Privacy Policy

Apex (the website getapex.live, the iOS and Android apps and the Apple Watch app) is operated by Rosini Transports et Locations Sàrl (Rosini Solutions), based in Switzerland ("Apex", "we", "us"). We are the controller of your personal data.

Privacy contact and data protection officer (Encarregado under the LGPD): hello@rosinisolutions.com

This policy explains what we collect, why, who receives it and what rights you have. It is written to comply with the Swiss Federal Act on Data Protection (nFADP/revFADP), the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and ePrivacy rules, Brazil's General Data Protection Law (LGPD), US state privacy laws (including California's CCPA/CPRA), Canada's PIPEDA, Australia's Privacy Act and other applicable laws. Where these laws differ, we apply the most protective standard to everyone.

Rosini Transports et Locations Sàrl (Rosini Solutions)
Chemin des Bulesses 16, CH-1814 La Tour-de-Peilz
UID CHE-264.039.709 · hello@rosinisolutions.com

Account data: name, email address, password (stored only as a secure hash) or your Apple/Google sign-in identifier, language and app settings.

Profile data: age, sex, height, weight, goals, training level, available equipment, days and time available, and injuries or pain areas you report.

Health and fitness data (sensitive data): workouts, sets, loads and effort (RPE), cardio sessions, heart rate, heart-rate variability (HRV), sleep, steps, daily check-ins (sleep, energy, soreness, stress), body measurements, progress photos, nutrition logs and food photos. With your permission we also read data from Apple Health, Health Connect and connected devices or services (e.g. Strava, Fitbit, Garmin, Oura, WHOOP).

Location: precise location only during a cardio session that you start, to map your route and calculate distance. Never in the background otherwise.

AI conversations: the messages you send to the AI coach and the photos you submit for analysis.

Purchases: subscription status, plan, amounts and dates. Card data is handled directly by Stripe, Apple or Google — we never see or store full card numbers.

Technical and usage data: device type, operating system, app version, IP address (for security), error logs and — only with your consent — analytics about how you use Apex.

Communications: emails and support messages you send us.

To provide Apex (account, training plans, workout logging, progress, nutrition, coach features, sync across devices) — performance of our contract with you (GDPR art. 6(1)(b); LGPD art. 7 V; nFADP).

To process health data and personalise training, recovery and nutrition — your explicit consent, given separately in the app (GDPR art. 9(2)(a); LGPD art. 11 I; nFADP art. 6(7)). You can withdraw it at any time in Settings → Privacy.

To keep Apex secure (preventing fraud, abuse and unauthorised access; security logs) — our legitimate interests (GDPR art. 6(1)(f); LGPD art. 7 IX) and legal obligations.

Analytics and marketing cookies — only with your consent, which you can change at any time (ePrivacy; GDPR art. 6(1)(a); LGPD art. 7 I).

Service emails (account, security, receipts, important changes) — contract. Newsletters and offers — only with your consent; you can unsubscribe in every email.

Accounting, tax and legal requests — legal obligations (e.g. Swiss Code of Obligations art. 958f).

We never sell your personal data, never use health data for advertising and never use it to build advertising profiles.

Health and fitness data are "sensitive" under the nFADP, GDPR and LGPD. We process them only after you give explicit consent in the app, separately from these terms, and only to provide Apex's features to you.

Data from Apple HealthKit and Health Connect is used only to provide fitness features to you. It is never used for advertising, never sold and never shared with third parties for their own purposes.

You can withdraw your consent at any time in Settings → Privacy. Withdrawal does not affect processing done before it. Because Apex's core features depend on this data, after withdrawal you can download your data and delete your account.

Apex uses AI to generate training plans, coaching answers, nutrition estimates and photo analysis. These are suggestions to support your training — not medical advice — and are never used to make decisions that have legal or similarly significant effects on you.

When you use AI features, the relevant content (for example your message, a photo or the training data needed for the answer) is sent to our AI providers (OpenAI and Google). Under our agreements with them, this data is processed only to produce the answer and is not used to train their models. We do not use your health data to train third-party AI models.

You may ask us to explain how a suggestion was produced and request a human review (nFADP art. 21; LGPD art. 20; GDPR art. 22).

We share data only with service providers that process it on our behalf under data processing agreements, and only as needed for the purposes above:

Hosting and database: Railway (USA). Storage, video delivery and bot protection: Cloudflare (global network).

AI: OpenAI (USA) and Google Gemini (USA/global).

Analytics (with consent): PostHog (servers in the EU) and Google Analytics (USA/global). Advertising measurement (with consent): Google Ads.

Payments and subscriptions: Stripe (web), Apple App Store, Google Play and RevenueCat (USA).

Sign-in: Apple and Google, when you choose them. Email delivery: Resend (USA). Maps for cardio routes: Mapbox and HERE. Barcode lookup: Open Food Facts (only the barcode is sent).

Services you connect (e.g. Strava, Fitbit, Garmin, Oura, WHOOP): only the data you authorise, under their own privacy policies.

Coaches and the community: a coach sees only what you share with them; posts you make public in the community are visible to other users.

Authorities: when required by law or a valid legal order.

We do not sell personal data. Measuring ad conversions with Google Ads may be considered "sharing" under some US state laws; it happens only if you accept marketing cookies, and you can opt out at any time (see section 9).

Apex is operated from Switzerland, which the European Commission recognises as providing adequate protection. Some providers process data in other countries, mainly the USA.

When data leaves Switzerland, the EEA or the UK, we rely on the EU-US / Swiss-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (with the Swiss and UK addenda), plus additional safeguards such as encryption in transit. For users in Brazil, transfers follow LGPD art. 33 (standard contractual clauses and adequate safeguards). You can ask us for a copy of the relevant safeguards.

Account, training and health data: while your account is active. When you delete your account, we delete or anonymise your personal data within 30 days; encrypted backups are overwritten within a further 35 days.

Billing records: 10 years, as required by Swiss accounting law.

Security logs: up to 12 months.

Analytics data (with consent): up to 14 months (Google Analytics) and 12 months (PostHog).

Consent records: for as long as the consent applies, plus the period needed to prove it.

Depending on where you live, you have the right to: access your data and receive a copy; correct it; delete it; restrict or object to processing; data portability; withdraw consent at any time; not be subject to solely automated decisions; and lodge a complaint with a supervisory authority.

Do it yourself in the app: Settings → Privacy → Download my data (portability), Cookie preferences, and Delete account (also at getapex.live/delete-account).

Or email us: hello@rosinisolutions.com. We answer within 30 days (within 15 days for confirmation and access requests under the LGPD). We may ask you to confirm your identity.

Switzerland: Federal Data Protection and Information Commissioner (FDPIC). EU/EEA: the data protection authority of your country. United Kingdom: Information Commissioner's Office (ICO). Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — you also have the right to information about who we share data with and about the consequences of not giving consent.

California and other US states: you have the right to know, delete and correct your personal information, to opt out of its sale or sharing (we do not sell it; you can opt out of sharing by rejecting marketing cookies — we also honour the Global Privacy Control signal), and to limit the use of sensitive personal information (we use it only to provide the service). We will not discriminate against you for exercising your rights. You may use an authorised agent.

Canada, Australia and other countries: you have similar rights of access and correction; contact us to exercise them.

We use necessary cookies and local storage to run Apex, and analytics and marketing cookies only with your consent. Optional tools are not loaded before you choose. Details are in our Cookie Policy (getapex.live/cookies), and you can change your choice at any time via "Cookie preferences" in the website footer or in the app settings.

We protect your data with encrypted connections (HTTPS/TLS), securely hashed passwords, encryption at rest by our hosting providers, access restricted to those who need it, and monitoring against abuse. If a data breach is likely to put your rights at risk, we will notify the competent authorities (such as the FDPIC, the relevant EU authority or the ANPD) and you, as required by law.

Apex is intended for people aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy. We will tell you about material changes by email and in the app before they take effect. Where processing is based on consent, we will ask for your consent again when required.

Rosini Transports et Locations Sàrl (Rosini Solutions)
Chemin des Bulesses 16, CH-1814 La Tour-de-Peilz
UID CHE-264.039.709 · hello@rosinisolutions.com