THALON - Privacy Policy

Last updated: August 16, 2026

Data controller

Controller: THALON

Company name and registered office: to be defined — this section will be updated as soon as the company is formally established.

Email for privacy requests: info@thalonapp.com

Minimum age and minors

The service is intended for people who are at least 16 years old. We do not knowingly collect data from users who have not reached that age. If we become aware that we have collected personal data from a minor under 16 without valid consent, we will promptly delete it.

Types of data collected

Identification data: first name, last name, email address

Login credentials: password, stored encrypted and never in plain text

Demographic data: age, sex, preferred language

Physical data: height, weight, including history over time if recorded by the user

Health-related data (special category of data, art. 9 GDPR): any injuries or physical limitations voluntarily disclosed by the user to personalize training

Training data: goal (hypertrophy, strength, endurance), level, weekly frequency, available equipment (gym or bodyweight), generated workout plans and workout history

Subscription data: subscription status (active, expired, plan type) received from the digital stores via the RevenueCat platform. Thalon never receives or processes payment card or payment method data: purchases are handled entirely by the Apple App Store or Google Play.

How we use artificial intelligence

The core of THALON is the automatic generation of workout plans through an artificial intelligence system. The data you provide (age, sex, weight, height, level, goal, frequency, any injuries, available equipment) is processed by OpenAI's models (ChatGPT) to generate a personalized workout plan, which is then periodically regenerated taking your progress into account.

This processing involves transferring some of your data, including any health data you have provided, to OpenAI, L.L.C., based in the United States (see the "International transfers" section).

The generated plan is an automated workout suggestion and does not replace the advice of a doctor or a qualified fitness professional; you can always choose not to follow it or to stop at any time.

Purposes of processing

Creating and managing your account

Generating and monthly updating of personalized workout plans through artificial intelligence

Managing your subscription and verifying purchase status

Sending service communications (e.g. related to your account or subscription)

Sending promotional communications, only with explicit consent

Aggregated statistical analysis and service improvement

Legal basis

Performance of a contract: to create the account, generate workout plans and manage the subscription

Explicit consent: specifically required for processing health-related data (injuries/physical limitations) and for marketing communications

Legal obligations: for example for accounting and tax purposes related to subscriptions

Processing methods

Data is processed with adequate security measures: passwords are stored encrypted, access to data is limited to authorized personnel, and periodic backups are performed.

Data retention

Data is retained for the entire lifetime of the account. If the account is deleted, personal data is deleted or anonymized within 30 days, except where a longer retention period is required by legal obligations (for example, accounting data related to subscriptions).

Disclosure to third parties

Your data may be shared with the following parties, to the extent strictly necessary to provide the service:

OpenAI, L.L.C. — data processing for generating workout plans through artificial intelligence

RevenueCat, Inc. — technical management of in-app subscriptions

Apple Inc. and Google LLC — payment processing when you subscribe through the App Store or Google Play

Hosting and cloud infrastructure providers, necessary to deliver the service

All these parties process data as independent controllers or processors, in compliance with applicable law.

International transfers

Some of the parties listed above (in particular OpenAI, RevenueCat, Apple and Google) are based in the United States. The transfer of your data to these countries is based on adequate safeguards provided by the GDPR, such as the standard contractual clauses approved by the European Commission or adherence to recognized transfer frameworks (e.g. the EU-U.S. Data Privacy Framework, where applicable by the individual provider).

User rights

Access, rectification, erasure

Restriction, objection, portability

Withdrawal of consent

To exercise your rights: info@thalonapp.com

Complaints

You can file a complaint with the Italian Data Protection Authority (Garante Privacy): www.garanteprivacy.it

Changes

This notice may be updated. Changes will be communicated through the app or the website.