Legal
Privacy Policy
Your privacy matters to us. This policy explains what personal data we collect when you use the Tande mobile app, the tande.app website and our newsletter, why we collect it, and how you stay in control of it.
Who we are
The controller responsible for your personal data is DELTOK TECHNOLOGIES d.o.o., Regentova ulica 9, 2000 Maribor, Slovenija, registration number 7603568000 (“Tande”, “we”, “us”).
For any privacy question or request, contact us at privacy@tande.app.
Data we collect
We only collect what we need to run Tande and make it useful for you:
- Account data — name, email address, password (stored only as a secure hash), language, and an identifier from Apple or Google if you sign in with them.
- Profile and goals — age or year of birth, sex, height, weight, fitness level, goals, training and dietary preferences.
- Health and fitness data — workouts, body measurements, meals and nutrition logs, progress photos you choose to add, and data you import from Apple Health or Google Health Connect.
- Usage and device data — how you interact with the app, device model, operating system, app version, crash reports, IP address and approximate location derived from it.
- Purchase data — subscription status and transaction identifiers from the App Store or Google Play. We never receive your full card details.
- Communications — messages you send to support and your email address if you subscribe to our newsletter.
- Website data — information stored in your browser as described in our Cookie Policy.
Health data
Some of the data you log in Tande, such as body measurements and nutrition, is data concerning health — a special category of personal data under Article 9 GDPR.
We process health data only with your explicit consent, which you give in the app before such data is used. You can withdraw it at any time in the app settings or as described in Your data rights. We never sell health data or use it for advertising.
Why we use your data and our legal bases
- To provide Tande — create your account, build personalized workout and nutrition plans and track your progress. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR), and your explicit consent for health data (Art. 9(2)(a) GDPR).
- To manage subscriptions — verify purchases and keep accounting records. Legal basis: contract (Art. 6(1)(b)) and legal obligations under tax and accounting law (Art. 6(1)(c)).
- To keep Tande secure and working — prevent fraud and abuse, fix bugs and monitor performance. Legal basis: our legitimate interest in a safe, reliable service (Art. 6(1)(f)).
- To improve Tande — understand which features are used, using aggregated or pseudonymized data where possible. Legal basis: your consent where required for analytics (Art. 6(1)(a)), otherwise our legitimate interests (Art. 6(1)(f)).
- To send newsletters and offers — only if you opt in. Legal basis: consent (Art. 6(1)(a)). Every email contains an unsubscribe link.
- To support you and meet legal obligations — answer your requests and comply with the law. Legal basis: contract, legal obligation and legitimate interests.
SI-powered guidance
To generate personalized recommendations, Tande sends the relevant parts of your profile and logs to SI service providers that process the data on our behalf. They are contractually bound to use it only to provide the service to us and not to train their own models on it.
SI suggestions are automated and can be wrong. They are not medical advice and do not produce decisions with legal or similarly significant effects on you within the meaning of Article 22 GDPR.
International transfers
We store data primarily in the European Union. When a provider processes data outside the EU/EEA, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses with additional safeguards where needed.
How long we keep data
- Account, profile and health data — for as long as your account is active. After you delete your account, we erase it within 30 days, and from backups within 90 days.
- Purchase and invoicing records — as long as tax and accounting law requires (generally up to 10 years).
- Security logs — up to 12 months.
- Newsletter data — until you unsubscribe.
- Support conversations — up to 3 years after your request is resolved.
How we protect your data
We use encryption in transit (TLS) and at rest, strict access controls, the principle of least privilege and regular reviews of our systems and providers. No system is completely secure, so if we ever become aware of a breach affecting you, we will notify you and the authorities as the law requires.
Your rights
You can access, correct, export or delete your data, restrict or object to its processing, and withdraw consent at any time. See Your data rights (GDPR) for how to do this, including how to delete your account.
Children
Tande is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as Tande evolves. The date at the top shows the latest version. If changes are significant, we will let you know in the app or by email before they take effect.
Contact and complaints
Write to us at privacy@tande.app. You also have the right to lodge a complaint with a supervisory authority — in Slovenia, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia) — or with the authority in the EU country where you live or work.