Privacy Policy

Rexly s. r. o. Registered office: Račianska 14350/64B, 831 03 Bratislava, Slovak Republic Company ID: 57 516 812 · Tax ID: 2122791220 · VAT ID: SK2122791220 Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 197507/B Email: support@trely.eu · privacy: privacy@trely.eu Web: https://trely.eu

The privacy contact is privacy@trely.eu. Trely assessed GDPR Article 37 and, as of the effective date, is not required to appoint a data protection officer; this is reviewed regularly.

Trely is the controller for account, public-profile, enquiry, subscription, support, security and service-operation data. For client data entered by a trainer, physiotherapist or another professional, that professional is the controller and Trely is the processor under GDPR Article 28. The professional determines the purpose, legal basis and information supplied to clients. Trely’s processor duties are included in section 5 of the Terms accepted by the trainer together with this policy. For card-payment processing, Stripe acts under its own terms and privacy policy.

Identity and contact data; account, public-profile, enquiry and subscription data; communications, chat, support and reviews; calendars, bookings, training and rehabilitation plans; height, weight, BMI, body measurements, goals, injuries, test results and progress; photos and files; IP address, device identifiers and time zone, logs, app and OS version; billing data, payment amount, currency, status and identifier, Stripe connected-account identifier and verification state. Trainers provide identity and payment-account verification details directly to Stripe. Trely does not see full payment-card numbers. Trely is not intended to process data about people under 16.

Account and service features: performance of the contract while the account exists; after that, we delete or anonymise the data without undue delay. Public profiles and enquiries: performance of the contract and steps requested before an agreement with a trainer; a profile remains public until the trainer hides it, and enquiry data is retained while it is handled and then for as long as necessary for that purpose, after which it is deleted. When a client deletes their account, we promptly remove their access, contact and profile data, messages, progress photos, measurements, intake forms, private notes linked to their account and client-specific training records; a note written on a shared group session remains with the trainer, because it belongs to the session, not to an individual participant. We keep messages and photos in the chat with your trainer for as long as the account exists. After you are disconnected from the trainer, you no longer see the chat in the app; the messages stay stored. If you delete your account, we delete the whole chat with your trainer. If the trainer deletes their account, we delete their messages; yours stay stored but are no longer shown in the app. Messages and photos in a group chat stay in the chat history after a member leaves the chat, is removed from the group or is disconnected from the trainer, and the others still see them under the author’s name. When you delete your account, we also delete the messages and photos you sent in group chats; when you erase your data with a particular trainer, we delete them in that trainer’s groups. After you are disconnected from a trainer, you can remove that trainer’s access to your data: the trainer no longer sees it, we delete the notes the trainer kept about you, your sessions and your payments, and your measurements, progress photos and intake forms stay in your account. If you erase your data with that trainer, we also delete your measurements, progress photos, intake forms, habits, achievements and the photos you sent the trainer in the chat. If a trainer deletes a group or their account, the whole group chat is deleted. If the trainer switches the group chat off, the history stays stored: the trainer can read it, the clients no longer can, and nobody writes in the chat. Otherwise we keep the messages for as long as the group exists. Historical bookings, payments and operational audit records remain without the client’s original identity. Client data: on the professional user’s instructions. Support: contract or legitimate interest, for as long as necessary to handle the request. Accounting and payment records: legal obligation, 10 years from the end of the relevant accounting period. We retain records of failed payment attempts together with the other payment records. Subscriptions and payments: contract, security and fraud prevention, subject to statutory periods and the rules of Apple, Google, RevenueCat and Stripe. Saved card and consent to automatic payments: the legal basis is performance of the contract. The card itself is stored by Stripe on the trainer’s account; Trely holds only the payment-method identifier, the card brand, the last four digits, the expiry date and the consent record (text version, time, amount, currency and date). Trely keeps the card data until the client removes the card, withdraws consent or deletes the account; it keeps the consent record for as long as necessary to demonstrate the consent and to handle the payments made under it. E-mails about a failed payment and required authentication: the legal basis is performance of the contract; they are sent by the Resend service. E-mails to trainers during the trial: the e-mail after you confirm your registration, the notice one week before the trial ends and the e-mail after it has ended are sent for the performance of the contract. Further e-mails with tips on getting started with Trely (for example connecting your first client or scheduling your first session), including a reminder before the trial ends, are sent on the basis of legitimate interest. To choose an e-mail we use the state of your account: connected clients, sessions and recurring sessions, packages, groups and group chat, public profile, online payments, working hours, reviews and review requests, subscription, last activity and device time zone. You can object to them at any time with the unsubscribe link in each such e-mail, without signing in; we will then not send them to you again. The e-mails contain no tracking pixels. We record which e-mail we sent, when and with what result, and, if you click a link in the e-mail, which link and when. We keep these records for as long as necessary for that purpose and the unsubscription for as long as the account exists. We send news, offers and tips from Trely by notification or e-mail only with your consent, which you can withdraw at any time in Settings. Consent to news, offers and tips that you gave for notifications before this version of the policy also covers e-mails; you can withdraw it in Settings or with the link in the e-mail. We keep a record of when and to which wording you gave or withdrew consent for as long as needed to prove it. Product analytics: legitimate interest in improving security and usability; we use a pseudonymous account identifier, role, app version, OS and feature-use data, not chat content, photos or health data. We retain product analytics data for as long as necessary for that purpose; the analytics provider (PostHog) retains it for 7 years. Our plan with the provider does not let us set a shorter period. When you delete your account, we ask PostHog to delete the data linked to your account. We retain message delivery records, booking status history, security and administrator audit records and records of administrative tasks for as long as necessary to keep the service secure and running. We retain operational logs, error reports and database backups for as long as necessary for their purpose. Data held by external providers (Sentry, PostHog, Stripe, Resend, RevenueCat) and in backups is retained according to those providers’ settings. We permanently retain the record of who accepted which version of the legal documents and when, and the record of how a data-subject request was handled. We retain contact details and notes on handling a request for 3 years after it is closed and then delete them. We provide the copy of your data (export) through a link; the link and the file are valid for at most 7 days, after which we delete the file. During a complaint, dispute or official proceeding, we retain only the records needed to resolve it until it ends. Reporting a message: legitimate interest in keeping the service safe. We store who reported the message and why, and a copy of its text and photo so that the Trely team can review it. We keep the copy while the report is being handled and afterwards for as long as the message itself exists. If the Trely team removes a message, we delete its photo within one day; the text of the message stays stored and is not shown. If the author of the message deletes their account, we also delete the copy from the report; only the record that a report was made and how it was handled remains. Reviews: legitimate interest in trustworthy information about trainers. A review (rating, text and your name) is public on the trainer's profile, on the web and in data for search engines. In a review without your name, “Anonymous client” is shown instead and the trainer does not see your name; only the Trely team sees it when checking the review. When you erase your data with a trainer, we delete the text of your review of that trainer and your name on it; the review is then shown everywhere with the label “Anonymous client”. Disconnecting alone does not change the review. When you delete your account, we delete the text and your name and the review is shown as “Anonymous client”. The rating remains part of the trainer's rating. If the trainer deletes their account, the reviews of them are deleted too. We delete the copy of a review's text in a report together with the text.

Height, weight, BMI, measurements, injuries, rehabilitation, tests and progress photos may be special-category data under GDPR Article 9. The professional obtains and records the appropriate basis, usually explicit consent under Article 9(2)(a). As processor, Trely does not use this data for marketing, profiling or AI-model training. Progress photos and the materials you exchange in the app are not public; access to them is controlled by authentication and access rules. A trainer can switch on a group chat for one of their client groups; members of the group who have a Trely account are in it straight away and may leave it. In a group chat, your name, profile photo, messages and the photos in your messages are seen by the other members of the chat and by the group’s trainer. A new member sees messages from the moment they were added; the trainer sees the whole chat history. In a chat between a trainer and a client, you can send a photo. Photos in a chat are not public: only those who can see the message see them, and the Trely team when it reviews a reported message. You can remove a photo you sent from the chat. A client’s profile photo is not public. It is seen by the client, their connected trainers and the members of their group chats. A former trainer no longer sees it. A trainer’s profile photo, however, is publicly accessible: it appears on the public profile and is loaded from a public address, so it can be opened without signing in. If a trainer hides their profile, it stops appearing in search and on the public profile, but the photo itself may remain reachable through a known address or from a browser or network cache. A trainer who wants the photo gone should replace or delete it in profile settings.

Supabase (EEA, Frankfurt) – database, authentication and storage; RevenueCat – subscriptions; Apple and Google – distribution, purchases and push; Stripe – payment-account verification, storing cards for automatic payments, card payments, refunds and fraud prevention; Resend – email delivery; Expo – push infrastructure; Sentry – diagnostics; PostHog – product analytics; Vercel – web hosting and traffic measurement. This current list forms the generally authorised subprocessors for client-data processing; trainers receive reasonable advance notice of a material change. Transfers outside the EEA use GDPR Chapter V safeguards, especially the EU–US Data Privacy Framework or Standard Contractual Clauses. In a group chat, the recipients of your messages and photos are the other members of the chat and the group’s trainer. Advisers and public authorities may receive data where legally required.

Measures include TLS, encryption at rest, least-privilege access, database access policies, monitoring, backups and security updates. As controller we report qualifying breaches to the authority generally within 72 hours and notify people where risk is high. As processor we notify the professional without undue delay.

You may request access, correction, deletion, restriction and portability, object, withdraw consent and complain. Email privacy@trely.eu; we normally respond within one month. For trainer-entered data, contact the trainer first; Trely assists the trainer with the request. Cancelling a subscription does not delete an account. Delete in the app or email support@trely.eu. Practical steps and retention details are at https://trely.eu/en/delete-account. Trely does not make decisions under GDPR Article 22.

The mobile app does not use browser cookies; it uses essential authentication tokens and device identifiers. The website uses no advertising cookies, third-party cookies or other non-essential storage; the language is determined by the URL. For traffic measurement we use Vercel Web Analytics: it is cookieless, stores nothing in your browser and builds no cross-site profiles. It processes the page visited, the referring source, country, device type, operating system and browser; unique visitors are counted using an identifier that changes daily, so it cannot follow you over time. On trely.eu/app and trely.eu/pair we also measure whether a visitor went on to an app store or into the app. Our server sends this to PostHog without cookies and without storing anything in your browser: the device type, the campaign and the domain the visit came from, and a random visit identifier that is gone when the page is closed. PostHog builds no person profile from it and does not determine location. Before enabling analytics that requires cookies or other non-essential storage, we will update this policy and obtain valid consent.

We provide appropriate notice of material changes. The current version is always available at trely.eu. Supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk, +421 2 3231 3214, https://dataprotection.gov.sk. You may also lodge a complaint with the supervisory authority of the EU country where you live or work. The Slovak version is binding.