Privacy policy of the SUPERSONIC Life Energy Coach application

 

1. Data administrator

The administrator of your personal data is Supersonic Food PL sp. z o.o. based in Warsaw, ul. Bruzdowa 100c/2, 02-991 Warszawa, entered into the register of entrepreneurs of the National Court Register under the number 0000839873, NIP 9512501164, REGON 385996745 ("SUPERSONIC", "we").

In all matters relating to the protection of personal data, you can contact us at the following e-mail address: contactus@biz.supersonicfood.com or in writing to the registered office address.

2. What this policy covers

The policy describes the rules for processing personal data of users of the SUPERSONIC Life Energy Coach mobile application ("Application"). The application combines daily check-ins on well-being (sleep, energy, mood) with conversations with an AI assistant ("Coach") and a catalog of SUPERSONIC supplements. The application processes health data - that is, special category data within the meaning of Art. 9 GDPR. We take it seriously and describe below exactly what, why and where it goes.

3. What data do we process?

3.1. Account details

• e-mail address (login, access verification, account communication),
• timestamps of consents granted (unmodifiable record on the server side - proof of consent).

3.2. Profile data provided during onboarding

• date of birth (verification of age), gender,
• weight and height,
• diet and lifestyle,
• goals (e.g. energy, sleep, figure),
• life phase: pregnancy, menopause, menstrual cycle phase,
• main problems: sleep quality, mood swings, lack of energy.

The data listed in point 3.2 (apart from date of birth and gender) constitute health data in whole or in part (Article 9 of the GDPR). The basis for their processing is your explicit, separate consent (Article 9(2)(a) of the GDPR).

3.3. Daily check-ins and history

• assessment of sleep quality, energy level and mood (scale 1–5),
• number of steps, weight entries over time,
• AI-generated tips and reports (derived from health data).

3.4. Conversations with Coach (AI)

We save the full content of your conversations with the Coach, conversation summaries generated by AI and the Coach's "long-term memory" (e.g. information about caffeine, alcohol, sources of stress, sleep, supplements taken). We do this so that the Coach remembers the context of your previous conversations and does not ask the same questions over and over again. The content of the conversations concerns health and well-being, so it constitutes data under Art. 9 GDPR.

3.5. Shopping data (Shopify)

• Shopify store customer ID and email address
• name and surname,
• order items (names of purchased products), subscription status.

The purchase data is used only to verify access rights to the Application (matching the verified e-mail address to the purchase). The app doesn't send any data about your health or conversation content to Shopify.

3.6. What we do NOT collect

• we do not conduct behavioral analytics or tracking in the Application (no active analytical tools),
• we do not use cookies (mobile application),
• We do not send your email address, name or account ID to the AI provider.

4. Purposes and legal basis for processing

Purpose	Data range	Legal basis
Account creation and maintenance, access verification	e-mail, purchase data, consent tags	art. 6 section 1 letter b GDPR (contract)
Providing coaching services: check-ins, reports, conversations with the Coach	profile data, check-ins, conversation content, Coach memory	art. 9 section 2 letter a GDPR (express consent) in connection with joke. 6 section 1 letter a
Transferring data to the AI model provider (Anthropic, USA) to generate Coach responses and reports	profile data, check-ins, conversation content (without e-mail, name and account ID)	art. 9 section 2 letter a GDPR (express consent including transfer); transfer mechanism: ch. 6
Transaction email with access code after purchase	name, order number, code	art. 6 section 1 letter b GDPR (contract)
Establishing, pursuing or defending claims; service security	account data, technical logs (reduced)	art. 6 section 1 letter f GDPR (legitimate interest)
Tax and accounting obligations (purchase settlements)	purchase data	art. 6 section 1 letter c GDPR

Voluntary consent. Consent to the processing of health data is voluntary, but without it we are unable to provide coaching services - the essence of the Application is to work on data about your well-being.

5. Data recipients

Entity	Role	Location	What it processes
Supabase	processor	EU (EU region)	database, authentication, server functions
Anthropic PBC (Claude API)	processor	USA	health data and conversation content in queries to the AI model
Shopify	separate administrator	USA/Canada	purchasing data: e-mail, name and surname, orders
Resend	processor	USA	sending transaction e-mail (name, order number, code)

6. Transfer of data outside the EEA

Some of our suppliers process data in the United States. This applies in particular to Anthropic (AI model provider), Shopify and Resend.

6.1. Anthropic (Claude API) - Health Data

Queries to the AI model include data about your health and well-being (profile, check-ins, conversation content). They do not include your email address, name or account ID. The basis for the transfer are EU standard contractual clauses (SCC, Commission Decision 2021/914, "controller-processor" module), incorporated into the entrustment agreement (DPA) concluded with Anthropic as part of the commercial terms of use of the API. In accordance with Anthropic's commercial terms, data provided via the API is not used to train models, and the default retention period on Anthropic's website is up to 30 days. Since the transfer concerns data pursuant to Art. 9 GDPR, before using Coach for the first time, we ask you for separate, explicit consent, including information about the transfer of data to the USA.

6.2. Shopify and Resend

Shopify (shopping data) and Resend (transactional email) only process regular data - they don't have access to your health data or conversation content. The transfer of data to these entities is based on mechanisms ensuring an adequate level of protection provided for by the GDPR, in particular on an adequacy decision (e.g. under the Data Privacy Framework) or on approved Standard Contractual Clauses (SCC).

7. Storage periods

Data	Period
Account details (e-mail, consents)	to delete your account; consent markers - for the period of limitation of possible claims (generally 6 years from the end of the service provision).
Profile, check-ins, reports, conversations and Coach's memory	to be deleted by you (profile reset / account deletion)
Data on the Anthropic side (API queries)	up to 30 days from processing (Anthropic commercial terms).
Purchase data	for the period required by tax and accounting regulations
Technical logs of server functions (reduced: serial/status)	short-term (approx. 24 hours on current infrastructure)

8. Your rights

You have the right to:

• access to data and obtaining a copy thereof (Article 15),
• rectification of data (Article 16),
• deletion of data - "right to be forgotten" (Article 17),
• restrictions on processing (Article 18),
• data portability (Article 20),
• Objection to processing based on legitimate interest (Article 21),
• withdraw consent at any time - without affecting the lawfulness of processing before withdrawal,
• submit a complaint to the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

How to exercise your rights: write to contactus@biz.supersonicfood.com. Profile reset is available in the Application (deletes reports, check-ins, conversations and Coach memory). We will complete full account deletion, including account and purchase data to the extent that we have no legal obligation to retain it, upon request sent to the same address. Withdrawal of consent to the processing of health data prevents further use of the coaching function.

Limitations: We cannot delete data already transferred to Anthropic directly - it is deleted automatically on the Anthropic side in accordance with its retention policy (up to 30 days). Purchase data on Shopify is subject to separate SUPERSONIC store policies.

9. Automated processing and profiling

The application generates reports, tips and recommendations using AI based on your health data - this is profiling within the meaning of the GDPR. The recommendations are of a supportive nature (lifestyle/wellness) and do not have any legal or similarly significant effects on you within the meaning of Art. 22 GDPR - you always make the final decisions (e.g. purchasing a supplement, changing your habits) yourself. The coach is not a doctor, he does not diagnose or treat. AI-generated content does not constitute medical advice.

10. Age of users

The application is intended only for adults (18+). Verification is based on the declared date of birth. If we determine that the account belongs to a minor, the account and collected data will be deleted.

11. Security

Data is stored on Supabase infrastructure in the EU region, with database row-level access control (RLS), transmission encryption and separation of privileges for server functions. Technical logs have been reduced so that they do not contain full personal data.

12. Policy changes

We will inform you about significant changes to the policy in the Application in advance. The current version is always available at https://supersonicfood.com/appprivacy.