Privacy Policy

Effective Date: March 26, 2026 · Last Updated: March 26, 2026

Castles Bay, Sociedade por Quotas ("we", "us", "our") operates software products including mobile applications, web applications, and related digital services ("our Products"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use any of our Products.

By using our Products, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our Products.

1. Who We Are

Castles Bay is a software development company registered in Portugal, specializing in the development, commercialization, and distribution of websites and software applications.

• Registered Address: Rua José Valorado, Fracção D, 10, 2660-131 Santo Antão do Tojal, Loures, Lisboa, Portugal
• Legal Form: Sociedade por Quotas
• Tax Identification Number (NIPC): 519226860
• Contact Email: info@castlesbay.com

2. Information We Collect

The specific data we collect depends on which Product you use. In general, we may collect the following categories of information:

2.1 Account Information

When you create an account in any of our Products, we may collect:

• Email address
• Display name
• Profile photo (optional)
• Authentication credentials (managed securely; we never store passwords in plain text)

2.2 Health and Fitness Data

Some of our Products may collect health and fitness data to provide their core functionality. This may include:

• Workout logs and exercise data
• Body measurements
• Nutrition and dietary information
• Fitness goals and preferences
• Activity and progress history

This data is only collected when strictly necessary for the Product's functionality and with your explicit consent.

2.3 Apple HealthKit Data

Some of our Products may integrate with Apple Health (HealthKit) with your explicit permission. In such cases:

• We only read and write the specific data types you authorize.
• We do not sell, share with advertisers, or use HealthKit data for marketing or advertising purposes.
• HealthKit data is only used to provide and improve the Product's core features.
• HealthKit data is never shared with third parties for advertising or data brokerage purposes.

2.4 AI-Processed Data

Some of our Products may include AI-powered features. When you use these features, we may process contextual data (such as your preferences or messages) through third-party AI providers to generate responses. We do not use your personal data to train AI models.

2.5 Usage Data

We may automatically collect:

• Device type and operating system version
• Product version
• General usage patterns (features used, session duration)
• Crash reports and performance data

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve our Products
• Generate personalized recommendations and content
• Sync data with device-level integrations (such as Apple Health), where applicable and with your permission
• Manage your account and provide customer support
• Send important service-related notifications
• Ensure security and prevent fraud
• Comply with legal obligations

We do not use your information for:

• Selling to third parties
• Targeted advertising
• Building marketing profiles
• Training AI models with your personal data

4. Third-Party Services

Our Products may use third-party services for infrastructure, functionality, or content generation. These may include cloud hosting providers, authentication services, AI API providers, and analytics tools.

Each of our Products specifies, where applicable, which third-party services are used and links to their respective privacy policies. We only work with providers that offer adequate data protection guarantees.

5. Data Storage and Security

• Your data is stored on secure servers with encryption at rest and in transit.
• Authentication is handled using industry-standard protocols.
• We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
• No method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• We retain your personal data for as long as your account is active or as needed to provide the Product's services.
• If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain it.

7. Your Rights

Under the General Data Protection Regulation (GDPR) and Portuguese data protection law (Lei n.º 58/2019), you have the right to:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Restriction — Request that we restrict the processing of your data.
• Portability — Request a copy of your data in a structured, machine-readable format.
• Objection — Object to processing of your data in certain circumstances.
• Withdraw Consent — Withdraw consent for data processing at any time, without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, contact us at info@castlesbay.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) at https://www.cnpd.pt.

8. Legal Basis for Processing

We process your personal data based on:

• Consent — For health data, device-level integrations, and AI-powered features.
• Contractual Necessity — To provide our Products' services as part of the applicable terms of use.
• Legitimate Interest — For security, fraud prevention, and service improvement.
• Legal Obligation — Where required by applicable law.

9. International Data Transfers

Your data may be processed outside the European Economic Area (EEA) by third-party service providers we use. Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms.

10. Children's Privacy

Our Products are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@castlesbay.com.

11. Product-Specific Privacy Information

Individual Products may collect or process additional categories of data specific to their functionality. Where applicable, supplementary privacy information will be provided within the Product itself or in a product-specific privacy addendum, which forms part of this policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy and updating the "Last Updated" date above. Your continued use of our Products after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy:

• Email: info@castlesbay.com
• Address: Rua José Valorado, Fracção D, 10, 2660-131 Santo Antão do Tojal, Loures, Lisboa, Portugal