For the purposes of this Policy, we act as a Business within the meaning of the CCPA and its amendments (CPRA). This means that we determine what Personal Data we collect from consumers, for what purposes, and how it is processed.

We may share your data with Service Providers who process it on our behalf in accordance with our instructions, and with Third Parties in cases provided by law or this Policy.

The Business is ANATOLY FZCO, a company registered under the laws of the United Arab Emirates, with its registered address at Dubai Silicon Oasis, DDP, Building A1, Dubai, United Arab Emirates, and license number: 33037 (hereinafter referred to as the Company).

If you are a California resident, the provisions of this document apply directly to you. If you live in another US state, you can also contact us if you have questions about the processing of your Personal Data or if the laws of your state grant you additional rights or guarantees.

Personal data that you provide when you create your account on the Platform or communicate with technical support:

• Information related to your account: When you register an account on the Platform, we collect information related to your account, including your first name, last name, contact details (phone number), email, payment details (transaction history without card details), sex, age, weight, height, and your image (profile picture)¹.
• User content: When you use the Platform, we receive certain Personal Data, such as the information you enter, the files you upload, and the comments or reviews you leave.
• Communication information: If you communicate with us (including technical support), we collect information such as your full name, contact details, email address, and the content of the messages you send.
• Other information you provide: We collect other information you provide to us, such as in connection with your participation in surveys or other activities, as well as information you provide to us to establish your age or identity.

Personal data that we automatically receive when you use the Platform (Technical Information):

• Log data: Information that the Platform automatically sends when you use it. Such data may include your IP-address, browser type and settings, the date and time of your request, and information about your interaction with the Platform.
• Usage data: We may automatically collect information about your use of the Platform, such as the type of content you view or interact with, the features you use, the actions you take, as well as your time zone, country, date and time of access, device type, and device connection.
• Device information: the name of the device and operating system, identifiers of the device you are using. The type of information collected may depend on the type of device you use to access the Platform and its settings, push token.
• Cookies and similar technologies: we use cookies and similar technologies to ensure the Platform works and to manage it, as well as to improve your experience of using it. For example, a session token or similar technical identifier, but not your account password. Detailed information about cookies is available in the Cookie Policy posted on the Platform.
• Social networks, messengers: Your nicknames on social networks, messengers (Facebook, Telegram, Instagram).

Personal data that we receive from other sources:

• We may receive information about you from other sources, including publicly available information on the Internet, in particular for the purposes described in this Policy.

  We also receive information from our trusted partners, such as security partners, to protect against fraud, abuse, and other security threats to the Platform, or from marketing service providers who provide us with information about potential customers for our services.

The Platform collects "Sensitive Personal Information" under the CPRA: data about your sex, height, age, weight, and your image (profile photo), solely on the basis of your explicit consent. It is important to note that our platform is not a healthcare provider and does not provide healthcare services within the meaning of US law. Therefore, the data provided is not considered "protected health information" (PHI) under HIPAA.

You have the right to request that we restrict the use of such data solely to providing services, ensuring security, and fulfilling our legal obligations. If you wish to exercise your right to restrict use, or to have your data completely removed, please contact us.

In certain cases, user content may be considered sensitive data (in particular, if such content includes information about sex, height, age, weight, or your images); in such cases, the content is processed on the basis of your explicit consent.

The Platform collects payment history: We do not collect or save bank details or complete payment details. All payments are processed by our partner Stripe. We only receive limited transaction information (date, amount, status, ID) that is used for your purchase history and to fulfill legal obligations. The GLBA and FCRA laws do not apply to our activities because we are not a financial institution and do not process credit histories.

If you have won a Contest operated by the Company in connection with the Platform, the Challenge, a Paid Subscription or another Service, we may request information from you that is necessary to award you the prize and to properly report the transfer of the prize to you to state and local government authorities.

This information includes your full name, tax identification number, date of birth, nationality, residential address, passport/ID number, email address, phone number, and bank details. This information is collected in accordance with the CPRA as information required for performance of a contract by sending you, as the Winner, the Prize Acceptance Form, which you must complete.

The procedures for conducting the Contest are governed by Contest Rules for APS Services.

We may collect the following categories of Personal Information:

1. Identifiers: name, email address, phone number, account ID, IP address, device identifiers, Telegram or social media usernames.
Purpose: account registration, authentication, customer support, service communications, fraud prevention, legal compliance. Disclosed to: hosting providers, customer support providers, email providers, security providers, payment providers, communication providers.
Sold or shared: not sold for money; may be shared for cross-context behavioral advertising only where applicable and subject to your opt-out rights.

2. Commercial information: subscription status, purchase history, transaction ID, payment amount, payment date, refund status.
Purpose: payment processing, accounting, access management, refunds, tax and legal compliance.
Disclosed to: payment processors, accounting providers, hosting providers, legal and compliance providers.
Sold or shared: no.

3. Internet or network activity information: log data, pages viewed, actions taken on the Platform, videos viewed, cookie identifiers, analytics data, device and browser information.
Purpose: platform operation, analytics, security, troubleshooting, fraud prevention, product improvement, advertising where permitted.
Disclosed to: hosting providers, analytics providers, security providers, advertising partners where permitted.
Sold or shared: may be shared for cross-context behavioral advertising where advertising cookies or similar technologies are used and where you have not opted out.

4. Health and fitness-related information / Sensitive Personal Information: age, sex or gender, height, weight, body measurements, fitness goals, training history, nutrition-related information, activity tracking, body images, photos, videos, information about injuries, physical limitations or other health-related information voluntarily provided by you.
Purpose: creating and providing the online fitness service package, generating training and nutrition plans, progress tracking, Remote Online Support, safety, compliance and dispute resolution.
Disclosed to: hosting providers, support providers, communication providers and other service providers acting on our behalf.
Sold or shared: no.

5. User Content and Support Data: messages, comments, uploaded files, support requests, feedback, Telegram communications and other content you provide.
Purpose: providing the Services, Remote Online Support, moderation, safety, troubleshooting, legal compliance and dispute resolution.
Disclosed to: hosting providers, customer support providers, communication providers, legal and compliance providers.
Sold or shared: no, unless you separately consent to a specific marketing or promotional use.

6. Approximate location and billing-related information: country, region, billing country, billing address where provided, IP-derived approximate location.
Purpose: payment processing, fraud prevention, service availability, legal compliance and determining applicable rules for the Services.
Disclosed to: payment processors, hosting providers, fraud prevention providers, accounting and legal providers.
Sold or shared: no.

We may use Personal Data for the following purposes:

• providing and ensuring the operation of the Platform, authentication and authorization: we use personal data to enable you to safely log into your account on the Platform, as well as to enable the effective and uninterrupted use of all Platform functions;
• improving and developing the Platform and new features, conducting research, and personalizing the user experience;
• communicating with you, including sending you information and marketing materials about the Platform and other services, products, and events, and push notifications: we use personal data to communicate with you about matters related to your account, the Platform, notifications or security alerts, and to properly deliver push notifications to your device;
• providing you with feedback, adding you to our Telegram channel: we use personal data to communicate with you while providing you with services;
• to prevent fraud, criminal activity, or misuse of the Platform, and to maintain the security of our systems and the Platform: for example, we may use multi-factor authentication (including phone numbers) to strengthen security; and
• to comply with legal obligations and protect the rights, privacy, safety, or property of our users (you), us, our affiliates, or third parties.
• to formalize the results of the Contest, we may list your username on the Platform and publicly display your username to announce the Contest results.

Aggregated or anonymized information. We may aggregate or anonymize Personal Data so that it does not identify you. This information is used to analyze the Platform's performance, improve and expand its functionality, conduct research, and for other similar purposes.

It is collected through the Platform, cookies, and other tools described in this Privacy Policy. We will store and process such data exclusively in a aggregated or anonymized form, in which it will be impossible to restore its identification.

We do not use identifiable Personal Data, Health and Fitness Data, photos, videos, Support Data, private communications or data relating to minors to train artificial intelligence or machine learning models unless you provide a separate, explicit and specific opt-in consent for that purpose.

We may use aggregated or anonymized information that does not identify you and cannot reasonably be used to re-identify you to improve the Platform, analyse performance, develop features and improve user experience.

We may use Your personal data, namely Your images, name, surname, sex, weight, and age, for marketing purposes only if You provide Your explicit consent in accordance with the terms of the CPRA by checking the box "I agree to the use of my photos and videos for marketing purposes". The use of personal data for marketing purposes is governed by Informed Consent for the Processing and Use of Photo and Video Materials.

Under certain circumstances, we may disclose your Personal Data to the following parties:

• Vendors and service providers: If necessary for our business activities and to provide certain services or functions, we may disclose Personal Data to vendors and service providers, including hosting providers, customer service providers, cloud services, data storage, technical support and security monitoring, email communication software, online information analytics services, payment and transaction processing providers, and other information technology providers, the messengers and social networks that we use to communicate with you. In accordance with our instructions, these parties only access, process, or maintain Personal Data in the course of performing their duties to us;
• Business transfer parties: if we engage in strategic transactions, reorganization procedures, bankruptcy, external management, or transfer of services to another provider (hereinafter collectively referred to as "Transaction"), your Personal Data and other information may be disclosed during the due diligence process to counterparties and other persons assisting with the Transaction, and transferred to a successor or affiliate as part of such Transaction along with other assets. In the event of such a merger, acquisition, reorganization, sale of assets, or bankruptcy of our company, your personal data may be transferred to the successor. Such successor is required to use your data only for the purposes specified in this Privacy Policy or to notify you of the changes and provide you with the opportunity to exercise your rights in accordance with applicable law (in particular, CCPA/CPRA);
• Government authorities and other third parties: We may disclose your Personal Data, including information about your interaction with the Platform, to government authorities or third parties in accordance with the law, (i) if required by law or if we believe in good faith that such action is necessary to comply with a legal obligation, (ii) to protect our rights or property; (iii) if we determine, in our sole discretion, that there has been a violation of our terms, policies, or legal requirements; (iv) to detect or prevent fraud or other illegal activities; (v) for the purposes of security, protection, and maintenance of the integrity of our products, employees, users, or the public; or (vi) to protect against legal liability;
• Affiliates: We may disclose Personal Data to our affiliates, which are entities that control, are controlled by, or are under common control with the Company. Our affiliates may use the Personal Data we provide solely in accordance with the requirements of this Privacy Policy;
• Corporate account administrators: If you join our platform through a corporate account (e.g., through an employer or educational institution account), the administrator of that account may have access to certain information in your profile. We do not control the actions of corporate account administrators and recommend that you contact your organization for details about their privacy policies.

Where you use Telegram or another third-party messenger to communicate with the Company or participate in the Challenge, your use of that messenger is also governed by the terms and privacy policy of the relevant third-party provider. The Company may process your messenger username, messages, support requests and related communication data for the purpose of providing the Services, Remote Online Support, moderation, safety, compliance and dispute resolution.

If you post information in a group channel or chat, such information may be visible to other participants. You should not post highly sensitive information, medical records, payment information, government identification documents or other confidential information in group communication channels.

We will store your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including providing you with access to the Platform, ensuring its uninterrupted operation, protecting our legitimate interests, fulfilling legal obligations, or resolving potential disputes.

If your account on the Platform remains inactive for 30 calendar days, or if you participated in a Challenge that has since ended, we have the right to remove or anonymize your Personal Data, unless otherwise required by law or justified by the need to protect our rights and legitimate interests.

Platform Data and Support Data necessary to review a Money-Back Guarantee application may be retained until the expiry of the period for submitting such application, the completion of the review process and, where necessary, for the period required to establish, exercise or defend legal claims.

Transaction, payment, refund, accounting and tax-related records may be retained for the period required by applicable accounting, tax and legal obligations.

Health and Fitness Data that is no longer necessary for providing the Services, reviewing a Guarantee Application, complying with legal obligations or protecting legitimate interests will be deleted or anonymized within a reasonable period after account deletion or termination of the relevant service, unless the User requests earlier deletion and such deletion is legally and technically possible.

The duration of storage of Personal Data depends, in particular, on:

• the purposes for which we process the data (for example, to provide access to the Platform or to communicate with you);
• the type of data, including whether it belongs to the category of Sensitive Personal Information;
• the potential risks associated with unauthorized access or disclosure;
• the statute of limitations or other legal requirements that apply to us.

We take appropriate technical and organizational measures to ensure the secure storage of your Personal Data, including:

• Encryption: personal data is encrypted both at standstill and during transmission using modern cryptographic algorithms;
• Access control: only authorized employees and contractors have access to Personal Data, exclusively for the performance of specific tasks. All of them are required to comply with confidentiality and Policy rules.
• Cloud storage and databases: we use secure databases and cloud storage services that comply with international security standards and implement measures to protect data from loss, unauthorized access, modification, or destruction.
• Monitoring and auditing: we periodically review our security procedures and conduct technical audits to minimize the risks of confidentiality violations.
• Pseudonymization and anonymization (where possible): sensitive categories of data may be processed in a depersonalized form to reduce the risk of unauthorized use.

You have the following legal rights regarding your Personal Data:

Your Right and What this means for you:

Right to know:

• You can find out what data we collect about you, where it comes from, and what it is used for.

Right of access:

• You can obtain a copy of your personal data in an understandable format.

Right to correct

• If the data is inaccurate or outdated, you can ask us to correct it.

Right to delete

• You can request that your data be deleted if it is no longer needed to provide services or comply with the law.

Right to object to processing

• You can ask us to restrict or stop using your data for certain purposes (e.g., for marketing or profiling).

Right to restrict the use of Sensitive Personal Information

• If we process data about your age, weight, height, gender, or photo, you can request that we use it only for the operation of the service and not for other purposes.

Right to opt out of sale or sharing

• You can restrict us from sharing your data with third parties for advertising or other commercial purposes.

Right to consent (opt-in) for children

• Data of children under 13 is only processed with parental consent, and data of teenagers aged 13-16 is only processed with their consent.

Right to data transfer

• You can receive your data in a format that is easy to transfer to another service.

Right to non-discrimination

• We cannot deny you access to the service or make it more expensive if you exercise your rights.

Right to complain

• If you believe that we are processing your data incorrectly, you can contact us or your local data protection authority (e.g., the California Privacy Protection Agency).

You can exercise some of these rights through your account on the Platform. If you are unable to exercise your rights through your account, please send an email request to technical support.

If the withdrawal of Personal data makes it impossible to provide all or part of the services we offer under the Terms of Use, we reserve the right to notify you of the consequences of such withdrawal and offer one of the following options:

• deletion of Personal data, resulting in the termination of all or part of the services;
• retention of Personal data to the extent necessary for the continued provision of services.

Please keep in mind that these rights may be limited, for example, if fulfilling your request would reveal Personal Data of another person or if you ask us to delete information that we are required to keep by law or for our compelling legitimate interests.

We hope we can answer your questions or concerns.

We do not sell Personal Information for money. However, certain uses of advertising cookies, pixels or similar technologies may constitute "sharing" of Personal Information for cross-context behavioral advertising under California law.

California residents may opt out of the sale or sharing of Personal Information by using the "Do Not Sell or Share My Personal Information" link available on the Website, by changing cookie settings, by contacting us, or by using a browser or extension that sends a Global Privacy Control signal.

Where required by applicable law, we honor Global Privacy Control signals as a valid request to opt out of the sale or sharing of Personal Information.

We do not knowingly sell or share the Personal Information of consumers under the age of 16 without the required opt-in consent.

This section applies to personal information that may be considered Consumer Health Data under applicable U.S. state consumer health privacy laws, including where such laws apply to the Company.

Consumer Health Data may include information that is linked or reasonably linkable to you and that identifies or may be used to identify your past, present or future physical or mental health status, including fitness goals, body measurements, weight, height, training activity, nutrition-related information, physical limitations, injuries, body images, progress information and support communications relating to health, fitness or wellbeing.

We collect and use Consumer Health Data only for the following purposes:

• to provide and operate the Platform and Services;
• to generate and make available training and nutrition materials;
• to provide tracking functionality, Remote Online Support and service communications;
• to process refunds and Money-Back Guarantee requests;
• to ensure safety, security, fraud prevention and compliance;
• to comply with legal obligations and protect legal rights.

We do not sell Consumer Health Data. We do not use Consumer Health Data for targeted advertising or cross-context behavioral advertising. We do not use Consumer Health Data to train artificial intelligence or machine learning models unless you provide a separate explicit opt-in consent.

We may disclose Consumer Health Data to service providers that process such data on our behalf and under our instructions, including hosting providers, customer support providers, communication providers, security providers and other vendors necessary to provide the Services.

You may request access to, deletion of, correction of, or withdrawal of consent for the processing of Consumer Health Data by contacting us at privacy@anatolyfit.com or support@anatolyfit.com. We will process such requests in accordance with applicable law.

The Platform is not intended for children under the age of 13.

Users under the age of 18 may use the Platform only with the consent and supervision of a parent or legal guardian, unless applicable law requires a higher age or a different form of consent.

Children under 13. In accordance with COPPA, we do not knowingly collect Personal Information from children under 13 without verifiable parental consent. If we become aware that Personal Information of a child under 13 has been collected without the required parental consent, we will delete it as soon as reasonably possible.

Teenagers aged 13 to 15. We do not knowingly sell or share the Personal Information of consumers aged 13 to 15 without the required opt-in consent.

Users aged 16 and older. Users aged 16 and older may exercise their privacy rights, including the right to opt out of the sale or sharing of Personal Information, where applicable.

Paid Subscriptions, participation in the Challenge, participation in any Contest, and any functionality involving physical training, performance testing, nutrition plans or submission of health, fitness or body-related information may be purchased or used by a minor only with the consent and supervision of a parent or legal guardian.

We may transfer and process your personal data outside the United States, including in countries within the European Union where our servers or service providers are located. Such transfers are necessary to enable our Platform to function. Regardless of where the processing takes place, we apply the same security measures and ensure that your rights under the CCPA/CPRA are protected. For more information about the security guarantees we provide, please contact us by sending an email to technical support.

We may send you push notifications to inform you about important events related to your account and use of the Platform (e.g., subscription confirmation, activity reminders, Platform update notifications). Such notifications are part of the provision of our services.

With your separate consent, we may also send you marketing or informational messages (e.g., offers, special promotions, or reminders to support activity). You have the right to opt out of such messages at any time in your browser or device settings or by clicking on the "Opt out of messages" link. If this is not possible, you can contact us by email and we will disable push notifications manually.

We process your device's technical data (e.g., browser ID, push token) to send push notifications. This data is used exclusively for the delivery of notifications and is not shared with third parties, with the exception of partner services that provide technical delivery.

Special conditions for children: if the user is under 13 years of age, push notifications may only be sent with the confirmed consent of their parents or legal guardians.

We keep the right to update this Privacy Policy to reflect current personal data processing practices, changes in legislation or regulatory requirements, as well as in case of updating the Platform's functionality. We update this Policy at least once every 12 months, as required by California law (CCPA/CPRA).

All amendments are published by posting the updated version of the Policy on this page with the date of "effective date." In cases where the changes are significant, we may additionally notify you of them (for example, by email or a message on the Platform).

We recommend periodically reviewing this Policy to stay informed about how we protect your Personal Data.

If you have any questions about this Privacy Policy or wish to exercise your rights under the CCPA/CPRA (e.g., the right of access, the right to know, correct, delete, or opt out of the sale/sharing of data etc.), please contact us:

• by email: support@anatolyfit.com
• via the contact form on our website: https://anatolyfit.com/.

We will review your request and respond within 45 days of verifying your identity. If necessary, this period may be extended by another 45 days, which we will notify you of separately. To process your request, we may ask you to provide additional information to verify your identity.

If you are a California resident and believe that we are violating your rights, you may also file a complaint with the California Privacy Protection Agency (CPPA).