Privacy Policy

1. What does Moveya do?

Moveya is a booking platform that enables members ("Members") to discover, book, and attend fitness classes and related offerings operated by independent studios, gyms, and trainers ("Studios" or "Partners"). Moveya provides the technology platform, including account management, scheduling, payments where applicable, and optional features such as recommendations and health insights.

Moveya does not own, operate, or instruct at Studios. When you book a class, you enter into a direct relationship with the Studio offering that class. Moveya facilitates the reservation and, where applicable, payment processing.

The Site serves three primary audiences: Members who book classes; Studios and trainers who list and manage Offerings; and Moveya administrators who review studio applications and operate the platform.

2. What personal information does Moveya collect?

We collect or receive personal information in several ways. Often you choose what information to provide, but sometimes we require certain information for you to use the Site and for us to provide the services you request.

3. How does Moveya use personal information?

We use personal information for the following purposes:

• Operating the Site: To create and manage accounts, process bookings and waitlists, facilitate payments and refunds through Stripe (including class bookings and class packs), manage pack entitlements and credit redemptions, display Studio and class listings, record attendance, and deliver the core booking experience. If a Studio has connected Instagram, this includes displaying that Studio’s authorised Instagram media on its public profile.
• Essential processing: To authenticate you, maintain sessions, secure the Site, prevent fraud and abuse, enforce our Terms of Use, and cache your own data so the app performs reliably. Essential processing cannot be turned off while you use Moveya.
• Communication: To send service-related messages such as booking confirmations, cancellations, reminders, security alerts, and account notices. These transactional messages are sent regardless of optional marketing preferences.
• Customer support: To investigate, respond to, and resolve inquiries, complaints, and service issues.
• Optional analytics: If you opt in, to understand how the Site is used — including which pages or screens you open and which buttons or links you tap — measure performance, and improve features. Aggregated trends may be reviewed by Moveya platform admins. Studio dashboards may show aggregated traffic trends only where applicable.
• Optional personalisation: If you opt in, to tailor class recommendations using your preferences, favourites, booking history, and activity on Moveya. This does not include health data unless you separately enable health consent.
• Optional marketing: If you opt in, to send promotional push notifications about Moveya, Studios, or related offers. Booking and reminder notifications are not part of this toggle.
• Health insights: If you separately give explicit consent under Settings → Health & Privacy, to use health and wearable signals (and, where you provide it, cycle information) in class recommendations, readiness features, and optional AI Insights. Health data is not used for marketing or advertising.
• AI-generated insights: To generate optional Member AI Insights and, where configured, recommendation explanations. These features may send relevant account activity (such as bookings, preferences, and favourites) to AI processors listed in "Third-party services". Health and wearable signals are included only when health recommendation consent is enabled. Studio AI reports use studio operational metrics for studio operators and do not include member health-consent data. AI outputs are informational and do not, by themselves, produce legal or similarly significant effects about you.
• Legal and business purposes: To comply with law, respond to lawful requests, protect rights and safety, and support audits, recordkeeping, and corporate transactions.

4. Consent categories

Moveya uses a consent model that separates essential processing from optional features. You can manage optional categories in Settings → Privacy & Data when signed in, or through the cookie and consent banner before you sign in.

5. Who does Moveya share personal information with?

Moveya does not sell your personal information to third parties for their own marketing purposes. We do not operate third-party advertising networks on the Site.

• Service providers. We use vendors to operate the Site — including hosting, authentication, databases, payments, maps, push delivery, email delivery, and AI processing — only to perform services on our behalf. Named providers are listed in "Third-party services".
• Studios and trainers. When you book a class or purchase a class pack, we share information needed to fulfil the reservation or pack purchase — such as your name, contact details, booking status, attendance, and relevant entitlement or credit-redemption details — with the relevant Studio or trainer.
• Wearable and health providers. If you connect Apple Health, Google Fit / Health Connect, WHOOP, or similar services, data flows according to your connection settings and the provider's own privacy policy.
• Instagram / Meta. If a Studio connects Instagram, we exchange data with Meta as needed to complete login and to retrieve the media the Studio authorises. Cached posts shown on a Studio profile are visible to other users and visitors of that profile. Members who open an Instagram link leave Moveya and are subject to Meta’s terms and privacy policy.
• Other Members and the public. Content you choose to make public — such as reviews, ratings, or public Studio and trainer profiles — may be visible to other users and visitors. Studio listings, schedules, practitioner names, and Instagram posts a Studio has authorised us to display are also publicly accessible.
• Legal and safety. We may disclose information to law enforcement, regulators, courts, or other parties when required by law, to protect rights and safety, or to respond to valid legal process.
• Business transfers. If Moveya is involved in a merger, acquisition, reorganisation, or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy.
• With your consent. We may share information in other circumstances where you have given consent or as otherwise permitted by law.

6. Cookies and similar technologies

We use cookies, local storage, and similar technologies to recognise you when you visit the Site and to support essential and optional features.

When you first visit the Site, you may see a consent banner that lets you accept or reject optional categories. You can change your choices at any time in Settings → Privacy & Data.

Moveya does not currently respond to browser "Do Not Track" signals because there is no uniform industry standard. Where required by law, we honour applicable opt-out signals such as Global Privacy Control (GPC).

• Essential cookies and storage: Required for sign-in, session management, security, and core booking functionality.
• Optional analytics storage: Used only if you accept usage analytics in the consent banner or Settings. Supports first-party page/screen views and UI interaction events, and Google Analytics cookies and similar identifiers on the website.
• Preference storage: Used to remember your consent choices, theme, and similar settings.

7. Health and sensitive data

Some information we process may be considered sensitive under applicable law, including health and fitness data, cycle information, precise geolocation, and payment information.

Special category data. Where health, wearable, or cycle information constitutes special category personal data under UK GDPR, we process it only where we have both a lawful basis under Article 6 and an applicable Article 9 condition. For Moveya's optional health and wearable features, we generally rely on your explicit consent under Article 9(2)(a), together with consent under Article 6(1)(a). That consent must be specific and affirmative; it is separate from analytics and marketing; and you can withdraw it at any time in Settings → Health & Privacy without affecting processing carried out before withdrawal.

Connecting Apple Health, Google Fit / Health Connect, WHOOP, or similar services is optional. Using synced or entered health signals — including sleep, recovery, activity, readiness, and any cycle information you choose to provide — for class recommendations, readiness personalisation, or AI Insights requires the Health & Privacy opt-in (off by default). We do not use health data for advertising or marketing.

When that consent is enabled, relevant health signals may be sent to AI processors (see "Third-party services") to generate insights. When consent is off, AI Insights and recommendations continue without those health signals. Disconnecting a wearable or withdrawing consent does not by itself delete historical health summaries you already stored; you can delete health data in Health & Privacy settings, or delete your account.

Moveya is not a medical provider. Health features are not medical advice. Do not use Moveya to diagnose, treat, or manage a health condition.

8. Third-party services

The Site relies on the following third-party providers (among others). Each processes data according to its own privacy policy:

• Vercel — application hosting and related infrastructure for moveya.io
• Google Analytics — optional website usage measurement when you accept analytics cookies (https://policies.google.com/privacy)
• Supabase — authentication, database, and file storage (https://supabase.com/privacy)
• Stripe — payment processing and Studio payouts (https://stripe.com/privacy)
• Mapbox — maps and location display where shown (https://www.mapbox.com/legal/privacy)
• Expo — mobile push notification delivery
• Apple Health, Google Fit / Health Connect, WHOOP — optional wearable and health integrations you choose to connect
• Meta / Instagram — optional Studio Instagram login and media display when a Studio manager connects an Instagram account (https://privacycenter.instagram.com/policy)
• Vercel AI Gateway — routes optional Member AI Insights, studio AI reports, and recommendation-explanation requests to model providers on our behalf
• OpenAI — large language models used via the AI Gateway for generative insights and explanations (https://openai.com/privacy)
• Anthropic — large language models used via the AI Gateway for generative insights and explanations (https://www.anthropic.com/privacy)

AI processors receive only the data needed to generate the requested insight or explanation. For Member AI Insights, that may include account activity you authorise the feature to use; health and wearable signals are included only when health recommendation consent is enabled. Studio AI reports use studio operational metrics (for example bookings, attendance, and aggregated usage trends) for studio operators and do not include member health-consent data. Where the provider contract allows, we configure AI features so submitted customer content is not used to train foundation models.

Links on the Site to third-party websites or apps are governed by those parties' privacy policies, not this one.

9. International data transfers

Moveya Fit Ltd is based in the United Kingdom. Personal information may be processed in the United Kingdom and in other countries where our service providers operate (including the United States), for example for hosting, authentication, payments, maps, push delivery, analytics, and AI processing.

Where personal information is transferred outside the United Kingdom, we use a lawful transfer mechanism required by UK data protection law — which may include a UK adequacy regulation, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, depending on the provider. You may email privacy@moveya.io for more information about the safeguards that apply to a particular transfer.

10. Data retention

We keep personal information only as long as needed for the purposes in this Privacy Policy and to meet legal, tax, and accounting duties. Typical periods (or criteria) are:

• Account profile data — while your account is active; deleted or anonymised after account deletion, subject to legal holds
• Booking, pack entitlement, payment, and refund records — typically up to 6 years after the relevant transaction for accounting, tax, chargeback, and dispute purposes
• Support and contact messages — typically up to 2 years after the last related message, unless a longer period is needed for an ongoing matter
• Marketing consent records — while marketing consent is active, and for a reasonable period afterwards to evidence consent or withdrawal
• Optional analytics events — typically up to 24 months, then deleted or aggregated
• Health and wearable summaries — until you delete them in Health & Privacy settings, or your account is deleted; withdrawing recommendation consent stops new use for recommendations and AI Insights but does not automatically erase stored summaries
• Studio Instagram connections — access tokens and cached media while the Studio remains connected; deleted when the Studio disconnects Instagram or the Studio account is deleted
• Backups — rotated on our providers' backup schedules; deleted copies may persist until the next rotation completes

Class-pack entitlements and related bookings are retained while credits remain usable or while we need the records for refunds, disputes, accounting, or support — including after a Studio deactivates the underlying pack product.

If deletion is not immediately possible (for example backup archives), we securely store the data and isolate it from further processing until deletion is possible.

11. Security

We use technical and organisational measures designed to protect personal information, including encryption in transit (HTTPS/TLS), access controls, and monitoring for vulnerabilities. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential. Notify us promptly if you believe your account has been compromised.

12. Your privacy rights

Depending on where you live, you may have the following rights regarding your personal information, subject to applicable law and exceptions:

• Access and portability — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate personal information.
• Deletion — request deletion of personal information we have collected from you.
• Opt-out — opt out of optional analytics, personalisation, and marketing through Settings → Privacy & Data, or reject optional cookies through the consent banner.
• Health consent — enable or withdraw health data use for recommendations and AI Insights in Settings → Health & Privacy.
• Objection and restriction — object to or request restriction of certain processing, where applicable law provides this right.
• Non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise these rights, sign in and update your Settings, delete your account in the Moveya app via Profile → Settings → Account → Delete account, use our public account deletion page at /account/delete (also linked from the site footer), or contact us using the details in "How to Contact Us" below. We may need to verify your identity before fulfilling a request.

Account deletion permanently removes your login and associated product data. It is not a temporary freeze. Some records may still be retained where required for legal, tax, accounting, chargeback, or dispute purposes, as described in "Data retention" above.

If you opt out of marketing push notifications, we may still send transactional messages related to your bookings and account.

13. United Kingdom privacy rights

Moveya is a trading name of Moveya Fit Ltd, a company registered in England and Wales. Company number 17341833. For UK data protection law, Moveya Fit Ltd is the data controller of personal information collected through the Site.

This Privacy Policy is intended to provide notice at or before the point of collection, as required by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

14. Users outside the United Kingdom

Moveya Fit Ltd is operated from the United Kingdom. If you access the Site from outside the UK — including from the European Economic Area — local data protection laws may give you additional rights.

We apply the same privacy controls and consent choices described in this policy regardless of where you use Moveya. Optional analytics, personalisation, and marketing can be managed in Settings → Privacy & Data.

Moveya does not sell your personal information. We do not use third-party advertising cookies or share personal information for cross-context behavioural advertising.

If you believe local law gives you rights we have not addressed here, or you wish to make a privacy request, please email privacy@moveya.io with "Privacy Request" in the subject line, or use our contact page.

15. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on the Site and update the "Last updated" date.

If we make material changes, we will provide reasonable notice by email, in-app notice, or another appropriate method. Where required by law, we will seek your agreement before changes take effect.

If you do not agree to an updated Privacy Policy, you must stop using the Site. The "Last updated" date at the top of this page shows when the policy was most recently revised.

16. How to contact us

Moveya is a trading name of Moveya Fit Ltd, a company registered in England and Wales. Company number 17341833. Moveya Fit Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Registration number ZC217978.

Privacy questions or requests: email privacy@moveya.io with "Privacy Policy" or "Privacy Request" in the subject line, or use our contact page. General support: support@moveya.io.

We aim to respond to privacy requests as soon as reasonably practicable and in accordance with applicable law.