Privacy Policy

Last updated: 12 October 2026

This policy explains what data Sassu collects, why, and what your rights are. The Dutch version is the leading text; this is a translation.

1. Who are we?

The controller is Jayyletsgetfit, Wenckebachweg 135-1H, 1096 AM Amsterdam, the Netherlands, Chamber of Commerce 34352011, VAT NL002174513B79, trading as Sassu. The app runs at app.sassu.fit. For privacy inquiries: info@sassu.fit.

2. What data do we collect?

Account data: name and email address at registration.
Training data: sets, reps, weights, exercises, and diary notes you enter yourself.
Nutrition data: meals, calories, and macronutrients you log manually.
Diary data: mood, temptation, sleep, and other daily check-ins you optionally fill in.
Subscription data: which plan you have, the term, the amount, and the payment references we get back from Mollie.
Technical data: login timestamps and device type (for app functionality).
Route data (only if you record it yourself): if you record a run, walk or ride, we store the line you covered on our server — the series of coordinates of that route, together with distance and elevation gain. If you save a home location for your routes to start from, it stays in localStorage on your own device and is not sent to us. The map underneath your route is loaded from OpenStreetMap; that service sees your IP address and which map tile you request.

Apart from those routes we collect no location data, and we place no advertising trackers. Your bank or card details never reach our server: they stay with the payment provider.

What other users see about you

If you take part in a challenge such as Cresco90, other participants see your nickname, your level and your challenge scores on the leaderboard. If you are in a Cresco group, the person who created that group also sees whether you were active this week. Your training, nutrition and client file stay private. If you stop the challenge or leave the group, you disappear from the leaderboard and from the group immediately.

3. Paying and invoicing

Payments run through Mollie, our payment service provider. These are payments for a subscription. Mollie sees your payment details; we only see whether a payment succeeded or failed, the amount, and a reference. For every charge we create an invoice in Moneybird, our accounting software, which therefore holds your name, email address and — if you pay through a business — your company name, VAT number and billing address. Invoices are kept for seven years because Dutch tax law requires it.

4. Our own measurement (no advertising trackers)

We measure how many people make it through the app so we can see where things stall. This does not run on Google Analytics or any other external network but on our own endpoint on our own server (POST /api/funnel). There is no third-party tracking script in Sassu.

We record steps, not content. For example: that a signup screen was opened, that an account was created, that a first workout was logged, that a pricing screen was viewed, that a subscription button was clicked, that checkout started, and that a limit was hit. For such a step we store which step it was, when, and at most a short technical marker such as the chosen term or which screen you came from. No diary text, no meal, no chat message and no training content travels with it. We use these numbers only to improve the app, never to profile you or to target advertising.

5. Storage in your browser

Besides the functional cookies, the app uses your browser's localStorage. That is storage on your own device; it is not sent to us. We keep four things there: your chosen theme (Day or Night), an invitation code you followed while you are not yet registered, the source you arrived at the signup screen from, and — if you saved one yourself — the home location your routes start from. You can clear them by clearing the site data in your browser.

6. Why do we process your data?

To run the app and store your training history (performance of contract).
To handle and invoice your subscription (performance of contract and legal obligation).
To send you account emails such as password resets (legitimate interest).
To improve the app based on the step measurement described above (legitimate interest).
To answer your question to the AI assistant, if you use it (performance of contract).

7. Data retention

Your data is retained as long as your account is active. Upon account deletion, your personal data is erased within 30 days, except for invoice data, which we must keep for seven years.

8. Your rights (GDPR)

You have the right to access, correct, and delete your data, to receive a copy in a portable file, and to object to certain processing activities. Send your request to info@sassu.fit. We will respond within 30 days.

9. Security — where your data lives

Where it lives: on our own server at TransIP, a Dutch hosting company. Your database and your files are stored in the Netherlands.
In transit: every connection is encrypted (TLS 1.3). Connecting unencrypted is not possible — your browser is told to enforce that for a year, including on all subdomains.
Your password: we never keep it the way you typed it, only as a bcrypt hash. Your password cannot be computed back from that — not even by us.
Back-ups: once a week we make a full back-up of the database and the files to separate storage outside the data centre. The most recent one was on 21 September 2026.
You keep the key: Settings has an Export my data button and a Delete account button — you take your data out, or throw it out, without having to ask us. We never sell it (see section 10).

One thing is not in the Netherlands: if you use the AI assistant, your message goes to a language model outside the EU — section 10 explains which parties those are and what the transfer rests on.

10. Third parties

Mollie: payment service provider, processes your subscription payments under their own privacy policy.
Moneybird: accounting software, creates and stores the invoices.
Google (Workspace SMTP): used to send transactional emails.
Oura: optional integration for sleep and recovery data. You can disconnect it at any time in app settings.
OpenStreetMap Foundation (United Kingdom): supplies the map imagery underneath your routes. Sees your IP address and the requested map tile, not the route itself.

The AI assistant

The app has an AI assistant. If you use it, the text you send it — and, if you attach one, a photo or a voice message — goes to a third-party language model. That includes the context needed to answer your question: your recent workouts or today's meals, for example. Legal basis: performance of the contract — the assistant is part of the app you use. If you do not switch the assistant on, nothing goes to these parties. We do not use your conversations to train models, and we contract with these suppliers that they do not either.

OpenRouter (United States): the gateway to the language models. Every conversation with the assistant passes through it — both the client side and the coach side. Transfer on the basis of the EU Standard Contractual Clauses (SCCs).
Google (Gemini, United States): the model behind the conversations and app control, and also the only party that processes images and audio — describing a photo of a meal and transcribing a voice message. Transfer on the basis of the Standard Contractual Clauses.
Anthropic (United States): the stronger model for heavy reasoning on the coach side, a programme proposal for instance. Reached through OpenRouter. Transfer on the basis of the Standard Contractual Clauses.

These are all the parties that see your message. All three are in the United States and every transfer runs under the EU Standard Contractual Clauses.

We never sell your data to third parties.

11. Cookies

We use only functional cookies (session cookie for login, preference cookie for language). No advertising cookies.

12. Contact and complaints

Questions or complaints: info@sassu.fit. You may also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or your local authority.