Privacy Notice

Executive summary

1. Identity and address of the data controller

The data controller for your personal data is XYPHOS.FITNESS, a platform operated by an individual engaged in business activity under Mexican law, trading as Xyphos (hereinafter “Xyphos”).

Address: Cumbres Madeira 50 B, Boca del Río, Veracruz, México, CP 94293.

Privacy contact: hola@xyphos.fitness.

For all matters relating to this Notice, ARCO rights or data handling, use the contact email above with the subject line Privacy — [type of request].

2. Personal data we collect

To provide the service, Xyphos collects the following personal data, either directly when you provide it or automatically as you use the app:

2.1 Identification and account data

• Full name
• Email address
• Password (stored hashed with a one-way function)
• Google identifier if you choose “Sign in with Google”
• Date of birth (to verify you are of legal age)
• Sex / declared gender (for metabolic calculations)

2.2 Anthropometric and biometric data

• Weight, height, age
• Body circumferences (waist, hips, chest, shoulders, thighs, arms)
• Body-fat percentage, lean mass and other body-composition metrics
• InBody files (PDF or image) you upload voluntarily
• Progress photographs you upload voluntarily

2.3 Declared health data

When entered in the questionnaire or updated in your profile:

• Present or past injuries affecting training
• Declared chronic medical conditions
• Pregnancy or breastfeeding status (if applicable)
• Medications that affect performance, recovery or metabolism
• Food allergies and intolerances
• Physical or medical restrictions on exercise
• Consumption habits (alcohol, tobacco) declared with frequency

2.4 Usage and training data

• Adopted or created routines, workout logs (sets, reps, weight)
• Training streaks, experience points (XP), badges
• Notes and comments you write within the app
• Generated nutrition plan and meals logged

2.5 Payment data

• Subscription status (Free / active Premium / cancelled)
• Transaction references processed by Apple App Store

We do not store your full card details. Apple App Store processes payment information directly under its own terms and data protection policies; Xyphos only receives the transaction identifier and subscription status to activate your Premium access.

2.6 Technical data collected automatically

• IP address (partial or full depending on context)
• Device type, operating system and browser
• App usage events (pages visited, actions taken)
• Technical security and performance logs

3. Sensitive personal data and express consent

When you create your account and accept this Privacy Notice you give your express consent for Xyphos to process the sensitive data listed in sections 2.2 and 2.3 solely to generate and operate your personalised training and nutrition plan.

You have the right to withhold these data. In that case we will be unable to generate a safe personalised plan and you may use Xyphos only with the generic features of the Free plan, without algorithmic routine or nutrition generation.

Your express consent for the processing of sensitive personal data is given by means of a digital signature captured at registration, in accordance with Article 8 of the LFPDPPP. This signature is stored as evidence linked to your account and is accessible at any time from /client/settings/privacidad.

4. Purposes of processing

4.1 Primary purposes (necessary for the service)

Without these purposes we cannot provide the service:

• Create, authenticate and manage your account
• Generate, display and adjust your personalised training routines
• Generate, display and adjust your personalised nutrition plans
• Keep a history of your workouts, measurements and progress
• Operate the gamification system (XP, streaks, badges, friends leaderboard and global Top-100 ranking visible to all Xyphos users). The global ranking displays only your name, profile picture, level, rank and XP/workouts for the selected period; your routines, measurements, nutrition plans, health data and payment method are never exposed in these rankings
• Process your Premium subscription and recurring billing via Apple App Store
• Send transactional emails (account verification, renewal reminders, receipts, critical alerts)
• Provide technical support when you request it
• Maintain platform security and prevent fraud
• Comply with legal obligations or requirements of competent authorities

4.2 Secondary purposes (optional)

These purposes are not essential to the service. You may object under section 5 without affecting your access to Xyphos:

• Anonymous and aggregated statistical analysis to improve the product, evaluate new features and detect usage patterns
• Marketing communications by email (announcements, news, promotions) about Xyphos
• Use of your non-sensitive contact data (name and email) for marketing and advertising purposes, including the possibility of sharing or transferring them to third parties for advertising purposes. This purpose never includes your sensitive data (health, measurements, plan), which are never shared or commercialised for advertising purposes. You may object at any time under section 5, without affecting your access to the service.

5. How to limit use of your data

To object to the secondary purposes listed in section 4.2, send an email to hola@xyphos.fitness with the subject Privacy — Objection to secondary purposes, stating which purpose(s) you are objecting to. Your objection will not affect your access to the service or the processing of your data for primary purposes.

In the future we will enable this management directly from your account at /client/settings/privacidad. In the meantime we will handle your request by email within the periods set out in section 8.

6. Data transfers and providers

To provide the service, Xyphos may transfer your personal data within and outside Mexico to third parties with whom it maintains a legal relationship for the purposes set out in this Privacy Notice, as well as in the cases specifically provided for in the LFPDPPP and other applicable regulations. Each provider operates under a contract obliging them to confidentiality and to process your data exclusively for the purposes we specify:

This list is illustrative and may be updated without prior notice to reflect operational changes to the service.

These transfers to the technology processors listed above are necessary to provide the service and do not require any additional consent beyond that already given by accepting this Notice, pursuant to Article 37(V) of the LFPDPPP. These processors do not use your data for their own purposes. The possible use of non-sensitive contact data for marketing and their transfer to third parties for advertising purposes is a separate secondary purpose governed by section 4.2, to which you may object under section 5; that purpose never includes your sensitive data.

Should data subjects not wish Xyphos to transfer their personal data, they have five calendar days to express their objection by contacting Xyphos through the privacy channel indicated in section 14.

Retention and deletion of your data

We retain your personal data only for as long as the relationship between you and Xyphos lasts (i.e., while your account exists). The relationship ends when you terminate it, either by deleting your account from the app or by requesting deletion by email (Cancellation right, section 8). An inactive or non-Premium account does not terminate the relationship by itself: your data are retained so that you can resume your progress when you return.

While your account is active, your non-sensitive contact data (name and email) may be processed for the secondary purposes in section 4.2 (marketing), unless you exercise your right of Objection.

When the relationship ends (upon account deletion or exercise of the Cancellation right) we permanently delete all your data from the platform: sensitive data (health, measurements, photos), profile, routines, nutrition plan, history, your IP address and device data. The only data retained is the evidence of your consent (what you accepted, when and with what signature) as a legal-compliance record, containing only non-sensitive data (name, email, dates, versions and signature), for up to 5 calendar years, to meet legal, tax and fraud-prevention obligations under Article 11 of the LFPDPPP and other applicable regulations. We do not retain your contact data for marketing after your account is deleted.

7. Automated decisions and artificial intelligence

7.1 Plan generation (OpenAI)

To generate and adjust your personalised training routines and nutrition plans we use large language models (LLMs) operated by OpenAI in the United States. These models receive your anthropometric data, declared health data and preferences, together with internal instructions, and produce a draft plan.

Meaningful human review. The draft generated by the model is not delivered directly to you. It first goes through a human validation process in which a Xyphos administrator reviews the plan and decides whether to approve, adjust or regenerate it. Only human-approved plans reach your account.

No training of external models with your data. Under the commercial terms of OpenAI applicable to its API, the data we send to generate your plans are not used to train or improve their models.

Your rights regarding this processing:

• Know the logic involved and the consequences of the processing
• Request additional human review if you believe the plan contains errors
• Object to this processing — in that case we will be unable to generate your personalised plan

7.2 AI conversational assistant — chat (Kimi / Moonshot AI)

To respond to you, the assistant accesses your profile, body measurements, declared health data and active plan, and includes that information in the conversation transmitted to the provider’s servers. This constitutes an international transfer of sensitive personal data outside Mexico, within the meaning of Articles 8 and 37 of the LFPDPPP.

For this reason, use of the chat requires a separate, express consent given in writing through your signature, distinct from the consent given at registration. It is voluntary and revocable: you may withdraw it at any time by writing to hola@xyphos.fitness. If you choose not to grant it (or revoke it), only the AI assistant chat is disabled; the rest of Xyphos continues to work normally.

To exercise your rights regarding any of these AI processing activities, write to hola@xyphos.fitness with the subject Privacy — AI / Automated decisions.

8. ARCO rights (Access, Rectification, Cancellation, Objection)

Under the LFPDPPP you have the right to:

• Access — receive a copy of the personal data we hold about you
• Rectification — correct data that are inaccurate or incomplete
• Cancellation — request deletion of your data when you consider it unnecessary or the processing does not comply with the law
• Objection — object to the processing of your data for specific purposes

How to exercise them

The official channel to exercise your ARCO rights is hola@xyphos.fitness, with the subject Privacy — ARCO Request and including:

• Your full name and email registered with Xyphos
• A valid official ID (INE, passport) — to verify identity
• The right you wish to exercise (access, rectification, cancellation or objection)
• A clear and precise description of your request
• If exercising rectification: documentation supporting the correction

In practice, each right is handled as follows:

• Access. You write to us and we email you a copy of the personal data we hold about you.
• Rectification. You can correct editable profile data (name, sex/gender, height, age, experience, goal, time zone) directly in the app. To correct questionnaire responses or other data, write to us at the same email.
• Cancellation. You can delete your account and all your data directly from the app (Settings → Delete account) or request it by email.
• Objection. To object to the use of your contact data for marketing, advertising or transfer to third parties for advertising purposes (section 4.2), write to us stating which purpose you object to.

Timescales

• Response on admissibility: up to 20 business days from receipt of your complete request
• Execution of an admitted request: up to an additional 15 business days
• The process is free; we may only charge justified shipping or reproduction costs

If after 20 business days you have not received a response, or it is unsatisfactory, you may file a review appeal before the Secretaría Anticorrupción y Buen Gobierno (SABG), the authority competent in personal-data protection matters in Mexico.

9. Withdrawal of consent

You may withdraw any consent you have granted for the processing of your personal data at any time. Withdrawal is made through the same procedure as section 8, expressly stating the scope of the withdrawal.

Note that withdrawing consent for the sensitive data described in section 3 means Xyphos will no longer be able to provide you with the personalised service, since routine and nutrition plan generation depends on those data. In that case your account may be downgraded to the Free plan or cancelled, at your choice.

AI assistant (chat). The specific consent for transferring your data to the AI chat provider (Kimi / Moonshot, section 7.2) is also revocable in this way. Revoking it only disables the AI assistant chat; the rest of Xyphos continues to work normally.

10. Cookies and similar technologies

11. Security breach notifications

Under Article 19 of the LFPDPPP, if a security breach occurs that significantly affects the patrimonial or moral rights of data subjects, Xyphos will notify the competent authority and the affected data subjects immediately, together with the information necessary for you to take steps to protect your rights.

We maintain reasonable technical, administrative and physical security measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest in our databases, role-based access controls, activity logs, periodic backups and recurring security reviews.

12. Minors under 18

Xyphos is intended exclusively for persons aged 18 and over. We do not intentionally collect personal data from minors. Registration requires an express declaration of legal age and validation of date of birth. If we detect that an account belongs to a person under 18, we will proceed to immediate suspension.

13. Changes to this Privacy Notice

This Notice may be updated when required by changes in applicable legislation, our operating practices or our service offering. When material changes occur:

• We will publish the new version at this same URL
• We will update the “Last updated” date in the header
• We will notify you by email and/or through a visible notice in the app at least 30 days before the material changes take effect
• When changes affect sensitive data or primary purposes, we will require your express re-acceptance before continuing the processing

14. Contact

For any query, complaint or exercise of rights relating to this Privacy Notice, contact us at:

• Email: hola@xyphos.fitness
• Postal address: Cumbres Madeira 50 B, Boca del Río, Veracruz, México, CP 94293

If you believe your right to personal-data protection has been violated by any act or omission of Xyphos, you may file a complaint or report before the Secretaría Anticorrupción y Buen Gobierno (SABG), the federal authority competent in personal-data protection matters in Mexico.

Last updated: May 30, 2026.