Privacy policy
Data controller
The controller of personal data is the sole proprietorship (obrt) BIG BEARD MAN, owned by Leo Vladimir, personal identification number (OIB) 24948306102, Split. For any questions about the processing, you can write to info@bigbeardman.com.
What data we collect
Account data: name and email address. Profile data: age, sex, height, weight, measurements, experience level, goals, and information about injuries and health limitations. Usage data: logged workouts, weekly check-ins and progress. When you pay: your name, email address, the package or plan you bought, the amount, and the date and status of the payment; your card details are processed only by Stripe, and we never see them.
When you buy a gift: your name and email address, the recipient’s name, the recipient’s email address if you enter it, and the message; we use the recipient’s email address only to send the gift. We keep this data while the gift code is valid and for as long as tax regulations require. For the nutrition module notification: your email address, which we use only for that one message. For a questionnaire recommendation sent to your email: we use the address only to send it and don’t store it; if you tick that Leo may contact you (consent you can withdraw by replying to his email), the address and the recommendation (program and package) also reach Leo by email and are kept until you ask for deletion.
Progress photos you upload are seen only by your coach. They are not used in marketing without your explicit and separate consent.
Video analysis: the exercise video or photo you send is seen only by your coach. A video is compressed on our server (Vercel, Frankfurt), stored with Supabase in Frankfurt and deleted 90 days after your coach comments on it (a video that cannot be processed, 90 days after you send it), or right away when you delete your account. A photo isn’t compressed, but is stored and deleted the same way. Your coach’s comments stay in your account.
Legal basis and purpose of processing
We process account and payment data to conclude and perform the contract and to issue invoices. We process data about your health and injuries solely on the basis of your consent, in order to tailor the program, and you can withdraw that consent at any time. We process analysis videos and the coach’s comments for the performance of the contract (video analysis is part of the package). We process data on the use of public pages (Google Analytics and Microsoft Clarity) only on the basis of your consent, to analyze traffic and improve the site, and you can withdraw that consent at any time.
After the questionnaire, an automatic rule builds the program and package recommendation from your answers. It is only a suggestion and has no legal effect: you choose the package yourself, and your coach builds your program. If you’d like your coach to give you a recommendation personally, write to info@bigbeardman.com or message Leo in the app.
By email, we only send messages related to your account and the service: sign-up and purchase confirmations, password resets, notifications about your program, messages and analyses, reminders before your demo, plan or package ends, and, during the free demo, two messages with tips. We don’t send a newsletter; if we ever introduced one, we would send it only with your consent and with an unsubscribe link in every message.
Who we share data with
We share data only with the service providers the platform cannot run without:
Supabase (Supabase, Inc., USA): database, sign-in and storage of progress photos and analysis videos, on servers in Frankfurt.
Vercel (Vercel Inc., USA): hosting of the website and the app, and compression of analysis videos, on servers in Frankfurt.
Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA): payments. You enter your card details directly with Stripe, and we never see them.
Resend (Resend, Inc., USA): sending email, such as purchase confirmations, password resets and notifications.
Email provider (Croatia): messages you send to info@bigbeardman.com.
Google Analytics (Google Ireland Limited, Ireland, and Google LLC, USA) and Microsoft Clarity (Microsoft Corporation, USA): analytics, only with your consent.
If you turn on notifications on your device, they are delivered by your browser’s or operating system’s notification service (Apple, Google or Mozilla). The content of notifications is encrypted.
Transfers outside the European Union
Some of these providers are based in the USA, so data may be transferred to or accessed from there. Such transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses.
How long we keep your data
We keep data while your account is active and for twelve months after it is closed. If you delete your account yourself in the app, under Profile, Settings, we delete the whole account right away: your profile, questionnaire answers, workouts, check-ins, measurements, photos, videos and comments. We keep data on issued invoices for eleven years, as required by tax regulations, and gifts that were bought as a record of payment.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability, as well as the right to object. You send your request to info@bigbeardman.com, and we respond within thirty days. You can also download a copy of your data and delete your account yourself in the app, under Profile, Settings. You can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, azop.hr.
Cookies and storage on your device
Essential, the site does not work without them and they cannot be turned off: the sign-in cookie (Supabase; keeps you signed in until you log out, at most 400 days), bbm_demo (public demo, 2 hours), and Stripe’s __stripe_mid (1 year) and __stripe_sid (30 minutes) on payment pages, to prevent fraud.
Functional, they do not track you: “jezik” remembers the language of the website and the app (hr or en), and “vodic” that you turned off the app guide; both last 12 months. In your browser’s local storage we keep your cookie choice, the questionnaire until you send it to your account (it is deleted after sending), the recommended package and program, the state of the guide and notifications, and temporarily saved copies of public pages, so they open even without internet.
Analytics, only with your consent and only on public pages, not in the app or on the questionnaire, registration, sign-in, new password, payment and gift pages: Google Analytics (_ga and _ga_JES71YTK1Z, 2 years; site traffic) and Microsoft Clarity (_clck, 1 year, and _clsk, 1 day, plus Microsoft cookies on the clarity.ms and bing.com domains; how the site is used: clicks and scrolling). You can withdraw your consent at any time via the Cookies link in the footer.