GDPR Privacy Notice

1 Data Controller Identity

The data controller responsible for your personal data is:

2 What This Notice Covers

This GDPR Notice applies to all processing of personal data of individuals located in:

• All 27 European Union member states.
• European Economic Area (EEA) countries: Norway, Iceland, and Liechtenstein.
• The United Kingdom (under UK GDPR and the Data Protection Act 2018).

It covers personal data collected when you:

• Create an OpenMat account or register via Google Sign-In.
• Use the OpenMat app or website at openmat.ai.
• Interact with community features, training tools, or coaching features.
• Subscribe to a paid plan or make a purchase.
• Contact our support team or respond to communications from us.
• Visit openmat.ai even without creating an account (analytics only).

This notice does not apply to users located outside the EU, EEA, and UK. All other users are covered by our main Privacy Policy.

3 Personal Data We Process

We process the following categories of personal data about EU/EEA/UK users. For full detail on each category, see Section 2 of our Privacy Policy.

4 Legal Bases for Processing

Under GDPR Article 6, every processing activity must have a valid legal basis. Here are ours:

5 Special Category Data

GDPR Article 9 imposes stricter requirements on "special category" personal data, which includes data concerning health. OpenMat may process special category data in two scenarios:

5.1 — Health & Body Data (Weight Logs, Injury Notes)

If you voluntarily enter weight logs, body composition data, or injury notes into the OpenMat app, this constitutes health data under Article 9. We process this data exclusively on the basis of your explicit consent (Art. 9(2)(a)). This data is:

• Stored only on your device in localStorage unless you choose to sync.
• Never shared with other users without your explicit action.
• Never used for advertising, profiling, or shared with third parties.
• Deleted with your account or on request at any time.
• Entirely optional — the core app works fully without entering any health data.

5.2 — Optional Google Data (Age Range, Birthday)

If you sign in with Google and grant the optional birthday/age scope, the approximate age range received may constitute data about a natural person's age — treated with equivalent care to health data. This is processed only with your explicit consent given on the Google consent screen, and is used solely to display an age note in your bio.

6 Purposes of Processing

7 International Data Transfers

OpenMat is operated from the United States, which is a third country for the purposes of GDPR Chapter V. When you use OpenMat as an EU/EEA/UK user, your personal data is transferred to and processed in the United States.

Transfer mechanism: We rely on the European Commission Standard Contractual Clauses (SCCs) — specifically the 2021 Module 1 (Controller to Controller) SCCs — as the legal mechanism for transferring personal data from the EU/EEA to the United States under GDPR Article 46(2)(c).

UK transfers: For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the Addendum to the EU SCCs approved by the UK ICO under UK GDPR Article 46.

You may request a copy of the SCCs and IDTA we use by emailing legal@openmat.ai with subject "SCC Request."

8 Sub-Processors & Third-Party Transfers

We engage the following sub-processors who may process EU/EEA/UK personal data on our behalf. All are bound by Data Processing Agreements (DPAs) under GDPR Article 28:

We will notify you of any new sub-processor additions that materially affect the processing of your personal data. You have the right to object to new sub-processors — if you object and we cannot accommodate your objection, you may terminate your account and receive a data export.

9 Data Retention

Under GDPR Article 5(1)(e) (storage limitation principle), we retain personal data only for as long as necessary for the purposes for which it was collected. Our full retention schedule is in Section 12 of our Privacy Policy. Key periods for EU/UK users:

At the end of each retention period, data is permanently and irreversibly deleted. For backup systems, deletion occurs within 90 days of the primary deletion as backups are rotated.

10 Your Eight GDPR Rights

Under GDPR Chapter III, EU/EEA/UK users have the following rights regarding their personal data:

11 How to Exercise Your Rights

To exercise any of your GDPR rights, follow these steps:

1. Identify your request type

   Refer to Section 10 above to identify which right you wish to exercise. You may exercise multiple rights in a single request.

2. Use the in-app options where available

   Many rights can be exercised directly: access and portability via Settings → Export Data; rectification via Settings → Edit Profile; erasure via Settings → Delete Account; notification opt-out via Settings → Notifications.

3. Email privacy@openmat.ai for all other requests

   Use the subject line "GDPR [Right Type] Request — @yourhandle". For example: "GDPR Erasure Request — @jakethompson" or "GDPR Access Request — @mariasantos". Include your registered email address.

4. Identity verification

   We will send a verification email to your registered address. You must click the verification link within 48 hours. For sensitive requests, we may ask for one additional piece of identification. We will not ask for passwords, full payment card details, or government ID numbers.

5. Receive our response

   We will respond to all GDPR rights requests within 30 days of receiving a verified request. For complex or multiple requests, we may extend this by a further two months and will notify you within the initial 30-day period. We do not charge a fee for reasonable requests.

12 Automated Decision-Making & Profiling

GDPR Article 22 grants you the right not to be subject to solely automated decisions that produce legal or similarly significant effects on you.

Current automated processing on OpenMat:

For fraud detection flags, a human member of our team always reviews automated flags before any action (such as account suspension) is taken. You will be notified of any such review and given the opportunity to contest the decision.

We do not use your personal data to make automated decisions about subscription pricing, access to features, or any other decision that produces legal or similarly significant effects without human oversight.

13 Cookies & ePrivacy

Our use of cookies and browser storage is governed by both GDPR and the EU ePrivacy Directive (implemented as PECR in the UK). For full details, see our Cookie Policy.

Summary for EU/UK users:

• Essential storage (localStorage for app function): No consent required — strictly necessary for the service you requested.
• Analytics storage (session tracking): Requires your consent under ePrivacy rules. Off by default. You are asked for consent on first visit via our cookie banner.
• Third-party advertising cookies: We do not use these. None are set on openmat.ai.

Your consent to analytics storage can be withdrawn at any time via Settings → Privacy → Cookie Preferences or by emailing privacy@openmat.ai.

14 Children (Under 16)

The GDPR sets the digital consent age at 16 years for most EU member states (some member states have set it as low as 13 — see below). Children below the applicable age in their country require parental or guardian consent before we can process their personal data.

Where a child below the applicable age creates an account, we require verifiable parental consent. If we become aware that a child below the applicable age has registered without parental consent, we will delete the account and associated data promptly.

Parents or guardians wishing to review, correct, or request deletion of a child's data should email privacy@openmat.ai with subject "Minor Data Request — [Country]".

15 Supervisory Authorities

Under GDPR Article 77, you have the right to lodge a complaint with your national supervisory authority (Data Protection Authority — DPA) if you believe we have not complied with GDPR in handling your personal data.

We encourage you to contact us first at privacy@openmat.ai — we want to resolve all concerns directly. However, you are entitled to contact your DPA at any time without first contacting us.

16 Changes to This Notice

We may update this GDPR Notice to reflect changes in our processing activities, legal requirements, or regulatory guidance. When we make material changes that affect EU/UK users' rights or our legal bases for processing, we will:

• Post the updated notice with a new "Last Updated" date.
• Display a prominent in-app notification describing the key changes.
• Send an email to all registered EU/UK users at least 14 days before the changes take effect.
• Where changes affect consent-based processing, seek fresh consent before the new processing begins.

Minor changes (such as clarifications, formatting, or contact detail updates) may be made without prior notice. The "Last Updated" date at the top of this notice will always reflect the most recent revision.

Continued use of OpenMat after material changes take effect constitutes acceptance of the updated notice, except where fresh consent is required.

17 Contact & Data Protection Officer

For any GDPR-related questions, rights requests, or concerns:

This GDPR Notice was last reviewed and updated on April 1, 2026. It is reviewed at least annually and whenever significant processing changes occur. For the latest version, visit openmat.ai/gdpr. This notice is provided in accordance with GDPR Articles 13 and 14.