalf under Article 28 GDPR.

2. Data We Collect

For Trainers & Studios:

• Account information (name, email, password)
• Business information (studio name, address, subdomain)
• Payment and billing information (processed via Stripe)
• Usage data (feature usage, login times)
• If you sign in with Google or Apple: the name and email address they share with us
• If you use the AI Connector: which AI app is connected, the permissions you gave it, and a log of what it read or changed

For Clients (via Trainers):

• Identity data (name, email, phone, date of birth, gender)
• Profile photo
• Communication data (chat messages, which are encrypted)
• Payment data for trainer services (processed via Stripe Connect)

Automatically Collected:

• IP address and approximate location (country/region)
• Browser type and version
• Device type and operating system
• Pages visited and feature usage
• Timestamps and session duration

3. Health & Fitness Data (Article 9)

To provide personalized fitness and nutrition coaching, we process the following special category data as defined by GDPR Article 9:

• Physical measurements: Height, weight, body measurements, body fat percentage
• Health information: Medical conditions, injuries, physical limitations
• Dietary information: Allergies, dietary restrictions, food intolerances
• Fitness data: Workout performance, exercise records, strength metrics
• Progress data: Progress photos, weight tracking, body composition changes
• Nutrition logs: Food intake, macro tracking, meal plan adherence

Apple HealthKit Integration (iOS)

With your explicit permission, the Scraler mobile app reads health and fitness data from Apple HealthKit, including steps, heart rate, active energy burned, exercise minutes, sleep analysis, body mass, and workout sessions. We write completed workout data back to HealthKit.

HealthKit data is used solely to display your health metrics and share them with your assigned trainer. It is never used for advertising, marketing, or sold to third parties.

Legal Basis (Article 9(2)(a)): We process this data based on your explicit consent, which you provide when signing up. You may withdraw consent at any time by contacting your trainer or deleting your account.

Menstrual Cycle Tracking (optional)

If you choose to enable cycle tracking, we process: period start and end dates, flow intensity (spotting, light, medium, heavy), symptoms you select (such as cramps, mood swings, or fatigue), whether you use hormonal birth control, your average cycle and period lengths, and the cycle phase calculated from those entries. Entries may also be imported from Apple Health or Health Connect if you grant that permission.

This data is yours, and cycle tracking is off by default. It is never enabled without you turning it on. You control what your trainer can see through a sharing setting you can change at any time:

• Private (default): your trainer sees nothing at all.
• Phase only: your trainer sees your current cycle phase (for example “luteal”) so they can adapt your training. They see no dates, no symptoms, and no flow data.
• Full: your trainer sees your logged entries.

Cycle data is never used for advertising, never sold, and never shared with third parties. It is also never sent to our AI providers — no AI-generated workout, meal plan, or recipe uses cycle data as an input.

Legal Basis (Article 9(2)(a)): Cycle tracking relies on your separate explicit consent, given when you enable the feature — it is not covered by the consent you give when signing up, and it is never a condition of using Scraler. You can withdraw at any time: turning cycle tracking off stops all further processing and immediately stops any sharing with your trainer, and the “delete my cycle data” option in the app permanently erases every entry and setting. Withdrawing does not affect any other part of your account.

4. Legal Basis for Processing

5. How We Use Your Data

• Service Delivery: Providing the platform, enabling trainer-client relationships, managing workouts and meal plans
• Communication: Sending service notifications, appointment reminders, and support responses
• Payment Processing: Processing subscriptions and trainer-client payments via Stripe
• AI-Assisted Features: Generating personalized workout and meal plan suggestions (see Section 6)
• Security: Protecting accounts, detecting fraud, and maintaining platform integrity
• Legal Compliance: Meeting tax, accounting, and regulatory requirements

We do not use your data for automated decision-making that produces legal effects. AI-generated plans are always reviewed and assigned by your trainer.

6. AI Processing

Scraler uses artificial intelligence (Google Gemini) to help trainers create personalized workout and meal plans. When generating plans, your fitness goals, preferences, and relevant health information may be sent to Google Gemini.

• Google does not use API data to train their models
• Data is processed under Google's Data Processing Addendum with SCCs
• All AI-generated plans are suggestions only — your trainer reviews and approves them before assignment

AI apps your trainer connects

Your trainer can choose to connect their own AI app, such as Claude or ChatGPT, to their Scraler account. That AI app can then read the training, nutrition, check-in and progress data your trainer holds about you, your class bookings, and your chat messages with your trainer. If your trainer allows it, the app can also create and change programs and forms in their account and, for example, give you a program, workout, meal plan, check-in or habit, switch or change one you already have, invite you, reply to or withdraw a check-in, add a progress entry, send you a progress report, book or move an appointment, book you into a class, or offer you a product that you decide to buy yourself (you get a notification, as when your trainer does it). Your check-in photos are only shared if your trainer separately switches on photo access for that app, which requires your explicit consent. It can also update the profile details your trainer keeps about you, archive your account or, after your trainer confirms, delete it, as your trainer can in Scraler. If your trainer allows it, the app can also see your payment status with them, such as your subscription, open payment requests and purchases, but never your card details. It never charges you, never sends you chat messages, and never changes your logged workouts, check-in answers or messages. Your email address is not shared, except to tell you apart from another client with the same name. Your trainer decides whether to do this, chooses the AI provider, and is responsible for it as the controller of your data, including asking for your consent and telling you which provider is used. Questions about this, or withdrawing your consent, go to your trainer.

7. Data Sharing & Processors

We share your data only with trusted service providers under Data Processing Agreements (GDPR Article 28):

Some pages also load content from other providers, which then receive your IP address: Google Fonts on trainer landing pages, YouTube (privacy-enhanced mode) for videos in our Academy, and Vercel Web Analytics, which counts page views on our marketing site without cookies. If you sign in with Google or Apple, they process that sign-in under their own privacy policies. Integrations a trainer sets up themselves, such as webhooks to their own tools or an AI app they connect, are chosen by that trainer and are not our processors.

We do not sell or rent your personal data. The only marketing-related sharing we do is described below: with your consent, we share hashed identifiers with Meta, and an ad click identifier with Google, to measure how well our advertising performs.

Advertising & Cookies (Meta Pixel)

On our public marketing website (scraler.com) we use the Meta Pixel and Meta Conversions API to understand which ads lead to sign-ups and to measure advertising performance. These set cookies (_fbp, _fbc) and send Meta a limited set of event data — including your hashed (SHA-256) email address, IP address, and browser user-agent — when you visit the site or create an account.

• Legal basis: your consent (GDPR Art. 6(1)(a) / ePrivacy). These cookies and events do not fire until you accept them in our cookie banner.
• Scope: advertising measurement only — limited to the marketing site. Your trainer/client dashboard data and your health & fitness data are never used for advertising.
• Withdraw consent: reject the banner, or clear the scraler_cookie_consent value in your browser, to stop it. You can also manage ad personalization in your Meta ad settings.

Advertising (Google Ads)

After you accept cookies, our marketing site and the trainer sign-up flow load the Google Ads tag, which records that you arrived from a Google ad (the gclid click identifier) and whether you signed up. When a trainer who arrived from a Google ad starts a subscription, we send Google that click identifier and an order reference so the conversion can be counted. We do not send Google your name, email address or any client data.

Product Analytics (Microsoft Clarity)

On our public marketing website we use Microsoft Clarity to understand how visitors use the site through aggregated usage metrics, heatmaps, and session replays (recordings of cursor movement, clicks, and scrolling). This helps us improve the site's usability. Clarity automatically masks text you type (form fields, etc.) so the content of your input is not recorded.

• Legal basis: your consent (GDPR Art. 6(1)(a) / ePrivacy). Clarity does not load until you accept analytics cookies in our banner.
• Scope: the public marketing site only — not the trainer/client dashboard or your health & fitness data.
• Processor: Microsoft processes this data on our behalf under its Data Protection Addendum with SCCs. See Microsoft's privacy statement.

Health Data Is Never Shared With These Tools

Special category health data — including cycle-tracking data, progress photos, measurements, and health-app data — is never transmitted to advertising, analytics, or marketing tools. The Meta Pixel and Microsoft Clarity described above run only on our public marketing website and never receive health data.

8. International Data Transfers

Your primary data is stored in the European Union (Frankfurt, Germany). For transfers outside the EU, we rely on Standard Contractual Clauses (SCCs), Data Processing Agreements, and supplementary measures including encryption and access controls.

You may request a copy of the relevant SCCs by contacting privacy@scraler.com.

9. Data Retention

Archiving a client is a reversible pause, not deletion — the data is retained so the client can be reactivated. Permanent erasure happens when you delete the client or your account (see Section 5 of our Terms), after which data is deleted, except records we must keep by law (e.g. financial records).

10. Your Rights Under GDPR

How to exercise your rights: Via your account settings or by emailing privacy@scraler.com. We will respond within 30 days.

Right to lodge a complaint: You may contact the Autoriteit Persoonsgegevens (Netherlands) at autoriteitpersoonsgegevens.nl.

11. Data Security

• Encryption in Transit: All data transmitted over HTTPS/TLS
• Encryption at Rest: Database encryption via Supabase (AES-256)
• Message Encryption: Chat messages encrypted in transit via TLS 1.3 and at rest via AES-256
• Access Controls: Row-level security ensures trainers can only access their own clients' data
• Authentication: Secure password hashing, optional two-factor authentication
• Regular Audits: Security monitoring and vulnerability assessments

12. UK Residents

If you are in the United Kingdom, your data is protected under the UK GDPR and Data Protection Act 2018. Your rights are substantially similar to EU GDPR (see Section 10).

UK Supervisory Authority: Information Commissioner's Office (ICO) at ico.org.uk.

13. California Residents (CCPA)

California residents have additional rights under the CCPA/CPRA:

To exercise CCPA rights, email privacy@scraler.com with subject "CCPA Request". We will respond within 45 days.

14. Children's Data

Scraler is not intended for individuals under the age of 16. Trainers must ensure they have appropriate parental consent before adding clients under 16.

If you believe we have collected data from a child without consent, contact us at privacy@scraler.com.

15. Data Breach Notification

In the event of a breach that poses a risk to your rights:

• We will notify the relevant supervisory authority within 72 hours (Article 33)
• If the breach is high risk, we will notify affected individuals directly (Article 34)
• Notification will include the nature of the breach, likely consequences, and measures taken

16. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you via email or in-app notification. Continued use after changes constitutes acceptance.

17. Contact Us

If you have questions about this policy, want to exercise your rights, or have concerns about our data practices: