Privacy Policy

Last updated: 4 September 2026

This policy explains what data Sassu collects, why, and what your rights are. The Dutch version is the leading text; this is a translation.

1. Who are we?

The controller is Jayyletsgetfit, Wenckebachweg 135-1H, 1096 AM Amsterdam, the Netherlands, Chamber of Commerce 34352011, VAT NL002174513B79, trading as Sassu. The app runs at app.sassu.fit. For privacy inquiries: info@sassu.fit.

2. What data do we collect?

Account data: name and email address at registration.
Training data: sets, reps, weights, exercises, and diary notes you enter yourself.
Nutrition data: meals, calories, and macronutrients you log manually.
Diary data: mood, temptation, sleep, and other daily check-ins you optionally fill in.
Subscription data: which plan you have, the term, the amount, and the payment references we get back from Mollie.
Technical data: login timestamps and device type (for app functionality).
Route data (only if you record it yourself): if you record a run, walk or ride, we store the line you covered on our server — the series of coordinates of that route, together with distance and elevation gain. If you save a home location for your routes to start from, it stays in localStorage on your own device and is not sent to us. The map underneath your route is loaded from OpenStreetMap; that service sees your IP address and which map tile you request.

Apart from those routes we collect no location data, and we place no advertising trackers. Your bank or card details never reach our server: they stay with the payment provider.

3. Paying and invoicing

Payments run through Mollie, our payment service provider. These are payments for a subscription. Mollie sees your payment details; we only see whether a payment succeeded or failed, the amount, and a reference. For every charge we create an invoice in Moneybird, our accounting software, which therefore holds your name, email address and — if you pay through a business — your company name, VAT number and billing address. Invoices are kept for seven years because Dutch tax law requires it.

4. Our own measurement (no advertising trackers)

We measure how many people make it through the app so we can see where things stall. This does not run on Google Analytics or any other external network but on our own endpoint on our own server (POST /api/funnel). There is no third-party tracking script in Sassu.

We record steps, not content. For example: that a signup screen was opened, that an account was created, that a first workout was logged, that a pricing screen was viewed, that a subscription button was clicked, that checkout started, and that a limit was hit. For such a step we store which step it was, when, and at most a short technical marker such as the chosen term or which screen you came from. No diary text, no meal, no chat message and no training content travels with it. We use these numbers only to improve the app, never to profile you or to target advertising.

5. Storage in your browser

Besides the functional cookies, the app uses your browser's localStorage. That is storage on your own device; it is not sent to us. We keep four things there: your chosen theme (Day or Night), an invitation code you followed while you are not yet registered, the source you arrived at the signup screen from, and — if you saved one yourself — the home location your routes start from. You can clear them by clearing the site data in your browser.

6. Why do we process your data?

To run the app and store your training history (performance of contract).
To handle and invoice your subscription (performance of contract and legal obligation).
To send you account emails such as password resets (legitimate interest).
To improve the app based on the step measurement described above (legitimate interest).
To answer your question to the AI assistant, if you use it (performance of contract).

7. Data retention

Your data is retained as long as your account is active. Upon account deletion, your personal data is erased within 30 days, except for invoice data, which we must keep for seven years.

8. Your rights (GDPR)

You have the right to access, correct, and delete your data, to receive a copy in a portable file, and to object to certain processing activities. Send your request to info@sassu.fit. We will respond within 30 days.

9. Security

Passwords are stored hashed (bcrypt), all connections use HTTPS, and database access is restricted to the server.

10. Third parties

Mollie: payment service provider, processes your subscription payments under their own privacy policy.
Moneybird: accounting software, creates and stores the invoices.
Google (Workspace SMTP): used to send transactional emails.
Oura: optional integration for sleep and recovery data. You can disconnect it at any time in app settings.
OpenStreetMap Foundation (United Kingdom): supplies the map imagery underneath your routes. Sees your IP address and the requested map tile, not the route itself.

The AI assistant

The app has an AI assistant. If you use it, the text you send it — and, if you attach one, a photo or a voice message — goes to a third-party language model. That includes the context needed to answer your question: your recent workouts or today's meals, for example. Legal basis: performance of the contract — the assistant is part of the app you use. If you do not switch the assistant on, nothing goes to these parties. We do not use your conversations to train models, and we contract with these suppliers that they do not either.

DeepSeek (China): the model behind the conversations and app control. China has no adequacy decision from the European Commission; the transfer therefore rests on the EU Standard Contractual Clauses (SCCs), supplemented by an assessment of the circumstances in that country. In plain words: there is a contract protecting your data, but the level of protection is not automatically equal to the European one. If you would rather not, do not use the assistant — the rest of the app works fine without it.
OpenRouter (United States): a gateway to language models, used for the coach side of the app. Transfer on the basis of the Standard Contractual Clauses.
Google (Gemini, United States): processes images and audio only — describing a photo of a meal and transcribing a voice message. Transfer on the basis of the Standard Contractual Clauses.

We never sell your data to third parties.

11. Cookies

We use only functional cookies (session cookie for login, preference cookie for language). No advertising cookies.

12. Contact and complaints

Questions or complaints: info@sassu.fit. You may also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or your local authority.