Privacy Policy of WAM Labs GmbH for the product “treat”

1. Introduction and Scope

The protection of your personal data is very important to WAM Labs GmbH. This privacy policy informs you transparently about which data we collect, how we use it, and what rights you have as a user under the General Data Protection Regulation (GDPR).

It applies to all digital offers and services provided under the brand name “treat,” including the smartphone app (iOS/Android) and the website www.gotreat.app.

Responsible for data processing is:
WAM Labs GmbH
Brunnenstr. 2/3, 73765 Neuhausen, Germany
Email for data protection inquiries: legal@wamlabs.io

No data protection officer is currently appointed. The management assumes responsibility for data protection compliance.

2. Data Collected and Purposes of Processing

Registration and User Account

Data collected: date of birth, height, weight, gender, activity level, email address, password, optional profile photo
Purpose: To provide and personalize the app, including a 3-day free trial followed by a paid subscription
Payment Credit card data processed via payment providers RevenueCat and Supawall

Sign-in via Apple and Google
Data received: name and email address (Apple may provide an anonymized email address)

App Usage and Tracking

Tools used: Mixpanel, Posthog, Sentry, Opik
Purpose: Application improvement and error monitoring

Communication / Support

Support exclusively via email using Google Business Suite

Push Notifications

App push notifications for reminders and progress updates (no advertising)

Health Data

No processing of health-related data in the narrower sense

Transactional emails are sent via Brevo (formerly Sendinblue)
Used only for essential communication, no marketing emails
Legal basis: legitimate interest under GDPR for transactional emails
No double opt-in required since no newsletters are sent
Unsubscribe mechanisms are not required for purely transactional emails, but Brevo adheres to high data protection and security standards

4. Legal Bases for Data Processing

Contract performance (e.g., user account, payments): Art. 6(1)(b) GDPR
Legitimate interests (e.g., service improvement, security): Art. 6(1)(f) GDPR
Legal obligations (e.g., document retention): Art. 6(1)(c) GDPR

Hosting and data processing by Railway and Supabase with servers located in the EU
Payment processing via RevenueCat, Supawall, and Apple In-App Purchase
Data processing agreements in place with all service providers as per Art. 28 GDPR
No use of content delivery networks (CDNs)
No sharing of data with advertising or retargeting services (e.g., Meta/Facebook Pixel, Google Ads)

6. Cookies and Web Technologies

No use of cookie banners or consent management tools
No external widgets, social media plugins, Google Fonts, or similar are embedded
No server-side logging of log files (IP address, browser type, etc.)

7. Data Retention and Deletion

User accounts inactive for 12 months are deleted
Transactional and invoice data are stored for 10 years in compliance with commercial and tax laws
Support requests and tracking/technical usage data are deleted as soon as the purpose ceases and no legal obligations require further retention

8. Your Rights as a User

You have the following rights under GDPR:

Right to access your stored personal data
Right to correct inaccurate data
Right to delete data unless statutory retention periods apply
Right to restrict processing
Right to object to processing based on legitimate interests
Right to data portability
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority

To exercise your rights, please contact: legal@wamlabs.io

9. Contact for Data Protection Questions

WAM Labs GmbH
Brunnenstr. 2/3, 73765 Neuhausen, Germany
Email: legal@wamlabs.io

This privacy policy is regularly reviewed and updated to meet legal requirements and technical developments. You will be informed of significant changes accordingly.