Privacy Policy
This Privacy Policy governs the processing of personal data collected through Rutinix, in accordance with Regulation (EU) 2016/679 (GDPR) y la Spanish Organic Law 3/2018 of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
- Identity: David Fernández and Daniel Gros, joint controllers (art. 26 GDPR), operating under the trade name "Rutinix"
- Email: rutinix.contact@gmail.com
| Dato | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Creating and managing the user account, authentication | Performance of a contract (art. 6.1.b GDPR) | While the account is active + 1 year after closure |
| Password | Secure authentication (stored as a bcrypt hash, never in plain text) | Performance of a contract (art. 6.1.b GDPR) | While the account is active |
| Fitness questionnaire answers (level, goal, available days, time per session, training location, physical limitations, weight, height, age, focus area, intensity) | Generating the personalized routine, saving and restoring the routine state, improving the service | Performance of a contract (art. 6.1.b GDPR) and legitimate interest (art. 6.1.f GDPR) | While the account is active + 1 year after closure |
| Google account identifier (only if you register or sign in with Google) | Create and link your account via Google sign-in | Performance of a contract (art. 6.1.b GDPR) | While the account is active + 1 year after closure |
| Messages sent to the AI Coach | Generate the training assistant's replies. Processed through OpenRouter without linking them to your identity | Performance of a contract (art. 6.1.b GDPR) | Not stored on our servers (processed in transit) |
| Review name and text (only if you post a review) | Display your public testimonial on the Site | Consent (art. 6.1.a GDPR) | Until you request its removal or delete your account |
| Usage and browsing data (pages visited, interaction events, device, anonymized IP) | Web analytics via Google Analytics 4 to improve the experience | Consent (art. 6.1.a GDPR) | 14 months (standard GA4 setting) |
Rutinix does not sell or share your personal data with third parties for commercial purposes. The only providers that may access data as data processors are:
- Google LLC (Analytics) — Google Analytics 4 (web analytics, with anonymized IP). Google acts as a processor under its privacy terms. International transfers are covered by the Standard Contractual Clauses approved by the European Commission.
- Google LLC (sign-in) — If you choose to register or sign in with your Google account, through its OAuth service we receive your email address and a unique identifier of your Google account, for the sole purpose of creating and linking your account on Rutinix.
- Hosting provider — The server hosting the user database. Hosting is contracted with a provider that offers data centers in the European Union; in the event of transfers outside the EEA, they would be covered by the Standard Contractual Clauses.
- OpenRouter, Inc. (AI Coach) — Router through which the messages you send to the AI Coach are processed. OpenRouter forwards each message to one of several language-model providers, including Meta (Llama), Google (Gemma), OpenAI (gpt-oss), Alibaba (Qwen), Mistral AI, Moonshot AI (Kimi), NVIDIA (Nemotron) y NousResearch (Hermes). No identifying data is sent with these messages (no email, no name, no account identifier). Some of these models are free and their provider may use the content to improve their services; therefore, we recommend not including sensitive personal data in the chat. These providers may be located outside the EEA, with transfers covered, where applicable, by the Standard Contractual Clauses.
Under the GDPR and the LOPD-GDD, you may exercise the following rights at any time by sending an email to rutinix.contact@gmail.com:
We will respond within a maximum of 30 days. If you believe the processing breaches the regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD).
We apply appropriate technical and organizational measures to ensure the security of your data: passwords stored with a bcrypt hash, encrypted connections via HTTPS, restricted database access and sessions with an HttpOnly cookie.
Rutinix is not intended for children under 14. If we detect that a minor has provided data without parental consent, we will delete it immediately.
This policy may be updated to adapt to legal or service changes. The "last updated" date at the top of the document will always indicate the current version.