Privacy policy.

We collect only what we need to coach you well, run our business, and stay safe and legal.

Account information

• Your name and email address.
• A password hash. We never store your password in readable form.
• Your time zone and preferred session times.

Training profile

• Your height, weight, and age.
• Your training history, fitness goals, and self-disclosed health information you choose to share with your coach.
• Notes your coach writes after each session, plus the program they build for you.

Billing

• Your subscription tier, billing cycle, and payment status.
• Stripe handles your card details on our behalf. We never see your full card number.

Session recordings

• We record video and audio of every coaching session. Recording is on by default, with your written consent at signup and a verbal confirmation at the start of each session.
• Recordings include only what is in frame and on mic during your scheduled session window. We do not record outside that window.

Behavioral and device data

• Pages you visit, buttons you click, and features you use, captured by PostHog for product analytics and, on our public pages, session replay. PostHog is hosted in the EU: these events go to PostHog's EU cloud, not to a server we run. Form inputs are masked in replays.
• Basic usage of our public marketing pages, measured with Google Analytics.
• Advertising identifiers from the link you arrived on, such as campaign tags, a Meta click identifier, or a Google click identifier. We pass these to our signup flow so we can tell which ad brought you to us.
• Your IP address, browser, operating system, and device type, used for security and fraud prevention.

When you contact us

• Emails you send to any of our addresses, kept as support history.
• If you choose to message us on WhatsApp, that conversation happens on WhatsApp's platform under WhatsApp's own terms and privacy policy. Nothing is shared with WhatsApp unless you start the chat yourself.

Each kind of data has a specific purpose. We do not collect data for vague "future use".

• To deliver coaching: pairing you with a coach, running live sessions, programming for next week, and reviewing your form between sessions.
• To run the business: billing, fraud prevention, customer support, and complying with tax and accounting law.
• To keep you and our coaches safe: reviewing recordings if a safeguarding concern is raised, by you or by us.
• To improve the product: aggregated analytics on which features get used, so we can see what works and fix what does not.
• To advertise Bespoke Fit: we run ads online and measure which ones lead to signups. See cookies, analytics, and advertising for exactly what each ad platform receives.

What we will not do

• We do not train AI models on your sessions, your coach notes, or your training profile. An AI service processes session transcripts to draft notes for your coach, under terms that forbid it from training on your data.
• We do not use your health or fitness data for marketing.
• We do not sell your data to anyone.
• We do not share your sessions, recordings, coach notes, or health data with advertising or social platforms. What those platforms can receive is limited to website browsing and purchase events, and the identifiers that link them, described in cookies, analytics, and advertising.

Recording every session is the part of our service that touches your privacy most directly. We are deliberately specific about how it works.

Why we record

• Your coach reviews recordings between sessions to refine your program and catch form issues you both moved past in real time.
• If a safeguarding concern is raised, by you or by Bespoke Fit, our safety team can review the relevant recording.

Who can see your recordings

• Your coach can view recordings of sessions they coached. Coaches cannot view other members' recordings.
• Recordings are for internal coaching and safety use only and are not made available to members for playback.
• Our safety team can view a recording only when a documented safeguarding review is open. Every such access is logged.
• No one else inside Bespoke Fit accesses them. Service providers process them on our behalf: Stream powers the video call and produces the recording and transcript, the files live in encrypted cloud storage we control, and Google's Gemini API analyzes the transcript to draft coaching notes for your coach. None of them may use your data for anything else, and advertising platforms never receive any of it.

How long we keep recordings

• Raw recordings are deleted automatically 90 days after the session.
• Coach notes (text, not video) are kept for the life of your subscription plus 12 months.
• If a safeguarding incident is documented, the relevant recording is preserved for the period required by the legal-claims window in your jurisdiction, then deleted.

Withdrawing consent

You can withdraw consent to recording at any time. Because live coaching depends on recording for safety review and program iteration, withdrawing consent ends your active subscription. You can request that all of your recordings be deleted on your way out.

Your coach is most likely based in the Philippines. To coach you, they view your live session and may temporarily store your recording on their work device. The Philippines does not have an EU adequacy decision, so we use the EU Standard Contractual Clauses and the UK International Data Transfer Addendum with each coach's contracting entity, plus a transfer impact assessment.

You can request a copy of the SCCs and IDTA we use by writing to privacy@bespoke.fit.

We delete data when its purpose ends. The table below summarizes the retention period for each category.

Depending on where you live, you have the rights below. We honor every request, regardless of where you live.

If you are in the EU, UK, or EEA

• Access: ask for a copy of the data we hold about you.
• Rectification: ask us to correct anything wrong.
• Erasure: ask us to delete your data, subject to legal retention duties.
• Portability: get your data in a machine-readable format.
• Restriction and objection: ask us to pause or stop a specific use.
• Withdraw consent: at any time, with no effect on processing that happened before.
• Lodge a complaint with your local data protection authority. Norway's authority is Datatilsynet.

If you are in California

• Right to know: what we collect, why, and who we share it with.
• Right to delete: with limited legal retention exceptions.
• Right to correct: anything inaccurate.
• Right to opt out of sale or sharing: we do not sell your personal information. We do share limited identifiers with advertising platforms, such as cookie and ad-click identifiers, a hashed version of your email address, and confirmation that you subscribed, so we can measure our ads and build audiences. California law may treat that as "sharing". To opt out, write to privacy@bespoke.fit and we will exclude your data from those platforms.
• Right to non-discrimination: exercising any of these rights does not change your service, your price, or your coach.

To exercise any of these rights, write to privacy@bespoke.fit. We respond within 30 days.

• Data in transit is encrypted with TLS 1.2 or newer.
• Data at rest is encrypted with AES-256.
• Access to recordings and notes is role-based: coaches only see their own sessions, the safety team only on documented review, no one else.
• Every safety-team access is logged and audited monthly.
• If you find a security issue, write to security@bespoke.fit. We thank every responsible disclosure.

We set first-party cookies to keep you logged in, hold your session, and remember basic preferences. On our public marketing and signup pages we also use, or will shortly use, the analytics and advertising tools below. We do not load advertising pixels on signed-in coaching, health questionnaire or messaging pages.

• What we never give advertising platforms: your health or fitness data, your session recordings, your messages, or anything your coach writes about you.
• Our Google Ads measurement and Google Analytics signup-funnel measurement are limited to visitors identified as being in the United States or Canada. We disable this measurement when the country is unknown or your browser sends Global Privacy Control. It is not used to create personalized advertising audiences.
• To opt out of the advertising tools above, write to privacy@bespoke.fit and we will exclude your data from them.

Bespoke Fit is for adults aged 18 or older. We do not knowingly collect data on anyone under 18. If you believe a minor has signed up, write to privacy@bespoke.fit and we will delete the account.

If we change this policy in a way that meaningfully affects your rights or how we use your data, we will email you at least 30 days before the change takes effect. The current version is always at bespoke.fit/privacy with the last-updated date at the top.