Privacy Policy

Casa Del Sur LLC, a Florida limited liability company ("Company", "we", "us", or "our"), attaches the highest priority to the privacy, security, and personal data protection of our users ("User", "you", or "your"). This Privacy Policy governs the collection, processing, storage, and transfer of personal and biometric information when you access or use the ATHETIC mobile application ("App") and the official website located at athetic.app ("Website") (collectively, the "Services").

1. Data Controller Information

Our official corporate registration details are as follows:

• Legal Entity Name: Casa Del Sur LLC
• Registered Office Address: 3440 Rudolf Rd, Lake Worth, FL 33461, USA
• Corporate Email: info@athetic.app
• Official Website: https://athetic.app

2. Categories of Personal Data Collected

When using our application and website, the following categories of data may be processed:

• Account & Registration Data: Full name, email address, avatar photo, and encrypted authentication tokens (including Sign in with Apple relay emails and Google OAuth).
• Physiological & Biometric Data: Heart Rate Variability (HRV), resting heart rate, body measurements, training load, fatigue indices, and biometric readiness scores.
• Device & Telemetry Data: IP address, operating system version, device model, unique device identifiers (UUID/IDFA), session durations, crash stack traces, and app interaction logs.
• Location Data: Non-continuous GPS location data gathered with your explicit consent during outdoor running and walking route tracking.

4. Lawful Grounds for Data Processing (GDPR Art. 6 & Art. 9)

Under European General Data Protection Regulation (GDPR) and international privacy frameworks, Casa Del Sur LLC processes your personal and biometric data strictly on the following lawful bases:

• Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a)): We process sensitive biometric and physiological telemetry (such as HRV, heart rate, and training strain via Apple HealthKit) exclusively upon your affirmative, explicit in-app consent. You may withdraw this consent at any time via device settings.
• Performance of a Contract (Art. 6(1)(b)): Processing account identifiers, workout completion histories, and subscription status is necessary to fulfill our service agreement, calculate dynamic training benchmarks, and provide customer support.
• Legitimate Interests (Art. 6(1)(f)): We process technical telemetry, IP addresses, and crash diagnostics to ensure server stability, prevent cheating/leaderboard manipulation, and maintain cybersecurity defenses.
• Compliance with Legal Obligations (Art. 6(1)(c)): We retain transaction metadata and dispute documentation to satisfy corporate accounting, tax compliance, and statutory regulatory requirements.

5. Public Profiles & Social Feed Controls

ATHETIC includes social community features and division leaderboards. Upon completing a workout, your workout summary and username may be visible in the social feed. Users can toggle off social timeline visibility at any time by navigating to Profile > Settings > Show in Social Feed.

6. Push Notifications

Our application sends push notifications to deliver daily biometric readiness scores, workout reminders, and VIP coach messages. You can manage or disable notification permissions at any time within your device's system settings.

7. Cookies, Local Storage & Tracking Technologies

Local Storage Technologies: The ATHETIC Website and App utilize client-side localStorage and secure session tokens solely for functional purposes, including preserving your language preference (e.g., English, Turkish, Spanish, Russian), maintaining active authentication states, and caching offline workout telemetry.

No Third-Party Advertising Trackers: Casa Del Sur LLC does not embed third-party advertising tracking pixels or cross-site tracking cookies designed to profile you across the web. Any analytics utilized are strictly aggregated and performance-oriented.

8. Data Security, Cloud Infrastructure & 72-Hour Breach SLA

Casa Del Sur LLC uses Supabase protected cloud database infrastructure, Row Level Security (RLS) access policies, and industry-standard TLS/SSL (AES-256) encryption protocols to protect your personal data against unauthorized access, loss, or misuse. All payment transactions are processed directly by Apple App Store (In-App Purchase) or Google Play Store billing; credit card details are never stored on our servers.

Security Incident & Breach Notification SLA: In the unlikely event of a security breach involving personal or biometric data that poses a high risk to user rights, Casa Del Sur LLC maintains an emergency incident response protocol and commits to notifying the competent supervisory authorities and affected users without undue delay, within seventy-two (72) hours of becoming aware of the breach, in full compliance with GDPR Articles 33 & 34 and Florida Information Protection Act (FIPA) requirements.

9. Data Retention Periods & Destruction Schedule

Personal and biometric data is stored only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Active Account Data: Biometric telemetry, profile details, and workout logs are retained for the duration of your active ATHETIC account.
• Immediate Purge on Account Deletion: When you initiate account deletion in-app or via email, all biometric records, HRV logs, profile images, and personal identifiers are immediately and permanently erased from our production databases.
• Statutory Retention: Basic transaction logs and legal correspondence may be retained for up to five (5) years solely to comply with applicable tax, accounting, and legal defense requirements, after which they are securely destroyed or irreversibly anonymized.

10. User Rights & Account Deletion (Apple Guideline 5.1.1(v))

Users have the right to access, rectify, request portability of, or permanently delete their personal data at any time:

• In-App Account Deletion: In compliance with Apple App Store Review Guidelines (Guideline 5.1.1(v)), you can initiate complete account and data deletion inside the ATHETIC app by navigating to Profile > Settings > Delete Account. This immediately and permanently purges your account and all associated biometric records.
• Email Deletion Request: If you no longer have access to the app or device, you can send a formal deletion request to info@athetic.app. Your request will be fulfilled and confirmed within 30 days.

11. Children's Privacy (COPPA & Apple Guideline 5.1.4)

ATHETIC services are not directed to individuals under 13 years of age (or 16 years of age in the European Union). Casa Del Sur LLC does not knowingly collect personal data from children. If we discover that a child under 13 has provided personal data without parental consent, we immediately purge such data from our databases.

12. International Privacy Rights (GDPR, US CCPA/CPRA, DNT & GPC Signals)

European Union & UK Privacy Rights (GDPR / UK GDPR): Users residing in the EEA or UK enjoy statutory rights to access, rectify, erase, restrict processing of, object to processing of, and export their personal data. If you believe your data has been unlawfully processed, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

United States State Privacy Rights (California CCPA/CPRA, Virginia VCDPA, Colorado CPA): Residents of California and other US states with comprehensive privacy laws have specific rights regarding their personal and sensitive biometric information:

• Right to Know & Access: You may request the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete & Correct: You have the right to request deletion or correction of inaccurate personal data.
• No Sale or Sharing of Personal Data: Casa Del Sur LLC does not sell or share personal or biometric data with third-party brokers.
• Non-Discrimination: We will never discriminate against you, deny services, or alter subscription rates for exercising any of your privacy rights.
• 45-Day Response Timeline: Formal privacy requests submitted to info@athetic.app will be acknowledged and fulfilled within forty-five (45) calendar days. You may also designate an authorized agent to submit requests on your behalf.

Global Privacy Control (GPC) & Do Not Track (DNT) Signals: ATHETIC fully respects browser-level Global Privacy Control (Sec-GPC: 1) and Do Not Track (DNT) signals. Because ATHETIC does not sell user data or engage in cross-context behavioral advertising, these privacy preferences are automatically upheld across all our digital properties.

Cross-Border Data Transfers: Casa Del Sur LLC operates servers and databases in the United States. When data is transferred internationally from the European Economic Area or UK, we employ Standard Contractual Clauses (SCCs) and strong encryption protocols to ensure adequate levels of data protection.

13. Corporate Business Transfers, Policy Updates & Contact

Business Asset Transfers: In the event of a merger, acquisition, corporate reorganization, or sale of company assets, user personal data may be transferred to the successor entity, provided that the acquiring party commits to upholding privacy protections substantially equivalent to those set forth in this Privacy Policy.

Policy Updates & Inquiries: Casa Del Sur LLC reserves the right to update this Privacy Policy to reflect technical enhancements or legal revisions. For any questions, data subject requests, or privacy concerns, please contact our privacy compliance team at: