Privacy policy
In short: we store the bare minimum so you can work out and track your progress. We don't sell your data. We only use your email for PantuFIT news or ads if you agree to it, and you can delete everything from the app whenever you want.
Last updated: September 29, 2026
This is a translation of the original Spanish text. If there is any discrepancy, the Spanish version prevails, unless the law of your country gives you greater protection.
1. Data controller
- Controller: [NOMBRE Y APELLIDOS O RAZÓN SOCIAL]
- Tax ID (NIF/CIF): [NIF / CIF]
- Address: [DIRECCIÓN POSTAL COMPLETA]
- Email for privacy matters: [EMAIL DE CONTACTO]
2. What data we process
| Data | Where it comes from |
|---|---|
| Username, email and password (stored encrypted, never in plain text) | You enter them when you sign up |
| Workout preferences: whether you have dumbbells or bands, and whether you prefer low-impact mode | You set them when you sign up or in your profile |
| App language (Spanish or English) | Detected from your browser or from the website you arrive from, and you can change it in your profile |
| Activity: completed workouts, date, duration, experience points, level and streak | Generated when you use the app |
| Social data: friendships, requests and applause | Generated when you use the social features |
| IP address of failed login attempts | Logged automatically for security |
| Whether or not you agree to receive PantuFIT news and ads, and the date you decided | You choose it when you sign up or in your profile |
| Website browsing data (pages viewed, device, where the visit came from) | Only if you accept analytics or advertising cookies in the banner |
We do not process health data: we don't ask for your weight, measurements, injuries or any medical information. Nor your location, your contacts or your photos.
3. Why we use it and on what legal basis
- To provide the service (creating your account, generating your workouts, saving your progress and showing your activity to your friends). Basis: performance of the contract you accept when signing up (Art. 6(1)(b) GDPR).
- To protect accounts against mass login attempts. Basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
- To send you notifications (when available), only if you turn them on. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the settings.
- To send you PantuFIT news by email and show you PantuFIT ads on social media and Google, using your email to create custom audiences (and lookalike audiences based on them). Only if you tick the corresponding box. Basis: your consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI-CE). You can withdraw it at any time from your profile.
- To measure website visits and the effectiveness of our ads using third-party cookies, only if you accept them in the banner. Basis: your consent. Details in the cookie policy.
We don't sell your data, we don't make automated decisions that legally affect you and, if you don't give permission, your data is not used for advertising.
4. Who can see your information
- Any registered user can find your username and level in the friend search.
- Only your friends (people who accepted your request, or whose request you accepted) see your workouts in the feed and can applaud them.
- Meta and Google, only if you accept ads: we share your email in hashed form (SHA-256, which cannot be read directly) with Meta Platforms Ireland Ltd. and Google Ireland Ltd. so they can show you PantuFIT ads. These companies only use it to match it against their users and discard any that don't match. They may process data in the United States under the EU-U.S. Data Privacy Framework.
- Nobody else. We don't share your data with third parties unless required by law.
5. Service providers
The data is hosted on a server provided by [PROVEEDOR DEL SERVIDOR Y PAÍS], which acts as a data processor with the safeguards required by the GDPR.
Fonts, icons and libraries are served from our own server. Neither the website nor the app loads Google or Meta tools unless you accept them in the cookie banner. The coach voice is generated by your own browser or operating system. Some browsers use their manufacturer's cloud voices: in that case they only receive the cheer phrases and the name of the exercise, never your data.
6. How long we keep it
- Account and activity data: for as long as your account exists. If you delete it, the data is erased immediately.
- IP addresses of failed login attempts: for a maximum of 24 hours.
- Consent for news and ads: until you withdraw it. If you withdraw it or delete your account, we stop sending you emails immediately and remove you from advertising audiences at the next update, within 30 days at most.
- We may keep blocked data only if a law requires us to, for the period it sets.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to [EMAIL DE CONTACTO] from your account's email address.
- Delete your account: you can do it yourself in the app, under Profile › Delete my account. Everything is erased instantly.
- Correct your preferences: from your profile.
- Withdraw consent for news and ads: from your profile, with a toggle, or from the unsubscribe link in any email.
- Cookies: from "Cookie settings" in the website footer.
If you believe we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.
8. Minors
You must be at least 14 years old to sign up, the minimum age set by Spanish law to give consent on your own behalf. If the law of your country sets a higher age, you must meet that age or have the consent of your parents or guardians. If we detect an account belonging to someone under that age, we will delete it.
9. Security
All communication is encrypted (HTTPS), passwords are stored using an irreversible hashing algorithm, and we limit login attempts to stop attacks.
10. Changes to this policy
If we change anything important, we'll let you know in the app or by email before it takes effect.