Privacy policy

1. Who is responsible for your data

This policy applies to the Noba iPhone app and to this website (nobaapp.com). The controller of your data is:

Controller

Miguel Ridruejo Mendoza

Tax ID (NIF)

02585581J

Address

Carrer de Elisa, 24, 08023 Barcelona, Spain

Email

hola@nobaapp.com

For any question about your data, write to us at hola@nobaapp.com.

2. What data we process

Your account

• Your email address, so you can sign in with a one-time code (we do not use passwords).
• If you use “Continue with Apple”, the identifier Apple gives us for your account and the email address Apple shares with us (this may be a private relay address if you choose to hide yours).
• Your name, to greet you and in your reminders.
• Your year of birth and a profile photo, only if you choose to add them. Both are optional.
• The date you signed up and your customer ID, a code that identifies you if you write to us.

Your practice

• Your answers to the welcome questionnaire: experience, goals, how comfortable you are getting down to the floor, how long you want classes to last, how many days a week and at what time of day you prefer to practise.
• Your favourites, your queue, your collections and your notes on classes.
• Your history: which class you did, when and for how long, and where you stopped in each class so you can resume it.
• The programs you have started, the classes you want to see less of, your weekly goal and your reminder, playback and timer settings.

This data is stored on your iPhone and, when you are signed in, synced to our server so you do not lose it and can use it on another device.

Health-related data

If you wish, you can tell us about considerations such as osteoporosis, a joint replacement or knee problems. We explain this in detail in section 3.

Your subscription

Payment is handled by Apple. We never see your card details or your billing address. Apple tells us the status of your subscription (which plan you have, whether you are in the free trial, start, renewal and end dates, cancellations and refunds) and the purchase identifiers, so we can unlock Premium on your account.

Messages you send us

• Thank-you notes to Belén: if you thank her after a class, we store your message, the class it refers to and your account, so Belén can read it.
• Help requests: if you write to us, we process your email address, what you tell us and the details the app adds at the end of the message to help us help you (your customer ID, the app version and the iOS version).

Technical data

When the app connects to our servers (to sign in, sync or play a video), technical data is logged, such as your IP address, device and system type, app version and the date and time of the connection. We use it to run the service, keep it secure and fix errors.

What stays only on your iPhone

• Downloaded classes.
• Calendar events you create when you schedule a class. The app can only add events: it does not read your calendar.
• The photo you choose for your profile is the only one in your photo library we access.

3. Your health data

In the welcome questionnaire and in Account → Practice preferences you can, if you wish, tell us about any of these considerations: osteoporosis or osteopenia, hip or knee replacement, back pain, sensitive knees or wrists, balance problems, menopause, or recovering from an injury.

The law treats this as health data, a special category of personal data (Article 9 of the General Data Protection Regulation, GDPR). That is why:

• It is optional. You can choose “None of these” and use Noba as normal.
• We only process it with your explicit consent, which you give by ticking a dedicated checkbox in the app. If you don't tick it, we don't store this information. You can withdraw it at any time in Account → Practice preferences, and we delete it.
• We only use it to recommend and order classes, showing you the most suitable ones first. We do not use it for advertising or any other purpose, and we never sell or pass it on to anyone.
• You can withdraw your consent at any time: unselect the considerations in Account → Practice preferences and we will stop using them, or delete your account to erase everything. Withdrawing does not affect what was done earlier with your permission.

Please do not write medical information in your notes or messages unless you need to. If you do, we will treat it with the same care.

4. Why we use it and our legal basis

• Creating and keeping your account, signing you in, syncing your practice and giving you access to Premium and downloads. Legal basis: performance of the contract you accept by using Noba (Art. 6(1)(b) GDPR).
• Recommending classes based on your questionnaire, your history and what you mark as “less like this”. Legal basis: performance of the contract, because recommendations are part of the service (Art. 6(1)(b) GDPR).
• Taking your health considerations into account when recommending classes. Legal basis: your explicit consent (Arts. 6(1)(a) and 9(2)(a) GDPR).
• Delivering your thank-you notes to Belén and answering your questions. Legal basis: performance of the contract, because you ask us to (Art. 6(1)(b) GDPR).
• Keeping the service secure, preventing abuse (for example, one subscription being used on several accounts) and fixing errors. Legal basis: our legitimate interest in protecting the service and the people who use it (Art. 6(1)(f) GDPR).
• Meeting legal obligations and handling possible claims. Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).

Recommendations are made automatically, but they have no legal or similarly significant effect on you: they only change the order in which you see classes, and you can adjust them at any time.

The only emails we send you are sign-in codes and replies to your messages.

5. Who we share it with

To run Noba we work with these providers. They act as processors: they may only use your data on our instructions and to provide their service to us.

Supabase

Hosting, database, sign-in and server functions. Your data is stored in the European Union (Ireland).

Mux

Streaming of class videos. It receives your IP address, device and player data and which video you watch; it does not receive your name or email. Based in the United States.

Postmark

Sending the emails with your sign-in code. It receives your email address and the content of that message. Based in the United States.

Fly.io

Hosting of this website (servers in Paris, France). It receives technical data about your visit, such as your IP address.

Cloudflare

Management of the nobaapp.com domain (DNS). It doesn't receive your personal data.

Google (Google Workspace)

Our email: it receives the messages you send us at hola@nobaapp.com and our replies to you.

In addition:

• Apple handles payments, subscriptions and Sign in with Apple as an independent controller, under its own privacy policy.
• Belén Mendoza, the teacher, reads the thank-you notes you choose to send her.
• Public authorities may receive data when the law requires us to provide it.

6. Transfers outside the EU

Mux, Postmark, Fly.io, Cloudflare and Google are United States companies. When your data travels to them, the transfer is protected by the standard contractual clauses approved by the European Commission, which require the provider to protect your data as EU law demands. The same applies to Supabase or Cloudflare if, for technical or support reasons, they access data from outside the European Economic Area. You can ask us for more information at hola@nobaapp.com.

7. How long we keep it

• While you have an account. Your account, practice and health data are kept while you use it.
• If you delete your account (in the app: Account → Account details → Delete account), we delete your profile, history, favourites, lists, preferences and health considerations, your subscription record and your thank-you notes. This cannot be undone.
• Backups. Server backups are replaced periodically; your data disappears from them too once they are overwritten.
• Help requests. We keep your messages for as long as needed to help you and to handle any claims.
• Technical data. Connection logs are kept for a short time, as set by our providers to operate the service.
• Legal obligations. If the law requires us to keep some data (for example, because of a claim), we keep it blocked, unused, only for the legal period, as provided in Article 32 of Spanish Organic Law 3/2018 (LOPDGDD).

8. Your rights

At any time and free of charge, you can:

• Access your data and find out how we process it.
• Rectify it if it is wrong. You can change your name, photo and preferences yourself in the app.
• Erase it. The quickest way is to delete your account from the app.
• Take it with you (portability): we send it to you in a structured, commonly used format.
• Object to processing based on legitimate interest.
• Ask us to restrict processing in certain cases.
• Withdraw your consent to the use of your health data, without affecting earlier processing.

To exercise them, write to hola@nobaapp.com, ideally from your account email or quoting your customer ID (you will find it in Account → Account details), so we can check it is you. We will reply within one month.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es). It would help if you told us first, so we can try to put it right.

9. Security

All connections between the app and our servers are encrypted. Each account can only read and change its own data, the service’s secret keys are never in the app, and access to our systems is limited to those who need it to run Noba. No system is infallible, but we work to protect your data and, if a problem affected you, we would tell you.

10. Children

Noba is designed for adults and is not directed at children under 16. We do not knowingly collect data from children under that age; if we find out we have, we will delete it.

11. This website

nobaapp.com uses no cookies, no forms and no analytics or tracking tools. Our hosting provider logs technical data about each visit (such as the IP address) to serve the website and protect it from attacks.

12. Changes to this policy

If we change this policy, we will update the date at the top. If the change is significant, we will let you know in the app before it applies.

Any questions? Write to us at hola@nobaapp.com.