BurstReps Privacy Policy
BurstReps (the “Company,” “we,” or “us”) respects your privacy. This Policy explains what personal information we process through the BurstReps app, website, and connected services (the “Service”), why we process it, whom we engage to process it, when it may be processed outside Korea, and how you can exercise your rights. The Korean Privacy Policy is the source text; if the versions differ, the Korean version prevails to the extent permitted by applicable law. Nothing in this provision limits rights that cannot be waived under the law where you live.
1. Purposes of processing
We process personal information as needed to:
- Create and manage accounts, authenticate users, prevent misuse, secure the Service, and respond to inquiries.
- Provide meal, nutrition, workout, body-measurement, goal, schedule, and progress-tracking features.
- Synchronize, display, and analyze Apple Health or Android Health Connect data that you authorize.
- Operate AI Coach: respond to messages and attachments, maintain conversation context, access records made available for the feature, and create, add, change, delete, or mark as completed records or plans concerning workouts, meals, the body, goals, and schedules.
- Review AI answers and record or plan actions; find and reproduce errors, malfunctions, and safety issues; improve AI features, evaluation methods, prompts, algorithms, and service flows; and detect abuse and security threats.
- Provide paid features, verify subscription status and receipts, handle payments, refunds, and disputes, and meet legal obligations.
- Operate and improve the Service, including reliability, notifications, usage and usability analysis, security, and new features.
- Provide support, send notices, resolve complaints, and respond to privacy requests.
AI Coach may process your messages and attachments, relevant recent conversation, goals and schedule, the meal, workout, and body records you make available, and the actions it takes and their results. We use sensitive information only with the applicable legal basis and within the scope you authorize.
We may use AI-feature information, including conversations, attachments, and related records, to provide coaching and to review quality and improve prompts and algorithms as described in item 5. We process sensitive information only with the applicable legal basis and within the purposes and scope you consent to.
Restrictions on training by outside AI providers
We use paid-API terms and training opt-out controls to exclude member data from outside AI services’ general model training. Separate processing may occur for safety, abuse investigations, or legal obligations. The Anthropic service used for internal quality improvement may use material flagged for safety review to improve safety-related models. Section 5 describes applicable retention and exceptions. This does not mean that we provide member data for advertising or an outside provider’s general model training.
We may use anonymous, aggregated information that cannot reasonably be re-identified, including when combined with other information, for analysis, research, business descriptions, or public statistics. We seek separate optional consent, describing the purpose, channel, and duration, before using an identifiable person’s photo, chat quotation, progress story, or records in marketing.
2. Information we process and how we obtain it
We process information within the scope needed for the Service. You can use features that do not require an optional item without providing that item. The legal bases listed below are not intended to exclude additional or different requirements that apply where you live.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account and sign-in | Email, sign-in provider, member identifier, registration and sign-in times | Identification, account management, security, support | Contract |
| Profile | Nickname, profile image, language, country/time zone, gender, birth year or date of birth, height, weight, unit settings | Profile display, localization, personalization | Contract or consent |
| Goals and environment | Training experience, body and fitness goals, frequency and equipment, preferred exercises, programs, 1RM and training percentages, minimum weight increments, diet settings, notes, user tags | Recording, planning, analysis, recommendations | Contract or consent |
| Meals | Foods, amounts, nutrients, meal times, food and nutrition-label photos, searches, recent and saved meals | Logging, image recognition, nutrition analysis, reuse | Contract or consent |
| Workouts | Exercises, sets, loads, reps, duration, distance, rest, RPE, programs, scheduled and completed sessions | Logging, progress, planning, adjustment | Contract or consent |
| Body and health | Weight, body-fat percentage, measurements, heart rate, sleep, activity, recovery and energy, injuries or pain that you enter or connect | Trends, health and fitness functions, requested analysis and personalization | Contract and, where required, separate consent |
| AI feature use | Messages, attachments, answers, feedback, records accessed by AI, actions performed by AI and their results, conversation IDs and times, technical and error information | AI Coach, context, record and plan actions, quality, error and safety review, and Service improvements | Contract and legitimate interests, with consent where required |
| Subscription and payment | Product, status and term, transaction ID, platform, receipt-verification information | Paid features, subscriptions, refunds and disputes | Contract and legal obligation |
| Device and use | App version, OS, device model and language, IP address, push token, advertising identifier if permitted, access, use, error, performance and security logs | Operations, notifications, reliability, security and usability | Contract and legitimate interests, with consent where required |
| Support and rights requests | Name or nickname, email, inquiry and attachments, handling history | Support, complaints, disputes and rights requests | Contract and legal obligation |
We obtain information when you enter or upload it in the app, chat, or support channels; from sign-in or payment platforms as you authorize; from Apple Health or Health Connect for data types covered by both OS permission and our separate sensitive-health-data consent; automatically during Service use; and when AI Coach accesses, generates, or changes related records through the Service.
Health information may be sensitive personal information. We process it only when authorized by law or with consent that is separate from ordinary personal-information processing where required. At your first Apple Health or Health Connect connection, we present a separate Health Data Consent. OS access permission and consent to BurstReps’s processing are different. You may change OS permissions in device settings and withdraw BurstReps consent through the app or company@burstreps.com. We do not sell connected health data or provide it for advertising, data brokerage, or a third party’s independent marketing. Only designated privacy personnel may inspect identifiable source records from connected health data where necessary for error or safety review or improvement of those health and fitness features; we restrict and log such access. We do not send original values from connected health records to external development tools. The separate consent explains the data types and how to decline or withdraw.
The Service is intended for people aged 14 or older. If we learn that an account belongs to a child under 14, we restrict it and delete personal information without undue delay unless retention is legally required.
3. Disclosures to third parties
As a rule, we do not disclose personal information to third parties for their independent purposes. Exceptions are where you separately agree after being informed of the recipient, purpose, categories, and retention period; where a specific law or legal obligation permits or requires disclosure; or where applicable law permits disclosure to protect urgent interests in life, bodily safety, or property. Processing by a service provider on our behalf is described in Sections 4 and 5 and does not authorize that provider’s independent use.
4. Service providers
We engage the following providers to process information on our behalf and use contracts and oversight to limit their processing to the assigned work.
| Provider | Assigned work |
|---|---|
| Google LLC | Authentication, database and file storage, server functions, push notifications, analytics, crash/error analysis, and Google AI features |
| Supabase Pte. Ltd. | Storage and processing of Service data and operational support |
| OpenRouter, Inc. | Support for providing and operating AI services |
| OpenAI OpCo, LLC | Providing and operating AI services and improving their quality |
| Anthropic, PBC | Improving the quality of AI services |
| Functional Software, Inc. (Sentry) | Error and performance monitoring and incident analysis |
| Mixpanel, Inc. | Service-use analytics |
| RevenueCat, Inc. | Subscription status, receipt verification, and subscription administration |
We update this list if a provider or its assigned work changes.
5. International processing and transfers
To provide cloud, analytics, and AI features, information may be transmitted over a network to processors outside Korea. For transfers necessary to perform the Service contract through processing or storage abroad, we rely on Article 28-8(1)(3) of the Korean Personal Information Protection Act. Additional requirements may apply where you live.
Transfers take place over encrypted networks when the relevant feature is used or quality-improvement work is performed. Each provider receives only information needed for its work, not every member record. The primary location of our Google database and default file storage is Osaka, Japan. Our Supabase production database is primarily stored in Seoul, Republic of Korea.
| Recipient/contact | Destination | Information | Purpose | Retention |
|---|---|---|---|---|
| Google LLC (contact) | Japan (database and default file storage), United States (authentication); countries where Google or its agents maintain facilities (transient storage/caching of AI data) | Account IDs, Service records/files, device, use and error data, AI inputs, images, related records and outputs | Authentication, storage, processing, notifications, analytics, error handling and AI | Stored Service data: while the Service is used or until our deletion request. Authentication data: up to 180 days after a deletion request for removal from systems. Paid AI abuse-monitoring inputs, context and outputs: 55 days. |
| Supabase Pte. Ltd. (contact) | United States, Singapore (operations/support; primary databases remain in Korea) | Member IDs, Service records, attachments and related technical data | Data storage, processing and operational support | While the Service is used or until our deletion request. Backups that cannot be individually erased follow Section 7. |
| OpenRouter, Inc. (contact) | United States | Messages, attachments, relevant records, responses and technical data needed for AI processing | Providing and operating AI services | For the time needed to process a request. Usage/security records: as needed for those purposes. Data covered by our deletion request is generally deleted within 30 business days of the request. |
| OpenAI OpCo, LLC (contact) | United States | Messages, attachments, relevant records, responses and technical data needed for AI processing | Providing, operating and improving AI services | API abuse-monitoring records: up to 30 days by default. Stored response data: at least 30 days by default. Quality-improvement conversations: until deleted, with removal generally within 30 days after deletion. |
| Anthropic, PBC (contact) | United States | Messages, attachments, relevant records, responses and technical data needed for quality review | Improving AI service quality | Generally removed within 30 days after conversation deletion. Inputs/outputs flagged by safety systems as policy violations may be retained for up to two years; related safety classification scores for up to seven years. |
| Functional Software, Inc. (Sentry) (contact) | Germany | Member/device IDs, error/performance logs and relevant screens/request data | Error/performance monitoring and troubleshooting | Event data: 30 days under our current plan. |
| Mixpanel, Inc. (contact) | United States | Member/device IDs, app-use events and properties | Service-use analysis and improvement | During the service agreement, subject to deletion on our request. Within 90 days after the agreement ends. |
| RevenueCat, Inc. (contact) | United States | Member IDs, product, subscription, transaction and receipt-verification data | Subscription verification and management | As needed for subscription administration. Our deletion requests are handled within a reasonable time; information needed for legal obligations or disputes may be kept until that need ends. |
The United States entries for OpenAI and Anthropic reflect their published information about U.S. processing and storage; they do not mean processing is limited to the United States. Information may also be processed in other countries as described in the OpenAI Privacy Policy and Anthropic Privacy Policy. Google’s transient storage and caching of AI data follow its paid AI service terms.
Each period applies only to the stated data. Exceptions may apply where a provider must keep information for legal obligations, abuse or security investigations, or disputes. They do not create a blanket extension for all member information held by BurstReps. We receive and manage deletion requests and check their outcome under Sections 7 and 9.
You may avoid some optional international processing by not using AI features, connected health data, or optional analytics. Refusing essential authentication, data storage, or error-handling processing may make all or part of the Service unavailable. Contact company@burstreps.com with questions or rights requests about a transfer.
6. Retention
We retain personal information needed to provide the Service until you close your account. When you delete a particular record or conversation or withdraw consent, we delete information that is no longer needed without undue delay. Account closure or a deletion request does not erase every provider backup and security record at the same instant. The data-specific periods and exceptions in Section 5 and the procedures in Section 7 also apply. We separate information that must be kept by law and delete it when the required period ends.
| Record | Period | Korean-law basis |
|---|---|---|
| Contracts and cancellation | 5 years | Act on the Consumer Protection in Electronic Commerce |
| Payments and supply of goods/services | 5 years | Act on the Consumer Protection in Electronic Commerce |
| Consumer complaints and disputes | 3 years | Act on the Consumer Protection in Electronic Commerce |
| Advertising records | 6 months | Act on the Consumer Protection in Electronic Commerce |
| Tax transaction evidence | Period required by applicable law | Korean tax laws |
We do not impose an across-the-board long retention period for misuse records that are not legally required. Any separate retention for legal claims or disputes is limited to what is necessary. Applicable requirements outside Korea may differ.
7. Deletion
- We delete information without undue delay when its retention period ends or its purpose is fulfilled. Request account closure, record deletion, or consent withdrawal using available app controls or company@burstreps.com.
- We delete operational records, attachments and account-linked logs under our control and use providers’ deletion controls or request procedures for information they hold. We check the scope and outcome and explain any limits on deletion.
- Legally retained information is segregated by storage or access controls and is not used for another purpose.
- Electronic files are deleted so they cannot be recovered or reproduced; paper copies are shredded or incinerated.
- Backup copies that cannot be individually erased are excluded from ordinary Service use and removed through backup replacement or erasure. Provider security and legal exceptions are described in Section 5. This is neither a promise that every copy disappears instantly nor a blanket grace period for deletion.
8. Security
We use reasonable administrative and technical measures to protect information against loss, theft, unauthorized access or disclosure, alteration, and destruction. These include limiting and managing staff access, protecting information and credentials, encrypting transmissions, reviewing access/error/security logs, and overseeing processors.
9. Your rights
Subject to applicable law, you may request access, data portability, correction, deletion, suspension or restriction of processing, withdrawal of consent, and account closure. You can edit or delete certain profile, record, chat, and connection information in the app. For other requests, email company@burstreps.com. We may verify your identity or an agent’s authority; we respond under applicable procedures and explain any legal limits on deletion or restriction.
Withdrawing consent for health data or related AI processing may make connected-health, personalized, or AI features unavailable, while other features remain available where possible. You can review AI conversations and AI-created or changed records, use available tools to correct or delete them, or ask us for help. AI Coach can access and create, add, change, delete, or complete records or plans about workouts, meals, the body, goals, and schedules. Results may be wrong. You may review them, correct or delete them, and challenge a result with us. We manage the Service so AI does not, without human involvement, make final decisions that have legal or similarly significant effects. If that changes, we will provide the notices and rights required by applicable law.
10. Cookies, SDKs, and similar technologies
We may use cookies, SDKs, and similar technology for app and website operation, security, error analysis, and usability improvement. Device information, IP address, use records, and error/performance data may be generated or collected. We access an advertising identifier only where the OS permits and provide consent or refusal controls for nonessential analytics or tracking as required by law and platform policy. Browser or device privacy settings may restrict cookies or tracking; core logging remains available, although some personalization or analytics features may be limited.
11. Privacy contact and remedies
Send privacy questions, complaints, or rights requests to our privacy officer:
- Privacy officer and representative: Hyojun Choi
- Company: BurstReps (버스트렙스)
- Business registration number: 596-10-02401
- Email: company@burstreps.com
For Korean privacy complaints, you may also contact the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972), the Personal Information Infringement Report Center (privacy.kisa.or.kr, +82-118), the Supreme Prosecutors’ Office (spo.go.kr, +82-1301), or the Korean National Police Agency (ecrm.police.go.kr, +82-182). These references do not replace remedies available where you live.
12. Changes to this Policy
We announce changes and their effective date in the app or on the website before they take effect. We give clear, sufficiently advance notice of material changes affecting your rights and seek additional consent where required. The Korean version is the master text to the extent permitted by applicable law; mandatory local rights remain unaffected.
Notice date: October 2, 2026
Effective date: October 9, 2026