GDPR Compliance

Last updated: November 4, 2025

Your Rights Under GDPR

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following data protection rights:

How to Exercise Your Rights

Online (Fastest)

1. Log into your Plate Progress account
2. Go to Settings → Privacy & Data
3. Use the self-service buttons for data export or account deletion
4. You'll receive a confirmation email when your request is processed

By Email

Send your request to: privacy@plateprogress.com

Please include:

• Your full name and email address associated with your account
• The specific right you wish to exercise
• Any additional details or context

Response Time

We will respond to your request within:

• Data Export: Within 48 hours (usually immediate)
• Account Deletion: Within 30 days, with confirmation email
• Other Requests: Within 30 days as required by GDPR

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contractual Necessity

Processing is necessary to provide the Service you've signed up for (e.g., storing workout data, managing your account, processing Premium subscriptions).

Legitimate Interests

We have legitimate interests in processing your data to improve the Service, prevent fraud, and ensure security. We balance these interests against your privacy rights.

Consent

For optional features like analytics, marketing emails, or social features, we process data based on your explicit consent, which you can withdraw at any time.

Legal Obligations

We may process data to comply with legal requirements, such as responding to lawful requests from authorities.

Data Protection Measures

Technical Safeguards

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest
• Row-Level Security: Database policies prevent unauthorized access to user data
• Secure Authentication: Industry-standard password hashing and session management
• Regular Audits: Security assessments and vulnerability scans

Organizational Safeguards

• Access Controls: Minimal team access with role-based permissions
• Data Minimization: We only collect data necessary for the Service
• Privacy by Design: Privacy considerations built into all features
• Staff Training: Team members trained on data protection best practices

Data Transfers

Your data may be transferred to and processed in the United States and other countries. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) - Approved by the European Commission
• EU-US Data Privacy Framework - For US-based service providers
• Adequate Safeguards - As recognized under GDPR Article 46

Our Service Providers

• Supabase (Database & Auth) - Hosted in EU region (Ireland/Frankfurt)
• Vercel (Hosting) - Global CDN with primary EU data centers
• Stripe (Payments) - GDPR-compliant payment processor, EU-US DPF certified
• Resend (Emails) - Transactional email service with EU infrastructure

All service providers are bound by Standard Contractual Clauses (SCCs) and comply with GDPR requirements for international data transfers.

Data Retention

Automated Decision-Making

We do NOT engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you. Features like XP calculations, PR tracking, and leaderboards are purely informational and for gamification purposes.

Children's Privacy

Our Service is not directed at children under 13 (or the applicable age of consent in your country). We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it immediately.

Data Breach Notification

In the event of a data breach that affects your personal data, we will:

• Notify the relevant supervisory authority within 72 hours (if required by GDPR)
• Inform affected users without undue delay if the breach poses a high risk
• Provide details about the breach and steps we're taking to address it
• Offer guidance on protecting yourself from potential consequences

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe we have not complied with GDPR.

Other EU residents: You may also contact your local data protection authority. Find your authority at edpb.europa.eu

Contact Our Data Protection Officer

For any GDPR-related questions or to exercise your rights:

• Email: privacy@plateprogress.com
• Subject Line: "GDPR Request" or "Data Protection Inquiry"

Updates to This Policy

We may update this GDPR compliance page to reflect changes in our practices or legal requirements. Significant changes will be communicated via email and in-app notification.