Privacy and Personal Data Policy

1. Data controller

• Company: Skytech Ingeniería S.A.S.
• Tax ID (NIT): 901.472.385-3
• Address: Carrera 101 # 13-111, Oficina 502, Cali, Valle del Cauca, Colombia
• Email: [email protected]
• Phone: +57 318 623 2980
• Website: https://pulsiko.app

2. Scope

This policy applies to the data we process when you visit pulsiko.app, join the waitlist, create an account or use the Pulsiko web app on any device.

3. Data we process

• Account data: name, email, password (stored encrypted, never in readable form) and preferences such as your profile color or weight unit.
• Training profile: goal, level, available days and duration, location (home or gym), equipment you own, focus muscles and limitations you indicate.
• Sensitive health-related data: weight, body measurements, body-fat percentage, progress photos, answers about your physical condition and any discomfort or pain you report after a workout.
• App activity: routines, completed workouts, sets, reps, weights, times and how you felt.
• Technical and security data: IP address, browser type, access date and time, time zone, sign-in attempts and the cookies needed for the app to work.
• Waitlist and questionnaire: email, name (if provided), language, your answers to the website questionnaire (goal, level, place and equipment, days, sex and any areas that bother you; the latter are sensitive and optional), your referral code and the code of whoever invited you. If you answer the questionnaire without leaving your email, your answers are only used to show you the sample plan and are not stored.
• Communications: messages you send to support.

4. Sensitive data and your authorization

Weight, measurements, photos and health information are sensitive data. Providing them is optional: you are not required to share them and you can use Pulsiko without recording photos or measurements. If you choose to provide them, we process them only for the purposes in this policy and with your prior, express and informed authorization, which you give when creating your account and of which we keep proof (date and accepted version).

Your progress photos are private: only you can see them from your account. We don't publish them, show them to other users, or use them to train artificial intelligence systems or for advertising.

5. How we use your data

• To provide the service: build your workouts, suggest weights, estimate muscle recovery, guide you during training and show your progress.
• To manage your account and its security: verify your email, reset your password, sign out sessions, and prevent fraud and abuse.
• To send you necessary service emails: email confirmation, waitlist invitations, security notices and, once available, billing and renewal notices.
• To handle support requests and the exercise of your rights.
• To run the referral program: we count how many people arrive with your link and how many create an account to give you the reward. The person who invited you only sees how many, never their data.
• To improve Pulsiko using aggregated or anonymous statistics that don't identify you.
• To manage your plan, free trial and subscriptions once enabled; your card data is received and processed directly by Paddle, and Pulsiko does not store it.
• To comply with legal obligations and requests from competent authorities.

We don't sell your data, we don't use it for third-party advertising and we don't use your health data for marketing. Automatic workout generation has no legal effects on you.

6. Who we share your data with

Only with providers that help us deliver the service (data processors), acting on our instructions under confidentiality and security obligations:

• Hetzner Online: servers hosting the app, database and photos (United States).
• Cloudflare: content delivery and attack protection (global network).
• Amazon Web Services (Amazon SES): sending app emails (United States).
• Zoho: support mailbox when you write to us.
• Paddle.com: processes payments and subscriptions as authorized reseller (Merchant of Record); it receives your payment and billing data directly (United Kingdom, United States and other countries).

We may also disclose data to authorities when required by law or court order.

7. International transfers

Our servers and some providers are located in the United States and other countries. By accepting this policy you authorize the transmission of your data to those processors, which protect it with security measures and contractual agreements under the terms of Colombian law.

8. Cookies

We only use necessary cookies: your session, your chosen language and your time zone. We don't use advertising cookies. If we add analytics tools in the future, we'll let you know and, where applicable, ask for your consent.

9. Security

We protect your information with encrypted connections (HTTPS), encrypted passwords, photos accessible only to their owner, sessions you can sign out on all devices, sign-in attempt limits and backups. No system is completely infallible; if an incident affects your data, we will report it to Colombia's Superintendence of Industry and Commerce (SIC) and to affected users as required by law.

10. How long we keep your data

While your account is active. If you delete your account, we erase your data and photos from the app immediately and from backups within 30 days. We only keep what the law requires (for example, accounting records of payments, once they exist). Waitlist data is kept until you create your account or ask us to delete it.

11. Your rights

As the data subject you have the right to:

• Know, update and correct your personal data.
• Request proof of the authorization you gave us.
• Be informed about how we have used your data.
• Revoke your authorization and request deletion of your data when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with the SIC after completing the inquiry or claim process with us.

In the app you can download all your data (Mi Plan → Tus datos → Descargar mis datos) and delete your account (Mi Plan → Tus datos → Eliminar mi cuenta) at any time.

12. How to exercise your rights

Email [email protected] with the subject "Personal data" or call +57 318 623 2980. The Pulsiko support team at Skytech Ingeniería S.A.S. is responsible for handling your requests. To protect your information we'll verify your identity, usually through your account email.

• Inquiries: answered within 10 business days; if that's not possible, we'll explain why and answer within 5 additional business days.
• Claims (correction, update, deletion or non-compliance): answered within 15 business days, extendable by up to 8 business days with notice. If a claim is incomplete we'll ask you to complete it within 5 days; after 2 months without a reply, it's considered withdrawn.

13. Minors

Pulsiko is only for people 18 and older. We don't knowingly collect data from minors; if we detect a minor's account, we'll delete it along with its data.

14. Changes to this policy

We'll post any changes here with their date. If a change is significant, we'll notify you by email or in the app and, where the law requires, ask for a new authorization.

15. Effective date

This policy is effective as of October 14, 2026. Databases will be kept as long as the purposes described remain or a legal duty to keep them exists.