This policy explains personal-data processing in the Trely mobile and web service under the GDPR and Slovak Act No. 18/2018. Cookies are covered here rather than in a separate policy.
1. Controller and scope
Rexly s. r. o. Registered office: Račianska 14350/64B, 831 03 Bratislava, Slovak Republic Company ID: 57 516 812 · Tax ID: 2122791220 · VAT ID: SK2122791220 Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 197507/B Email: support@trely.eu · privacy: privacy@trely.eu Web: https://trely.eu
The privacy contact is privacy@trely.eu. Trely assessed GDPR Article 37 and, as of the effective date, is not required to appoint a data protection officer; this is reviewed regularly.
2. Our roles
Trely is the controller for account, public-profile, enquiry, subscription, support, security and service-operation data. For client data entered by a trainer, physiotherapist or another professional, that professional is the controller and Trely is the processor under GDPR Article 28. The professional determines the purpose, legal basis and information supplied to clients. Trely’s processor duties are included in section 5 of the Terms accepted by the trainer together with this policy. For card-payment processing, Stripe acts under its own terms and privacy policy.
3. Data we process
Identity and contact data; account, public-profile, enquiry and subscription data; communications, chat and support; calendars, bookings, training and rehabilitation plans; height, weight, BMI, body measurements, goals, injuries, test results and progress; photos and files; IP address, device identifiers, logs, app and OS version; billing data, payment amount, currency, status and identifier, Stripe connected-account identifier and verification state. Trainers provide identity and payment-account verification details directly to Stripe. Trely does not see full payment-card numbers. Trely is not intended to process data about people under 16.
4. Purposes, legal bases and retention
Account and service features: performance of the contract while the account exists, followed by deletion or anonymisation generally within 30 days. Public profiles and enquiries: performance of the contract and steps requested before an agreement with a trainer; a profile remains public until the trainer hides it, and enquiry data is retained while it is handled and then for 12 months from the last change to the enquiry status, after which it is deleted. When a client deletes their account, we promptly remove their access, contact and profile data, messages, progress photos, measurements, intake forms, private notes linked to their account and client-specific training records; a note written on a shared group session remains with the trainer, because it belongs to the session, not to an individual participant. Historical bookings, payments and operational audit records remain without the client’s original identity. Client data: on the professional user’s instructions. Support: contract or legitimate interest, 3 years. Accounting and payment records: legal obligation, 10 years from the end of the relevant accounting period. We retain records of definitively failed payment attempts where no money was received for 90 days from the end of the attempt. Subscriptions and payments: contract, security and fraud prevention, subject to statutory periods and the rules of Apple, Google, RevenueCat and Stripe. Saved card and consent to automatic payments: the legal basis is performance of the contract. The card itself is stored by Stripe on the trainer’s account; Trely holds only the payment-method identifier, the card brand, the last four digits, the expiry date and the consent record (text version, time, amount, currency and date). Trely keeps the card data until the client removes the card, withdraws consent or deletes the account; it keeps the consent record for 3 years from the last payment made under it. E-mails about a failed payment and required authentication: the legal basis is performance of the contract; they are sent by the Resend service. Product analytics: legitimate interest in improving security and usability; we use a pseudonymous account identifier, role, app version, OS and feature-use data, not chat content, photos or health data. We retain product analytics data for at most 90 days from the event. Delivery telemetry: 90 days. Booking status history: 365 days. Security and administrator audit records: 2 years. We retain non-financial records of administrative tasks for 2 years after the task is closed. Sentry operational logs and crash reports: 30 days. Daily database backups: 7 days. We retain evidence of data-subject rights requests and legal acceptances permanently. During a complaint, dispute or official proceeding, we retain only the records needed to resolve it until it ends.
5. Health data and photos
Height, weight, BMI, measurements, injuries, rehabilitation, tests and progress photos may be special-category data under GDPR Article 9. The professional obtains and records the appropriate basis, usually explicit consent under Article 9(2)(a). As processor, Trely does not use this data for marketing, profiling or AI-model training. Progress photos and the materials you exchange in the app are not public; access to them is controlled by authentication and access rules. A trainer’s profile photo, however, is publicly accessible: it appears on the public profile and is loaded from a public address, so it can be opened without signing in. If a trainer hides their profile, it stops appearing in search and on the public profile, but the photo itself may remain reachable through a known address or from a browser or network cache. A trainer who wants the photo gone should replace or delete it in profile settings.
6. Recipients and transfers
Supabase (EEA, Frankfurt) – database, authentication and storage; RevenueCat – subscriptions; Apple and Google – distribution, purchases and push; Stripe – payment-account verification, storing cards for automatic payments, card payments, refunds and fraud prevention; Resend – email delivery; Expo – push infrastructure; Sentry – diagnostics; PostHog – product analytics; Vercel – web hosting and traffic measurement. This current list forms the generally authorised subprocessors for client-data processing; trainers receive reasonable advance notice of a material change. Transfers outside the EEA use GDPR Chapter V safeguards, especially the EU–US Data Privacy Framework or Standard Contractual Clauses. Advisers and public authorities may receive data where legally required.
7. Security and incidents
Measures include TLS, encryption at rest, least-privilege access, database access policies, monitoring, backups and security updates. As controller we report qualifying breaches to the authority generally within 72 hours and notify people where risk is high. As processor we notify the professional without undue delay.
8. Your rights and account deletion
You may request access, correction, deletion, restriction and portability, object, withdraw consent and complain. Email privacy@trely.eu; we normally respond within one month. For trainer-entered data, contact the trainer first; Trely assists the trainer with the request. Cancelling a subscription does not delete an account. Delete in the app or email support@trely.eu. Practical steps and retention details are at https://trely.eu/en/delete-account. Trely does not make decisions under GDPR Article 22.
10. Changes, contact and authority
We provide appropriate notice of material changes. The current version is always available at trely.eu. Supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk, +421 2 3231 3214, https://dataprotection.gov.sk. You may also lodge a complaint with the supervisory authority of the EU country where you live or work. The Slovak version is binding.