RepFit Coach Privacy Policy

Art. 1Overview and Controller

Joyce Studios ("Company", "we") values the privacy of users and the Members they manage in «RepFit Coach» ("Service"), and complies with Korea's Personal Information Protection Act (PIPA), the Network Act, and, where applicable, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and other applicable laws.

This Privacy Policy ("Policy") explains what personal data we process, on what legal basis and for what purposes, and how we collect, use, store, disclose and delete it, as well as your rights and how to exercise them. It applies to the Service and not to third-party services linked from it.

Art. 2Principles of Processing

In processing personal data, we adhere to the following principles.

• Lawfulness & purpose limitation: collected lawfully for clear purposes and used only within that scope.
• Data minimization: we collect only the minimum data necessary to provide the Service.
• Accuracy: we strive to keep data accurate and up to date as needed for the purpose.
• Storage limitation: we retain data only as long as necessary and then delete it without undue delay.
• Security: we apply appropriate technical, administrative and physical safeguards.
• Transparency: we publish this Policy so data subjects can understand how their data is processed.

Art. 3Personal Data We Collect

Art. 4How We Collect

• Directly, when you enter data at sign-up, in profile/settings, or in member/session/income screens;
• Automatically, generated by your device/app during use;
• Through partners/processors such as Apple (Sign in with Apple, billing) and Google Firebase (infrastructure);
• When you contact us by email for support.

Art. 5Legal Bases for Processing

We process personal data on the following bases (for GDPR-subject users, the bracketed basis applies):

• Performance of a contract: to provide the Service, manage accounts, sync data and fulfill subscriptions (GDPR Art. 6(1)(b));
• Legitimate interests: to improve the Service, diagnose errors, ensure security, prevent abuse and produce statistics, where not overridden by your rights (GDPR Art. 6(1)(f));
• Consent: for optional data, international transfer and other consent-based processing (GDPR Art. 6(1)(a)); you may withdraw consent at any time without affecting prior lawful processing;
• Legal obligation: record retention and other duties required by law (GDPR Art. 6(1)(c)).

Art. 6Purposes of Use

• Provide the Service: manage members, programs, attendance and income; generate and share reports and SNS cards;
• Accounts & sync: authenticate, manage accounts, sync and back up data across devices;
• Subscriptions: verify paid status, provide Pro features and manage free trials;
• Improvement: analyze usage/diagnostics to improve quality, ensure stability and develop features;
• Support & notices: respond to inquiries and communicate important policy, update or security matters;
• Legal compliance, dispute handling, and prevention of abuse and security threats.

Art. 7Retention Periods

• We delete personal data without undue delay once its purpose is achieved.
• When you delete your account, account information and server-synced data are deleted without undue delay (within a reasonable technical window, up to 30 days). Guest data is not stored on our servers.
• Diagnostic/statistical logs are retained for up to 24 months, then deleted or irreversibly de-identified.
• Where law requires retention, we store the relevant records separately for the required period (e.g., under Korean e-commerce law: contract/withdrawal and payment/supply records for 5 years; consumer-complaint records for 3 years). App Store payment records are retained by Apple.

Art. 8Destruction Procedure and Method

• Procedure: data whose purpose is fulfilled is destroyed without undue delay; data retained by law is stored separately and destroyed after the retention period.
• Method: electronic files are permanently deleted by irrecoverable technical means; printouts are shredded or incinerated.

Art. 9Disclosure to Third Parties

We do not use personal data beyond the stated purposes or disclose it to third parties, except:

• with your prior explicit consent;
• where required by law or lawful request from investigative/supervisory authorities;
• where necessary to prevent imminent danger to the life, body or property of users/Members.

Art. 10Processors (Sub-processors)

For reliable operation we entrust processing to the following domestic/overseas processors:

Under Art. 26 of PIPA, our processor agreements set out, in writing, the prohibition of processing beyond the entrusted purpose, technical/administrative safeguards, restrictions on sub-processing, supervision and liability. Changes to entrusted work or processors will be disclosed via this Policy.

Art. 11International Transfers

Given our cloud infrastructure, personal data may be processed and stored abroad. Under Art. 28-8 of PIPA we disclose:

For GDPR users, where personal data is transferred outside the EEA, we and our processors apply lawful safeguards such as the EU Standard Contractual Clauses (SCCs). You may decline international transfer, in which case you can stop using the Service by deleting your account (note that sync and some features may be unavailable without transfer).

Art. 12Your Rights and How to Exercise Them

Data subjects (users and Members) have the following rights under applicable law:

• Access, rectification, deletion and suspension of processing (PIPA);
• Under the GDPR: access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, withdrawal of consent, the right to lodge a complaint with a supervisory authority, and rights regarding automated decision-making;
• Under the CCPA/CPRA: the right to know, delete and correct; to opt out of sale/sharing (we do neither); and non-discrimination for exercising rights.

You can view/edit your account data in the app and delete your account and all data via Settings → Delete account. Members' rights requests should first be directed to the trainer (controller) who manages them; we, as processor, assist on the trainer's lawful instructions. Other requests may be sent to our privacy officer below in writing or by email; we act without undue delay (in principle within 10 days) and notify you of the outcome.

You may exercise rights through a legal representative or authorized agent, and we may reasonably verify that the requester is the data subject or an authorized agent. Where a request falls within a statutory exception, we may refuse and will explain why.

Art. 13Pseudonymized/Anonymized Data and Statistics

For service improvement and statistics, we may use pseudonymized or anonymized (de-identified) information that cannot identify an individual. Such information is not personal data and may be processed for statistics, research and service improvement.

Art. 14Automatic Collection & Analytics

• We collect an app-generated device identifier (UUID), install/DAU statistics and error-diagnostic data to improve the Service.
• We do not collect advertising identifiers (IDFA) and do not use third-party ad SDKs for cross-app tracking.
• The Service does not perform tracking via web-browser cookies. As no common industry standard exists for "Do Not Track" signals, we do not separately respond to them, but we never track you for advertising purposes.

Art. 15Security Measures

• Technical: encryption in transit (HTTPS/TLS), least-privilege access and controls, authentication/authorization, our providers' security systems, and vulnerability checks;
• Administrative: minimizing and managing personnel with access, an internal management plan, and periodic training and reviews;
• Physical: physical access controls at cloud data centers (provided by processors).
• We apply reasonable safeguards but cannot guarantee absolute security of internet transmission or electronic storage. You are also responsible for keeping your account and device secure.

Art. 16Breach Notification

If we become aware of loss, theft, leakage, forgery, alteration or damage of personal data, we will notify affected data subjects and report to the relevant authorities without undue delay as required by applicable law (including PIPA), and take necessary measures to minimize harm.

Art. 17Automated Decision-Making

The Service provides statistics and insights (e.g., renewal reminders) as supporting information to aid your judgment. It does not carry out solely automated decisions producing legal or similarly significant effects on you or Members.

Art. 18Children

The Service targets adult personal trainers and does not collect personal data from children under 14 (Korea). Where the GDPR applies, we do not knowingly collect data from children under 16; where U.S. COPPA applies, under 13. If we learn such data was collected without guardian consent, we delete it without undue delay.

If you enter data about a minor Member, you are responsible for obtaining the necessary consent from that minor's legal guardian.

Art. 19Business Transfers

If we transfer all or part of our business, or transfer personal data through a merger, division or similar, we will, following the procedures required by law, notify you in advance of the fact, the recipient and how to exercise your rights, and give you the opportunity to object to the transfer or withdraw consent.

Art. 20Privacy Officer and Contact

We designate a privacy officer to oversee processing and handle inquiries, complaints and remedies.

• Privacy Officer: Bill Kim
• Email: ibillkim@gmail.com

You may contact us at the above for any privacy inquiry, complaint or remedy; we respond diligently without undue delay.

Art. 21Remedies

To seek remedies for privacy infringement, you may contact the following bodies (Korea), which are independent of the Company, if you are dissatisfied with our handling or need further assistance:

• Personal Information Dispute Mediation Committee: 1833-6972 · kopico.go.kr
• Privacy Infringement Report Center (KISA): 118 · privacy.kisa.or.kr
• Supreme Prosecutors' Office Cyber Investigation: 1301 · spo.go.kr
• National Police Agency Cyber Bureau: 182 · ecrm.police.go.kr

GDPR users have the right to lodge a complaint with the supervisory authority of their habitual residence or the place of the alleged infringement.

Art. 22Regional Supplements (EEA/UK, California)

EEA/UK users (GDPR/UK GDPR)

We process personal data on the legal bases stated above and apply lawful safeguards (e.g., SCCs) for transfers outside the EEA. You may exercise your rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Where we rely on legitimate interests, you may object based on your particular situation.

California users (CCPA/CPRA)

The categories of personal information we processed in the past 12 months are those listed under "Personal Data We Collect"; sources, purposes and recipients are described in the relevant sections. We do not sell or share personal information and have not done so in the past 12 months. You have the right to know, delete and correct, and to non-discrimination for exercising your rights, which may be exercised through an authorized agent. Submit requests via the contact above.

Art. 23Notice and Changes

We may revise this Policy following legal or service changes. We will announce changes and the effective date in the Service or on this page in advance; for material changes (e.g., substantive changes to collected items, purposes, third-party disclosure, international transfer or retention) we give notice 30 days in advance and, where required by law, obtain your renewed consent. Continued use after the effective date may be deemed acceptance of the changes.

Contact