Privacy Policy

1. Who is responsible for your data

SSF WORKOUTS is operated by SSF WORKOUTS (commercial registration number To be published), address: Kuwait City, State of Kuwait, which is responsible for your personal data. For any privacy question or request, contact us at support@ssfworkout.com or +96500000000.

Kuwait does not yet have a general data protection law. We wrote this policy using the Data Privacy Protection Regulation of the Communication and Information Technology Regulatory Authority (CITRA Decision 26 of 2024) as a guide.

2. What we collect

• —Account: your mobile number (confirmed with an SMS code), your name, your language, and your email address only if you add one. For staff: an email address, a password stored only in hashed form, and a second sign-in factor.
• —Profile and body: sex, date or year of birth, height, weight, target weight, body fat, goal, experience, activity level, training days and preferred training time, the equipment you can use, and, if you choose to add them, your governorate and a contact number.
• —Training: your schedule, sessions, exercises, sets, repetitions, loads, effort ratings, notes, personal records and body measurements.
• —Nutrition: dietary preferences, allergies and intolerances, foods you exclude, meals per day, preferred cuisines, budget level, and your answers to the health screening.
• —Photos: your profile photo, progress photos, the photos you upload for Future Self and the illustrations made from them.
• —Leaderboards: your alias, and whether you have chosen to take part.
• —Purchases: orders, amounts, payment status, the MyFatoorah payment reference, and any refund requests with the reasons you give. We never receive your full card number.
• —Consents: each consent you give or withdraw, with the date and the version of the document you were shown.
• —Messages: what you send us through the contact form or by email, and your email address if you subscribe to the newsletter (only after you confirm it from the link we send you).
• —Technical: IP address and browser type for your signed-in sessions and to limit misuse, plus security logs.

3. Why we use it

• —To run your account, sign you in and provide what you bought: programmes, tracking, calculations, nutrition plans and illustrations.
• —To take payment, send receipts, handle refunds and keep the accounting records the law requires.
• —To send the notifications you have chosen, in the app and by email. We use SMS only for sign-in codes.
• —To keep the platform and your account secure and prevent misuse.
• —To answer your questions and complaints.
• —To understand how the platform is used, from totals and averages rather than by building a profile of you.

We do not sell your data, we do not use it for advertising, and we do not use your photos or health information for marketing or to train AI models.

4. Your consent

When you open an account, you agree to the Terms and to this policy so that we can provide the service. There are also two optional consents, which stay off unless you turn them on:

• —AI processing: lets us send the data described in section 5 to our AI providers. Without it, we do not send your data to them, nutrition plans and Future Self are not available to you, and exercise-swap suggestions come from our own rules instead of AI.
• —Leaderboards: lets us show your approved alias and your results on leaderboards (section 7).

You can withdraw either consent at any time from Settings or by contacting us. Withdrawing stops processing from then on but does not undo what has already happened. Refusing or withdrawing a consent does not affect the rest of your account.

5. AI features: what is sent, and where

• —Nutrition plans (Anthropic, USA): we send Anthropic's Claude model your sex, age, height, weight, activity level and goal, the calorie and macro targets we have calculated, the number of meals you want, the foods you exclude (including allergies and intolerances), your dietary preferences, preferred cuisines and budget level, and the list of foods it may choose from. We do not send your name, mobile number, email or photos.
• —Exercise swaps (Anthropic, USA): we send the exercise, its sets and repetitions, the reason you type and the equipment you have. Please do not put personal or health details in that reason.
• —Future Self (Google Gemini, USA): we send the photo you upload (after removing hidden data such as location and reducing its size), the timeframe and goal you choose, and, for a woman's photo, an instruction not to change how much the clothing covers. The result is checked automatically before you see it, marked in the image itself as an AI illustration, stored privately and shown only to you. You can delete both the original photo and the illustration at any time.
• —Never sent to any AI provider: your health screening answers, apart from the food allergies and intolerances we need to keep out of your plan.
• —These providers process the data to return the result to us. We use them only under their business terms, which do not allow them to train their models on your data. They may keep what they receive for a limited time under their own terms, for example to detect misuse, and then delete it.

6. Who else receives your data

We share data only with the service providers we need, and each one receives only what it needs:

• —Amazon Web Services (AWS), India (Mumbai region): hosting, our database and file storage. All the data in section 2 is stored there.
• —SMSBox, Kuwait: your mobile number and your sign-in code, so the SMS can reach you.
• —MyFatoorah, Kuwait: your name, mobile number, email if you have given us one, the order number and the amount, to process the payment. Card details go directly to MyFatoorah.
• —Google (Gmail), USA: your email address, your name and the content of the emails we send you, and the messages you send us by email or through the contact form.
• —Anthropic, USA, and Google (Gemini), USA: only if you have given AI consent, as described in section 5.
• —WhatsApp (Meta): only if you choose to message us on WhatsApp. That conversation is also subject to WhatsApp's own terms.
• —Authorities: where Kuwaiti law or a court order requires it.

This means your data is stored in India, some of it is processed in the USA, and Google may also process data in other countries where it operates. To protect it, we send each provider only what it needs, always over an encrypted connection.

7. Leaderboards

• —Taking part is optional. You need the leaderboard consent and an alias that a member of our team has approved.
• —A leaderboard shows your alias and your score or rank, for consistency and for strength progress (the improvement in your lifts, not the weights themselves).
• —It never shows your mobile number, bodyweight, photos or health answers. A board with fewer than five people is not shown.
• —You can leave at any time, and you are removed from the boards straight away.

8. How we protect your data

• —All connections to the platform are encrypted (HTTPS).
• —Progress photos and Future Self images are encrypted before they are stored, so the stored files cannot be read without our key, and they are shown only after we check that you are their owner. We remove hidden data, including location, from every photo you upload.
• —Sign-in codes expire after five minutes, stop working after five wrong attempts, and are stored only in hashed form.
• —Staff sign in with a password and a second factor. Customer data is seen only by staff who need it for their work, and staff access to private photos is limited and logged, as are other sensitive actions.
• —We never see your full card number.

No system is 100% secure, but we work to keep these protections in place.

9. How long we keep your data

• —While your account is open: we keep your data until you delete it, or until we delete it (for example, at your request or when an account is closed under the Terms). It does not expire on its own.
• —Photos: you can delete any progress photo, Future Self photo or illustration yourself at any time, from your dashboard.
• —When you delete your account: your access ends immediately. We delete your profile, body measurements, health screening answers, photos and illustrations, AI results, training history, nutrition plans, leaderboard alias and notification settings. Deletion from our live systems is complete within 30 days, and copies in backups disappear as those backups are replaced.
• —What the law requires us to keep: Kuwaiti commercial law requires merchants to keep invoices and business documents for five years, and accounting books for ten. So when you delete your account, or ask us to delete financial records, we keep a minimal record of each purchase and refund: the invoice or order number, date, amount, what was bought, the MyFatoorah payment reference, refund details, and the name and mobile number as they appear on the invoice. Only authorised staff can access it, and we delete it when the legal period ends. We may also keep information needed for a legal claim or a court order until it is resolved.
• —Newsletter: until you unsubscribe with the link in every email.
• —Security logs: kept for a limited period and then deleted.

10. Your rights and choices

• —See and download: from Settings you can download a copy of everything we hold about you: your profile, consents, health screening answers, body measurements, enrollments and training history, nutrition plans, the list of your photos and illustrations, your leaderboard alias, orders and refund requests.
• —Correct: edit your details in Settings, or ask us to correct them.
• —Delete: delete progress photos and Future Self photos yourself, or delete your whole account from Settings, subject to section 9.
• —Withdraw consent: turn off AI processing or leaderboards at any time (section 4).
• —Ask or complain: contact us at support@ssfworkout.com or +96500000000. We may need to confirm that you own the account before acting on a request.

11. Age

The platform is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we will close it and delete its data, subject to section 9.

12. Cookies

We use only the cookies the platform needs: one to keep you signed in and one to remember your language. We do not use advertising or analytics cookies. On the checkout page, MyFatoorah's payment form may use its own cookies to process your payment and prevent fraud.

13. If there is a security incident

If a security incident is likely to affect you, we will tell you without delay, explain what happened and what you can do, and notify the authorities where the law requires it.

14. Changes to this policy

The date of the latest version is shown at the top of this page. Before any significant change takes effect, such as a new provider or a new use of your data, we will tell you in the app or by email, and ask for your consent again where needed.

15. Language

This policy is in Arabic and English. If the two differ, the Arabic text prevails.