Privacy Policy

The responsible business is [LEGAL ENTITY NAME — LEGAL_REVIEW_REQUIRED], at [REGISTERED ADDRESS — LEGAL_REVIEW_REQUIRED]. Privacy questions and requests should be sent to [PRIVACY CONTACT — LEGAL_REVIEW_REQUIRED].

We process name, email address, email-verification state, authentication provider/account information, session and account-security data. Sign-in is available through email and password or Google. Linking Google to an existing account requires an explicit authenticated action; we do not describe same-email accounts as automatically merged.

We process selected Program, Offer and specialization, purchase locale, Checkout Intent and Order identifiers and status, provider transaction references, and commercial snapshots such as amount, currency, and duration.

Digistore24 is the Merchant of Record. It processes checkout and payment details on its systems and exchanges transaction and contact information needed for purchase processing, reconciliation, refunds, and support. Currently Natty does not store full payment-card details.

We process Enrollment ownership and lifecycle, Program and specialization, onboarding state, service dates, access Entitlements, and termination information.

Onboarding may include your goal and context, weight, height, training experience and history, equipment, availability, limitations or injuries, nutrition preferences, and WhatsApp contact. This information supports personalization, coaching delivery, safety, and operations; it is not used to provide a medical diagnosis.

We keep limited audit events and operational-exception records for security, accountability, financial reconciliation, troubleshooting, and human follow-up. These may include action and entity references, timestamps, safe bounded metadata, and request or correlation identifiers where available. We do not intentionally place authentication secrets or raw payment-provider payloads in those records.

We use information to authenticate accounts, prevent abuse, process and reconcile purchases, deliver and personalize coaching, manage access and capacity, communicate service and security messages, handle support and refunds, meet legal obligations, and protect the service. The applicable legal basis and jurisdiction-specific wording remain subject to legal review.

We share only what is necessary with Digistore24 for payment and Merchant-of-Record functions; Resend for transactional and operational email delivery; Google when you choose Google authentication; and hosting or technical service providers needed to operate and secure the application.

CookieYes provides cookie-consent controls. Where analytics is configured and you consent, Google Tag Manager loads the configured Google Analytics 4 tags. Analytics remains denied and those tags are withheld when consent has not been granted or is withdrawn.

Information is retained only as needed for service delivery, account, financial, legal, security, and dispute purposes. The final retention schedule is [DATA RETENTION SCHEDULE — LEGAL_REVIEW_REQUIRED]. We use technical and organizational safeguards, but no online system can guarantee absolute security.

Depending on applicable law, you may have rights relating to access, correction, deletion, restriction, objection, portability, or complaints. The governing jurisdiction is [GOVERNING LAW / JURISDICTION — LEGAL_REVIEW_REQUIRED]. Contact [PRIVACY CONTACT — LEGAL_REVIEW_REQUIRED] so a request can be verified and handled under the applicable law.

The minimum age is [MINIMUM AGE / ELIGIBILITY — LEGAL_REVIEW_REQUIRED]. Providers may process data in other countries subject to the safeguards required by applicable law; the final transfer wording requires review once the legal entity and jurisdiction are confirmed. We will update this page and its date when this policy changes materially.