Privacy Policy
Last updated 28 October 2026
This policy explains what personal data UrFitHub collects, why, who we share it with, how long we keep it, and your rights. It applies to the website urfithub.com and the UrFitHub app.
1. Who we are
UrFitHub is operated by KRAC Technology Ltd, a company registered in Ireland. We are the “controller” of your personal data, which means we decide how it is used. You can contact us about anything in this policy at hello@urfithub.com.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account details: your name, email address, password (stored only in scrambled, hashed form), whether you joined as a client or a coach, and when you confirmed you are 18 or over, accepted our terms, and chose whether to get marketing emails. | You, when you sign up. |
| Coach profile and content: username, bio, profile photo, specialty tags, posts, images and plan files. | Coaches, when they fill in their profile or upload. |
| Activity: the coaches you follow and your subscriptions (coach, price, status and dates). | Your use of the app. |
| Payment details: a Stripe customer or account reference, and the amount and date of payments. We never see or store your full card number. | Stripe, our payment provider. Coaches give their identity and bank details directly to Stripe to get paid. |
| Reports and messages to us: what you tell us when you report content or contact us. | You. |
| Waitlist: your email address and whether you are a client or a coach. | You, if you joined our waitlist before launch. |
| Technical data: IP address, browser and device type, and the time of requests, kept in our providers’ security logs. | Your browser, automatically. |
We do not ask for health information. Please don’t share details about your health in public posts. UrFitHub is only for people aged 18 or over, and we delete accounts we find belong to anyone younger.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Creating and running your account, showing coach profiles and posts, and giving subscribers access to paid content. | Performing our contract with you. |
| Taking subscription payments and paying coaches, and sending receipts and account emails (for example, confirming your email or resetting your password). | Performing our contract with you. |
| Keeping payment and tax records. | Complying with the law. |
| Keeping the service secure, preventing fraud and abuse, and enforcing our terms. | Our legitimate interest in a safe service, which we balance against your rights. |
| Handling reports of illegal or harmful content, and answering requests from authorities. | Complying with the law (including the EU Digital Services Act) and our legitimate interests. |
| Sending marketing emails, and launch news to the waitlist. | Your consent, which you can withdraw at any time with the unsubscribe link or by emailing us. |
We do not sell your data, show you targeted advertising, or use your data to train AI models. We don’t make decisions about you by purely automated means.
4. Who can see your data
- Other users: coach profiles, posts and plan listings are visible to signed-in users. Subscriber-only posts and plans are visible only to the coach’s subscribers. Client profiles are not shown to other users.
- Our service providers (they process data only on our instructions, under a data processing agreement):
- Supabase (database, logins and file storage), with our data stored in Ireland.
- Netlify (website hosting).
- Resend (sending account emails).
- Stripe processes payments and pays coaches. Stripe is also responsible for its own use of data, for example to verify identity and prevent fraud, under the Stripe Privacy Policy.
- Authorities and advisers: police, courts or regulators when the law requires it, and our professional advisers (such as lawyers and accountants) under a duty of confidentiality.
- A buyer of our business, if UrFitHub is ever sold or merged. They would have to keep to this policy.
5. Transfers outside the EU
Some of our providers (Netlify, Resend and Stripe) are based in, or use servers in, the United States. When your data goes outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of these safeguards.
6. How long we keep it
- Account, profile and content: while your account is open. When you delete your account, we delete it within 30 days, apart from what we must keep for the reasons below. Deleted data can stay in encrypted backups for up to 30 more days.
- Payment records: 6 years after the end of the tax year, because Irish tax law requires it.
- Reports and moderation decisions: up to 2 years, or longer if needed for a legal claim.
- Waitlist: until you sign up, unsubscribe, or 12 months after launch, whichever comes first.
- Security logs: as set by our providers, typically no more than 90 days.
7. Cookies
We only use cookies that are strictly necessary to keep you signed in and keep your account secure. We don’t use analytics, advertising or tracking cookies. If we ever add them, we will ask for your consent first.
8. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive the data you gave us in a common electronic format, or have it sent to another provider; and
- withdraw your consent at any time, where we rely on it.
To use any of these rights, email hello@urfithub.com. We will answer within one month, and may ask you to confirm your identity first. It’s free.
You can also complain to the Irish Data Protection Commission (www.dataprotection.ie), or to the data protection authority where you live. If you’re in the UK, that’s the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to fix things first.
9. Security
Your data is encrypted in transit and stored with access controls that let each user see only what they are allowed to. Paid content and uploads are private and opened only through links that expire. If a breach ever puts your data at risk, we will tell the Data Protection Commission and, where the law requires, you.
10. Changes to this policy
We will post any change here with a new date. If a change matters to how we use your data, we will email you before it takes effect.
See also our Terms of Use.