Privacy Policy

Forge Ventures, operating as FuelTheGains ("we", "us", "our"), is the data controller responsible for your personal data. For any questions regarding this policy or your data, contact us at support@resend.fuelthegains.com.

We collect the following categories of data:

• Personal information: name, email address, and authentication credentials (password hash or Google OAuth profile).
• Biometric data: age, gender, height, weight, activity level, and body composition data you provide for meal plan generation and progress tracking.
• Payment data: subscription status and billing information. Payment details (card numbers) are processed and stored exclusively by Stripe — we never store your full card information.
• Usage data: meal plan history, meal logs, weight logs, and calorie/macro calculations generated through the Service.
• Newsletter and lead data: if you submit your email via our calculator, starter-kit form, or any other lead magnet without creating an account, we store your email address, the locale you submitted from, the source of the submission, and a consent record (timestamp, version identifier, and the exact disclosure text shown to you at submission — required proof-of-consent under GDPR Article 7(1)).

We process your data under the following legal bases (GDPR Article 6):

• Contract performance: to provide you with the Service, generate meal plans, and manage your subscription.
• Consent: for sending marketing communications and processing biometric data for personalized nutrition plans.
• Legitimate interest: to improve the Service, prevent fraud, and ensure security.
• Legal obligation: to comply with applicable laws and regulations.

We use the following third-party services to operate FuelTheGains:

• MongoDB Atlas: cloud database hosting for storing your account and meal plan data. Data is stored in secured, encrypted clusters.
• Stripe: payment processing for subscriptions. Stripe handles all payment card data in compliance with PCI DSS standards. Stripe Privacy Policy.
• Resend: transactional email delivery for account verification, welcome emails, and password resets. Resend Privacy Policy.
• Google OAuth: optional authentication provider. When you sign in with Google, we receive your name and email address from your Google profile. Google Privacy Policy.
• Vercel: frontend hosting and web analytics. Vercel Analytics collects anonymous, aggregated usage data (page views, referrers, device info, geolocation) without cookies or personal identifiers. Vercel Privacy Policy.
• Railway: backend hosting and infrastructure. Railway processes API requests on our behalf. Railway Privacy Policy.

We retain personal data only as long as needed for the purpose of each processing activity. Account data (profile, biometrics, meal plans, logs) is kept while your account is active and deleted within 30 days of account deletion. Billing records (invoices, Stripe customer ID, subscription history) are retained for 10 years from the end of the accounting year, as required by French commercial law (Code de commerce, Art. L.123-22). Newsletter and lead data is retained until you unsubscribe, or after 3 years of inactivity if you never engage with our emails — whichever comes first (aligned with CNIL guidance on prospect data). Consent records (timestamp, version, disclosure text) are retained for 5 years after consent is withdrawn, as evidence under GDPR Article 7(1). Anonymized and aggregated statistics may be retained indefinitely for service improvement.

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Data portability: receive your data in a structured, machine-readable format.
• Restriction: request that we limit the processing of your data.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@resend.fuelthegains.com. You can also delete your account and export your data directly from your account settings. We will respond to formal requests within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following additional rights:

• Right to Know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: you may request deletion of the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: we do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA rights (e.g., by denying services, charging different prices, or providing a different quality of service).

Categories of personal information collected (as defined by the CCPA): identifiers (name, email), biometric information (height, weight, age), commercial information (subscription and payment history), and internet or electronic network activity (usage data and meal logs).

To exercise your CCPA rights, contact us at support@resend.fuelthegains.com. You can also delete your account and download your data directly from your account settings. We will verify your identity before processing formal requests and respond within 45 days.

FuelTheGains uses localStorage to store your authentication token (JWT) and user preferences. We use Vercel Web Analytics for anonymous, aggregated traffic statistics — it does not use cookies or collect personal identifiers. We do not use tracking cookies or third-party advertising cookies. No cookie consent banner is required as we only use strictly necessary storage mechanisms and privacy-compliant analytics.

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete such information.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including where our third-party service providers operate. In such cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data.

We implement industry-standard security measures to protect your data, including password hashing with Argon2, encrypted database connections, HTTPS enforcement, and JWT-based authentication. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our privacy team at support@resend.fuelthegains.com. As a micro-entreprise, Forge Ventures is not required to appoint a designated Data Protection Officer under GDPR Article 37, but we handle all privacy requests personally and respond within the 30-day statutory window.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (Commission Nationale de l'Informatique et des Libertes).