This policy explains how Wonop ApS handles personal data when you visit the Outlift website, use the training app, buy access or contact us. The website and the signed-in app have different data needs.
Who is responsible
Wonop ApS is the data controller. Our address is Klokagervej 26, 9800 Hjørring, Denmark; company registration number CVR 41904143. Contact support@getoutlift.com about this policy or your data.
Data we use and why
- Account information: your email address and name, used to provide your account, send sign-in codes and communicate about the service.
- Training profile: your goals, experience, available time, training frequency, bodyweight and lift maxes; optional profile fields include height, date of birth, body-fat percentage, sex and joints you ask the app to work around.
- Training records: your gyms, equipment, plans, sessions, logged sets and weigh-ins, used to provide and maintain your training history.
- Billing records: purchases, payment status and payment-provider customer identifiers, used to manage access, renewals and accounting. Card details are handled by Stripe rather than stored by Outlift.
- Technical and support records: IP addresses and request information in server logs, and messages you send us, used to operate the service, investigate faults, prevent abuse and answer requests.
You supply account and training information directly. Payment status comes from the payment provider. Technical records arise when your browser contacts the service. Visiting this marketing website does not itself create a training profile.
Legal grounds
We process account, service and payment information where necessary to perform our agreement with you, and accounting records to meet legal obligations. Operating and securing the service and responding to general enquiries are legitimate interests, balanced against your rights. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Some profile information may reveal health data. Where Article 9 GDPR applies, explicit consent is required in addition to an Article 6 basis. Supplying a field alone should not be treated as a substitute for that consent. You can remove optional information or contact us to withdraw consent; this may limit the personalised functions that depend on it.
Service providers and external sites
The existing Outlift service documentation identifies Scaleway for hosting, storage, queues and sign-in email, with application data hosted in Amsterdam, and Stripe for payments. Stripe may act as an independent controller for its own payment, compliance and fraud-prevention purposes. See Stripe’s privacy policy.
The public roadmap is hosted by Featurebase. Opening that link takes you to a separate service. Information you post on a public board may be visible to others; do not post passwords, payment details or private health information. Contact support privately for account-specific requests.
If you allow cookies on the consent banner, we use Google Ads, provided by Google Ireland Limited, to measure which of our ads lead to sign-ups and purchases. Google then receives the ad click identifier, the step that happened and, for checkout and purchases, the price and currency, together with the technical data any web request carries, such as your IP address and browser. The legal basis is your consent, which you can withdraw at any time through the cookie policy. Google processes this data under its own privacy policy and may transfer it outside the EEA.
We may disclose information where required by law or as necessary to establish or defend legal claims. We do not sell personal data.
International transfers
Core application hosting is described as EU-based in the existing service documentation. External providers may process information outside the EEA. Where we transfer personal data to a country without an adequacy decision, an appropriate transfer mechanism, such as standard contractual clauses, must apply. Contact us for information about the safeguards relevant to your data.
How long information is kept
Account and training data are retained while your account is active or until you delete the relevant records. Account deletion removes the associated profile and training records, subject to information we must retain for legal obligations or claims. Accounting records are retained for five years from the end of the financial year concerned, as stated in Outlift’s existing policy.
Technical logs are retained for operational and security needs; support correspondence is retained for the enquiry and any related dispute. Exact log and backup retention periods need to be confirmed against the deployed service before this draft is published.
Your choices and rights
Depending on the circumstances, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent. These rights are subject to applicable legal conditions; deletion does not remove records we are legally required to keep.
The app provides data export and account deletion in Settings. You can also email support@getoutlift.com. We normally respond within one month; where the law permits an extension, we will explain it. We may ask for information needed to verify your identity.
You may complain to Datatilsynet, the Danish supervisory authority, or the authority where you live or work. Read about GDPR rights at the European Commission.
Training recommendations
Outlift selects movements and loads using your training information and available equipment. These recommendations are not decisions intended to have legal or similarly significant effects. You can change exercises and weights; the app does not supervise your technique or replace individual professional advice.
Cookies, age limits and changes
See our cookie policy for browser storage. Outlift’s existing terms limit accounts to people aged 16 or over and purchases to adults. Contact us if you believe a younger child’s data has been provided.
We update this policy when practices change. Material changes will be explained before they take effect where required. The date above identifies this version.