Data protection addendum

Fortified Fuel Fitness & Nutrition, operated by Jeff Beck, Daphne, Alabama

Version 0.2, September 2026. Under review.

About this addendum

This addendum sits under the Fortified Fuel Privacy Policy. It explains how Fortified Fuel handles personal data for members in the EU, the UK and US states with privacy laws, and we apply the same standards to everyone, wherever you live. It uses the terms of the EU General Data Protection Regulation (GDPR), the UK GDPR and the California Consumer Privacy Act (CCPA) because those laws set the standard we follow. If this addendum and the Privacy Policy say different things, this addendum applies.

1. Definitions

1.1 Personal data (called "personal information" under CCPA) means any information about you that identifies you or could reasonably be linked to you. Your name, email address, phone number, date of birth, weight, workout logs, food logs, meal photos, progress photos, check-in answers, AI coach conversations, and your usage of the app are all personal data.

1.2 Sensitive data means personal data that gets extra protection. For Fortified Fuel this is your health-related data: body weight and measurements, progress photos, food logs, and anything you tell us about your health, injuries, medications, sleep, stress or lifestyle in a check-in or to the AI coach. GDPR calls this "special category data" (data concerning health). CCPA calls it "sensitive personal information". Your precise location would also be sensitive data. We do not collect it. It also includes an audio recording you make when you answer a check-in by voice.

1.3 Controller (called "business" under CCPA) means the organisation that decides why and how personal data is used. Fortified Fuel is the controller for your data.

1.4 Processor (called "service provider" or "contractor" under CCPA) means a company that handles personal data on the controller's instructions and for the controller's purposes only. Supabase is a processor for Fortified Fuel.

1.5 Sub-processor means a processor used by one of our processors. For example, the cloud provider that Supabase runs on.

1.6 Data subject (called "consumer" under CCPA) means the person the data is about. In this addendum, that is you, the member.

1.7 Processing means anything done with personal data: collecting it, storing it, reading it, changing it, sharing it, or deleting it.

1.8 Sale and sharing have the CCPA meanings. Sale means giving personal data to a third party for money or other value. Sharing means giving personal data to a third party for cross-context behavioural advertising. Fortified Fuel does neither.

2. Roles

2.1 Fortified Fuel is the controller. Jeff Beck, trading as Fortified Fuel Fitness & Nutrition, decides what data is collected and why. Jeff is the only person at Fortified Fuel who handles member data.

2.2 Third-party roles. The table below states the role each vendor plays.

2.3 We do not use third-party advertising cookies or pixels.

3. Lawful bases and purposes

3.1 Under GDPR, we need a lawful basis for every use of your data, and an extra condition for health data. Under CCPA, we need to tell you the purpose for which we collect each category. The table covers both.

3.2 Legitimate interest balancing. Where we rely on legitimate interest, we have considered whether the use is something you would reasonably expect, whether it could harm you, and whether there is a less intrusive way. Our conclusion is that keeping the service secure and understanding how members use the app are things a member would expect, and neither use involves selling data or advertising to you elsewhere.

3.3 Consent is not a condition of the service for the parts of the service that do not need health data. If you withdraw consent for health data or photos, we can still run your account and subscription, but we cannot build a personalised program or nutrition plan without them.

4. What we do not do

4.1 We do not sell your personal data.

4.2 We do not share your personal data for cross-context behavioural advertising.

4.3 We do not use your health data or photos for advertising.

4.4 We do not use your data to train AI models.

4.5 We do not make body fat estimates, diagnoses or medical claims from your data.

5. Your rights

5.1 Access. You can ask what personal data we hold about you, where it came from, who we have shared it with, why we use it and how long we keep it. We will send you a copy. Under CCPA, we will also tell you the categories of data collected, the sources, the purposes and the categories of third parties it was disclosed to, for the past 12 months or longer if you ask and it is not impractical.

5.2 Rectification (correction). You can correct your name, email, phone number, date of birth, weight, measurements and profile details in the app. For anything you cannot edit yourself, ask us and we will correct it.

5.3 Erasure (deletion). You can delete your account in the app. Deletion removes your profile, logs, photos, check-ins, messages and AI coach conversations from our live database. We keep only what we must keep for tax and accounting records (section 7) and what Stripe must keep for payments. We will pass the deletion request to each processor that holds your data.

5.4 Restriction. You can ask us to stop using your data while we check its accuracy, or while we decide a complaint, without deleting it. In practice, Jeff will stop reviewing your account or generating programs for it until the matter is resolved.

5.5 Portability. You can ask for a copy of the data you gave us in a machine-readable format (JSON or CSV) so you can take it elsewhere. Ask us and we will send it to you. The copy covers your profile, workout logs, food logs, check-in answers, measurements, and your AI coach conversations. Photos are provided as image files.

5.6 Objection. You can object to any use of your data based on legitimate interest, and to any marketing at any time. If you object to marketing, we stop. If you object to another legitimate-interest use, we stop unless we have a compelling reason that overrides your interests, which we will explain.

5.7 Withdraw consent. You can withdraw consent for health data, photos, AI coach conversations, texts, voice notes or marketing at any time, in the app or by asking us. Withdrawal stops future processing. It does not undo processing that happened before you withdrew.

5.8 Opt out of sale or sharing. We do not sell or share your personal data, so there is nothing to opt out of.

5.9 Limit the use of sensitive personal information. We use your health data only to provide the coaching service you asked for, which is a permitted use under CCPA. We do not use it to infer characteristics about you for any other purpose. If you want us to stop using it entirely, you can withdraw consent under section 5.7.

5.10 Non-discrimination. We will not refuse service, charge you a different price, or give you a lower level of service because you exercised a right. The only exception is where the data itself is needed for the feature: no program can be built without training and nutrition data.

5.11 Complain. EU and UK members can complain to their national data protection authority. UK members can contact the Information Commissioner's Office. California members can contact the California Privacy Protection Agency or the Attorney General. We would rather hear from you first (see the Contact section).

6. How to make a request, and how we respond

6.1 How to ask. Message Jeff in the app, use the contact details in the Contact section, or use the account settings page where the app offers the option (deletion, correction, notification preferences). You do not need to use any special form or wording.

6.2 Timelines.

6.3 Free of charge. Requests are free. If a request is clearly unfounded or excessive, particularly because it repeats, we may charge a reasonable fee or decline, and we will tell you why.

6.4 Identity verification. Before we act on a request we need to be sure it is you. For most requests, being signed in to your account is enough. If you ask by email, we will reply to the email address on your account. For a request to receive a copy of health data or photos, or to delete an account, we will ask you to confirm from within the app or answer two account details that only you would know (for example the month you joined and the plan you are on). We do not ask for government ID, and we will not use the verification information for anything else.

6.5 Authorised agents. Under CCPA you can have someone make a request for you. We will ask the agent for your signed permission, and we will confirm with you directly before acting. A person holding a power of attorney for you can act without a separate signed permission if they provide a copy of it.

6.6 Requests we cannot meet in full. If we decline all or part of a request, we will tell you why and how to complain (section 5.11).

6.7 Record of requests. We keep a log of each request, the date it was received, and what was done and when, for as long as CCPA regulations require.

7. Retention

7.1 We keep personal data only as long as we need it for the purpose we collected it.

7.2 Your account and coaching data. Your profile, training programs, workout logs, food logs, measurements, check-in answers, progress photos, meal photos, AI coach conversations, and messages with Jeff are kept for as long as your account is open, or until you delete them or your account.

7.3 Records we must keep. Payment and subscription records are kept for as long as tax and accounting law requires. Stripe keeps its own records under its own policy. Records of the consents you gave, and of testimonial consents, are kept for as long as we need to show that consent was given.

7.4 Operational data. Email sending, open and click logs, generated voice notes, product analytics, server and security logs, and crisis hold records are kept for a limited period and then deleted or made anonymous.

7.5 Backups. Backups are deleted on a rolling schedule. Data you have deleted may persist in a backup until that schedule overwrites it.

7.6 When we no longer need data, we delete it or make it anonymous so it can no longer be linked to you.

8. Security measures

8.1 In transit. All traffic between your device and our platform, and between our platform and each vendor, is encrypted using TLS.

8.2 At rest. Our database and file storage are encrypted at rest by Supabase.

8.3 Row-level security. The database enforces access rules on every row, so each member can read and write only their own data, and each coaching business on the platform can see only its own members.

8.4 Least-privilege access. Each vendor integration uses a key with only the permissions it needs. The AI coach cannot change your program, billing or account.

8.5 Human access. Jeff is the only human with access to member data. No employees, contractors or family members have accounts with access. If that changes, this addendum will be updated and the new person will be trained and bound by a confidentiality agreement.

8.6 Logging. Sign-ins, admin actions, data exports and deletions are logged with the time and the account that did them, and logs are kept for a limited period.

8.7 Member security. You are responsible for keeping your password private and your device secure. Tell us at once if you think someone else has used your account.

8.8 Vendor security. Each processor is chosen with regard to its published security practices and certifications (for example SOC 2 reports), and is bound by a data processing agreement (section 10).

9. Personal data breaches

9.1 What counts. A personal data breach is any event that leads to the accidental or unlawful loss, alteration, disclosure of, or access to personal data. Examples: a lost laptop, a mis-sent export, a vendor incident, or an unauthorised login.

9.2 What we do. When Jeff learns of a possible breach, he will, in this order: (a) contain it (revoke keys, reset passwords, disable the affected feature); (b) record what happened, when it was discovered, what data and how many members are affected, in a breach log kept whether or not anyone is notified; (c) assess the risk to members; (d) notify the parties in the table below within the stated times; (e) tell affected members what happened, what data was involved, what we have done and what they can do; (f) review and fix the cause.

9.3 Who is notified and when.

9.4 Encrypted data. Notification laws generally do not require notice where the data was encrypted and the key was not compromised. We will still tell you if we think you could be harmed.

9.5 Not an admission. Telling you about a breach is not an admission that we did anything wrong.

10. Sub-processors and vendors

10.1 We use the following companies to handle personal data on our behalf.

10.2 Changes to this list. If we add a new vendor that will handle your personal data, or replace an existing one, we will tell you in advance by email or in the App before the change takes effect.

10.3 Our obligations to you about vendors. We rely on each vendor's standard data processing agreement, which requires it to act only on our instructions, keep the data confidential, secure it, help us honour your rights, delete or return the data at the end of the service, and tell us of any breach. We remain responsible to you for what our processors do with your data.

11. International transfers

11.1 Fortified Fuel is in the United States, and our vendors store data in the United States. If you are in the EU, the UK or another country outside the US, your data is transferred to and stored in the US.

11.2 For EU members, we rely on the European Commission's Standard Contractual Clauses (controller-to-processor, module two) with each processor, and each processor's own transfer mechanism for its sub-processors. For UK members, we rely on the same clauses with the UK International Data Transfer Addendum.

11.3 Because Fortified Fuel itself is the US-based controller collecting data directly from you, the transfer from you to us is not a transfer between two organisations. The clauses above govern the onward transfers from us to our vendors.

12. Children

12.1 Fortified Fuel is for adults. The platform asks your age at intake and again at checkout and refuses anyone under 18. We do not knowingly collect personal data from anyone under 18, and we do not collect data from anyone under 13 for the purposes of COPPA. If we learn we hold data about someone under 18, we delete it and close the account.

13. Automated decision-making and profiling

13.1 The AI coach. The AI coach answers questions and offers guidance based on Jeff's methods. It does not change your training program, nutrition plan, billing or account. Program and plan adjustments are made by Jeff after he reviews your weekly check-in.

13.2 AI-drafted replies. When you message Jeff, the platform may draft a reply for him. Jeff reads and approves or edits every draft before it is sent. Nothing is sent to you in Jeff's name without Jeff seeing it.

13.3 Churn risk and engagement signals. The platform may score how likely a member is to lose momentum or cancel, using check-in completion, workout logging and app usage. That score is used only to prompt Jeff to reach out. It does not change your price, your access or your plan, and Jeff decides whether and how to act on it.

13.4 Crisis hold. If the AI coach detects that you may be in crisis, it stops coaching, gives you crisis resources and routes the conversation to Jeff. This is a safety measure, not a decision about your membership.

13.5 No legal or similarly significant automated decisions. No decision that produces legal effects for you, or that similarly significantly affects you, is made solely by automated means. Under GDPR you therefore have no separate right to object to automated decision-making, but you can always ask Jeff to explain any adjustment to your program and to reconsider it.

Contact

Fortified Fuel Fitness & Nutrition Operated by Jeff Beck Daphne, Alabama

Message Jeff in the app, or use the contact details on fortifiedfuel.fitness.