This Privacy Policy explains how THE OFFICIAL MAXFIT SPORTS CONTRACTING SERVICES- L.L.C (“MaxFit”, “we”, “us”) collects, uses, discloses, and protects your personal data when you use the MaxFit Platform. We handle personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and other applicable UAE regulations.
1. Who is responsible for your data
MaxFit is the data controller for personal data processed through the Platform. You can reach our privacy team at info@maxfitai.com.
2. Data we collect
- Account & profile data: name, email, password (stored hashed), date of birth, and account role.
- Health & fitness data: goals, activity, body metrics, dietary preferences, allergens, and other information you provide so the AI can personalise plans. This is treated as sensitive data.
- Voice & conversation data: audio and transcripts of voice calls, dictated messages and chat messages, where you choose to use those features, and what the coach remembers about you from them (you can see and edit it in the app).
- Photos: meal photos you choose to send to the coach for a calorie and macro estimate, and your profile photo.
- Subscription & transaction data: plan, billing history, and payment status. Full card details are handled by Dodo Payments for purchases on our website, or by Apple or Google for purchases in the mobile app, and are never stored on our servers.
- Device & usage data: device type, app version, IP address, and interaction logs used for security, analytics, and diagnostics.
3. How we use your data
- To operate the Platform, create AI-generated plans, recipes, and coaching responses tailored to you.
- To run the allergen and safety checks that protect you when generating nutrition content.
- To process subscriptions and payments and, if you joined through a partner's referral link or code, to calculate that partner's commission. Partners are never told who they referred.
- To provide support, send service and transactional messages, and (with your consent) marketing.
- To secure the Platform, prevent fraud and abuse, and comply with legal obligations.
4. Legal bases for processing
We process personal data where: (a) you have given consent; (b) processing is necessary to perform our contract with you (delivering the subscription you bought); (c) we have a legitimate interest such as security and service improvement that does not override your rights; or (d) we must comply with a legal obligation.
5. AI processing of your data
To generate coaching, plans, and recipes, relevant profile and health inputs are processed by AI models run by third parties acting as our processors under contract. We name them here rather than describing them generically, so you can see exactly who receives what:
- Anthropic (anthropic.com) — the Claude models behind the coach, your plans and meal-photo estimates. What is sent: your message or plan request, a meal photo you choose to send, the relevant parts of your profile (such as goals, body metrics, injuries, allergens and dietary preferences), what the coach remembers about you, and recent conversation context.
- LiveKit (livekit.io) — the real-time connection for voice calls. It carries the call audio between your device and our servers while the call is live.
- Deepgram — speech recognition. What is sent: the audio you speak during a voice call or when you dictate a message, so it can be turned into text.
- Fish Audio — speech synthesis. What is sent: the text of the coach’s reply, so it can be spoken aloud. Your own voice is not sent to it.
These providers process your data on our instructions only. We do not sell your data, we do not permit these providers to train their models on it, and every AI output passes through our own safety filtering before it reaches you. You control whether voice transcripts are stored, in the app’s privacy settings. If you do not wish your data to be shared with these providers, do not use the AI coach, voice calls, meal photos or plan generation — the rest of the Platform works without them. See our AI Usage & Disclaimer Policy.
6. When we share data
We share personal data only as needed:
- Service providers (processors): payment processing (Dodo Payments), the AI and voice providers named in section 5 (Anthropic, LiveKit, Deepgram, Fish Audio), in-app purchase management (RevenueCat), email delivery (Postmark), push notifications (Firebase Cloud Messaging), and hosting — each bound by a data-processing agreement.
- Legal & safety: authorities where required by law, or to protect the rights and safety of users and the public.
- Business transfers: in a merger or acquisition, subject to this Policy.
7. International transfers
Some processors may store or process data outside the United Arab Emirates. Where we transfer personal data abroad, we do so only to jurisdictions with adequate protection or under appropriate contractual safeguards, as required by the UAE PDPL.
8. Data retention
We keep personal data only as long as necessary for the purposes described here or as required by law (including tax and accounting rules). When data is no longer needed, we delete or anonymise it. Sensitive fields (such as bank details, TOTP secrets, voice transcripts, and chat bodies) are encrypted at rest.
9. Your rights
Subject to the UAE PDPL, you have the right to:
- Access the personal data we hold about you and request a copy (data portability).
- Correct inaccurate or incomplete data.
- Request erasure of your data (subject to legal retention obligations).
- Restrict or object to certain processing, and withdraw consent at any time.
- Lodge a complaint with the UAE Data Office.
You can exercise most of these rights directly in the app (account settings and data export), or by emailing info@maxfitai.com. We respond within the timeframes set by applicable law.
10. Security
We use technical and organisational measures including encryption in transit and at rest for sensitive data, access controls, audit logging, and secure payment handling via Dodo Payments. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.
11. Cookies & tracking
Our website uses strictly necessary cookies to run the service and, with your consent, analytics cookies to understand usage. You can manage non-essential cookies through the consent controls presented on our site.
12. Children
MaxFit is not directed to children under the applicable minimum age. We do not knowingly collect data from children without verified parental consent. If you believe a child has provided us data, contact info@maxfitai.com and we will delete it.
13. Changes to this Policy
We may update this Policy and will post the revised version with a new effective date. Material changes will be notified through the Platform or by email.
14. Contact us
Data protection contact: THE OFFICIAL MAXFIT SPORTS CONTRACTING SERVICES- L.L.C
Licence no. CN-6250407
Abu Dhabi, United Arab Emirates
Phone: +971 56 960 2209
Email: info@maxfitai.com