Privacy policy

1. Who we are

The company behind camu, and how to reach us about privacy.

camu is operated by Adam Demian, a sole trader (živnostník) registered in the Slovak Republic, Sebechleby 333, 962 66 Sebechleby, Slovakia ("camu", "we", "us"). We are the controller responsible for your personal data under the General Data Protection Regulation (GDPR) for the processing described in this policy.

For anything relating to this policy — questions, requests, or complaints — contact us at adam@camu.co or by messaging camu directly in the app.

2. What we collect

Your messages, your training and health data, basic account details, and payment status — never your card number.

We collect and process the following categories of personal data:

• Conversation data.The full content of your chat messages with camu, and camu's replies, so the coaching context persists across sessions.
• Health and training data.Workout logs, training history, injuries and pain reports, sleep, heart-rate variability (HRV), recovery scores, and any other health or fitness information you share with camu or connect from a wearable or training platform. This is "data concerning health" under Article 9 GDPR — see Section 3 for how we handle it.
• Telegram profile basics.Your Telegram user ID, first/last name and username as provided by Telegram, and your chat ID, so camu can message you. We do not receive your phone number or Telegram password.
• Billing status.Whether your subscription is active, trialing, past due, or cancelled, and which plan you're on. Card and payment details are collected and processed entirely by Stripe — camu never receives or stores your card number, CVC, or full billing address.
• Product analytics.Events such as which features you use, message counts, session timing, and device/browser metadata, collected to understand and improve the product.

3. Health data and explicit consent (Article 9)

We only process your health data because you explicitly agreed to it — and you can withdraw that at any time.

Health data is a "special category" of personal data under Article 9 GDPR, and by default it may not be processed at all. We rely on yourexplicit consent(Article 9(2)(a) GDPR) as the legal basis for processing it. You give this consent when you first start using camu and voluntarily share health or training information — for example, by telling camu about an injury, your sleep, or your recovery data, or by connecting a wearable.

You may withdraw this consent at any time, with effect for the future, by telling camu in chat that you want to stop sharing health data, or by emailing adam@camu.co. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and may limit camu's ability to give you personalized coaching, since injury and recovery context is core to how it adapts your training.

4. Why we process your data

To coach you, to reach out proactively, and to make the product better.

• Providing the coaching service— generating training plans, answering questions, and adapting to your progress, injuries, and schedule. Legal basis: performance of the contract with you (Article 6(1)(b) GDPR), and explicit consent for health data (Article 9(2)(a) GDPR, see Section 3).
• Proactive check-ins— camu messaging you first (e.g. a daily brief, a nudge after a missed session) as a core, expected part of the service you signed up for. Legal basis: performance of the contract.
• Billing and account administration— processing your subscription, invoices, and support requests. Legal basis: performance of the contract and our legitimate interest in running the business (Article 6(1)(f) GDPR).
• Product improvement— understanding usage patterns and failure modes to fix and improve camu. Legal basis: legitimate interest (Article 6(1)(f) GDPR), balanced against your rights; we do not use your identifiable conversation content for this without a lawful basis, and analytics events are configured to minimize personal data.
• Legal compliance— where we're required to keep or disclose records, e.g. tax and billing records. Legal basis: legal obligation (Article 6(1)(c) GDPR).

5. AI model processing (how your messages get a reply)

Your messages are sent to AI providers to generate a response — they are not used to train their models.

To generate camu's replies, your conversation content (including health and training data you've shared) is transmitted to third-party AI model providers — currently including Anthropic — via Vercel's AI Gateway, which routes and logs the request. This processing is necessary to provide the core service: without it, camu cannot respond to you.

These providers process your data as our processors, under data processing agreements, and are contractually restricted from using your conversation content to train their general-purpose models. Some of these providers are located outside the EU/EEA — see Section 7 on international transfers.

6. Who else processes your data (sub-processors)

The vendors that keep camu running, and what each one sees.

We use the following sub-processors to operate camu. Each is bound by a data processing agreement and only processes data as needed to provide its service to us.

• Vercel(hosting, infrastructure, and the AI Gateway) — hosts the application and routes AI model requests. Processes all conversation and account data in transit.
• Neon(database) — stores account records, conversation history, and training/health data in a managed Postgres database.
• Anthropic and other AI model providers (accessed via Vercel AI Gateway) — process conversation content, including health data you've shared, to generate camu's replies. See Section 5.
• Telegram(chat transport) — delivers messages between you and camu. Telegram is an independent controller for its own platform data (e.g. your Telegram account); we only receive the profile basics and messages described in Section 2.
• Autumn and Stripe(billing and payments) — purchases are completed with Stripe acting as merchant of record: Stripe is the legal seller for the payment transaction, stores your payment method, processes charges, and handles applicable VAT and payment-related data as an independent controller under its own privacy policy. Autumn manages subscription and entitlement logic on top of Stripe. Card data is handled by Stripe directly and never passes through camu's servers.
• PostHog(EU Cloud, product analytics) — processes usage events to help us understand and improve the product. Data is hosted in the EU.
• Vercel Blob(media storage) — stores media attachments (e.g. exercise clips, generated cards) sent to you in chat.

We may add or change sub-processors as the product evolves; this page will be updated when we do.

7. International data transfers

Some processors are US-based; transfers to them are covered by Standard Contractual Clauses or equivalent safeguards.

Some of our sub-processors (including Vercel, Neon, Anthropic, and Stripe) are based in, or process data in, the United States. Where personal data is transferred outside the EU/EEA, we rely on recognized transfer mechanisms — the EU Standard Contractual Clauses (SCCs), and, where a processor participates, the EU-U.S. Data Privacy Framework (DPF) — to ensure your data continues to receive GDPR-equivalent protection. We have not independently verified the current DPF certification status of every named processor as of the last update to this page; this should be confirmed against each processor's current certification before this policy is relied upon as final.

8. How long we keep your data

We keep your data while your account is active, and delete it on request.

We retain your account, conversation, and training/health data for as long as your camu account is active, so camu can keep the full context of your coaching relationship. If you delete your account or ask us to erase your data, we will delete or anonymize it within a reasonable period, except where we are required to retain specific records (e.g. billing/invoice records) for tax or accounting purposes under applicable law. Backups may persist for a limited additional period before being purged in the normal backup rotation.

9. Your rights

Access, correct, delete, or export your data — and complain to a regulator if you think we got it wrong.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure("right to be forgotten") of your personal data, subject to legal retention requirements.
• Portability— receive your data in a structured, machine-readable format, or have it transmitted to another controller where technically feasible.
• Restrictionof processing in certain circumstances.
• Objectto processing based on legitimate interest.
• Withdraw consentat any time for processing based on consent (including health data — see Section 3), without affecting the lawfulness of prior processing.
• Lodge a complaintwith a supervisory authority in your EU member state of residence, work, or the place of the alleged infringement, if you believe our processing violates the GDPR.

To exercise any of these rights, message camu directly in chat and ask, or email adam@camu.co. We will respond within one month, as required by the GDPR.

10. Cookies and analytics

We use PostHog, hosted in the EU, to understand how camu is used.

Our website and product may use cookies and similar technologies for essential functionality (e.g. remembering your theme preference) and for analytics via PostHog EU Cloud, which processes and stores data within the EU. Analytics data is used in aggregate to understand product usage and is not sold to third parties.

11. Age minimum

camu is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a minor under 16 has provided us with personal data, contact us at adam@camu.co and we will delete it.

12. Security

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and reputable infrastructure providers — to protect your data. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or from camu.

13. Changes to this policy

We may update this policy as camu's product or legal obligations change. We'll update the "last updated" date above when we do, and for material changes we'll make a reasonable effort to notify you directly (e.g. in chat).

14. Contact

Adam Demian — adam@camu.co. Postal address and full operator details are in the imprint.