Privacy Policy

JackedCycle (“we”, “us”, “our”) is the trading name under which the data controller responsible for your personal data operates the website and digital fitness plan service at jackedcycle.com. The legal data controller is Adam Branný, a self-employed sole trader (OSVČ) registered in the Czech Republic, IČO 29864381, registered address Bystřice 1306, 739 95 Bystřice, Czech Republic. JackedCycle is not itself a registered legal entity.

Contact: support@jackedcycle.com

2.1 Account data — checkout requires creating an account. We (via Supabase) store your email address and an encrypted/hashed password. We never see or store your password in plain text.

2.2 Contact data — your name and email address, collected at checkout to deliver your plan and communicate with you about your order.

2.3 Health and body data — age, weight, height, body fat percentage, fitness level, sleep hours, training preferences, and fitness goals. This is special category data under GDPR Article 9. It is collected solely to generate your personalized fitness plan. We collect it only with your explicit consent.

2.4 Payment data — your payment is processed entirely by Stripe. JackedCycle never sees, stores, or has access to your card details.

2.5 Usage and attribution data — a pseudonymous session identifier, the pages/events you interact with (e.g. quiz started, checkout initiated), and, where present, marketing campaign parameters (UTM source/campaign/content) from the link you arrived on. This is stored in our database on our own infrastructure to understand how the site is used and which campaigns drive orders. We do not use Google Analytics or any third-party analytics tool. Separately, the Meta Pixel sends Meta a small number of bare funnel-milestone signals (page views, quiz started, quiz completed, checkout started) and, after a purchase, the sale amount and currency — never your name, email, quiz answers, or any health/body data. See Sections 5 and 7 for when this is active and what it does and does not include.

2.6 Security and consent records — your IP address and browser/device information (User-Agent), recorded against your quiz submissions and orders for fraud prevention, abuse prevention, and as a security log of activity on the service. At checkout, we also record a timestamped confirmation of which consent checkboxes (terms, health-data processing, age/responsibility) you accepted and against which version of these policies, so we can demonstrate that consent was properly obtained as required by GDPR Article 7(1).

• Contract performance (Article 6(1)(b) GDPR) — processing your account, name, email, and order data to fulfil your purchase and deliver your plan.
• Explicit consent (Article 9(2)(a) GDPR) — processing your health and body data to generate a personalized fitness plan. You provide this consent via the checkbox at checkout. You may withdraw it at any time by contacting us.
• Legal obligation (Article 6(1)(c) GDPR) — retaining order and payment records for as long as required under applicable Czech tax and accounting law.
• Legitimate interests (Article 6(1)(f) GDPR) — maintaining records of transactions for operational purposes, understanding site usage and marketing performance through our own first-party analytics, and security/fraud prevention (IP address and device logging, abuse-rate limiting, an audit trail of administrative access to customer data).

Your fitness plan is generated automatically by our own algorithm, based on the data you provide in the questionnaire (age, weight, goals, activity level, etc.). We do not use external or third-party AI services to do this, and we do not share your data with any third party for this purpose.

This is a form of automated processing under GDPR Article 22. Under Article 22(3), you have the right to express your point of view, contest the outcome, and request human review of the plan generated for you, by contacting us at support@jackedcycle.com.

We share your data only with the following third-party service providers, strictly for the purposes described:

• Stripe — payment processing. Stripe processes your payment data as an independent data controller. See Stripe's privacy policy at stripe.com/privacy.
• Resend — email delivery of your fitness plan. Resend receives your name and email address solely to transmit the delivery email on our behalf.
• Supabase — our database, authentication, and file storage provider. Supabase hosts your account credentials, order data, quiz/health data, and generated plan files on our behalf, hosted in the EU.
• Vercel — our website hosting provider. Vercel serves the website and processes standard technical/server log data (such as your IP address and browser type) as part of operating the infrastructure.
• Meta (Facebook/Instagram) — active on every page for visitors outside the EU/EEA/UK/Switzerland, or after you accept the cookie banner if you are in one of those regions, to measure the performance of our ads. We only ever send Meta bare funnel-milestone signals (page views, quiz started, quiz completed, checkout started) and, after a purchase, the sale amount and currency — never your name, email, quiz answers, or any health/body data. These signals are sent either directly from your browser (Meta Pixel) or from our own servers (Meta Conversions API) for reliability; the same consent rule applies to both, and both carry the same limited, non-personal information. See Section 7 (Cookies) for details.

We do not sell or rent your data to any third party. Meta only receives the limited, non-personal purchase/ad-measurement signals described above.

Our database and file storage (Supabase) are hosted within the EU. Stripe, Resend, Vercel, and Meta are US-based companies; transfers of your data to these providers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data receives an equivalent level of protection to that required within the EU.

7.1 Strictly necessary — a Supabase authentication cookie (keeps you signed in), and a pseudonymous session identifier (local/session storage) for the first-party usage data described in Section 2.5. A separate long-lived, first-party device identifier cookie is also set on every visit, unconditionally, distinct from and unrelated to Meta's ad-measurement cookies described in 7.2 below (it never loads any third-party script and nothing about it is shared with Meta or any advertiser). It exists for the security and fraud-prevention purposes described in Section 2.6, and falls under the same “strictly necessary” exemption from cookie consent as the authentication cookie.

7.2 Ad measurement — the Meta Pixel sets its own cookies, used to measure ad performance for our campaigns. It sends Meta bare funnel-milestone signals (page views, quiz started, quiz completed, checkout started) and, after a purchase, the sale amount and currency only — no name, email, quiz answers, or health/body data is ever attached to any of these. If you are visiting from the EU, EEA, UK, or Switzerland, this only loads after you accept the cookie banner shown on your first visit; elsewhere, it is active on every page load, consistent with local requirements. We do not use Google Analytics or any other third-party analytics/advertising tool.

• Order and payment records: retained for as long as required under applicable Czech tax and accounting law, then securely deleted.
• Quiz and health data: retained for as long as your account exists, so your personalized plan remains accessible to you. This data is permanently deleted when you delete your account (see Section 10), or earlier upon request.
• Usage and attribution data: retained for as long as needed for the analytics/attribution purposes described in Section 2.5, or earlier upon request.
• Security and consent records: IP address, device information, and consent confirmations described in Section 2.6 are retained for as long as needed for security, fraud-prevention, and legal-compliance purposes — not on a fixed timer, since the length of time these purposes require can vary (e.g. an active fraud investigation or a legal dispute).
• Email delivery logs: retained by Resend in accordance with their own retention policy.
• Payment records held by Stripe: retained by Stripe in accordance with their own retention policy and applicable financial regulations.

Under GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw your consent to the processing of health data at any time, without affecting the lawfulness of processing before withdrawal.
• Right to human intervention — contest an automated decision and request human review, as described in Section 4.

You can delete your own account, order history, and stored plan files at any time from your account settings, which immediately and permanently removes this data from our systems (subject to the legally required retention described in Section 8).

To exercise any other right listed above, contact us at support@jackedcycle.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Address: Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Website: www.uoou.gov.cz
Email: posta@uoou.gov.cz

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated date. Continued use of the service following any changes constitutes acceptance of the revised policy.