Effective date: 4 October 2026
ViaVia UG (haftungsbeschränkt) (“ViaVia”, “we”, “us”, “our”) operates the Charles mobile application (“Charles”, “the App”) and the website getcharles.pro (“the Website”). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Charles or visit the Website.
Charles is an AI-powered strength training application. We take the protection of your personal data seriously and comply with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and all other applicable data protection laws.
When you first visit the Website, analytics services are disabled.
You can choose “Accept analytics” or continue with necessary storage
only. Your choice is stored locally in your browser under
charles_consent_v1 so that we can remember it. This
preference is strictly necessary to provide the privacy choice you
requested and remains until you change it or clear your browser
storage.
If you consent, we process Website analytics under Art. 6(1)(a) GDPR and access or store analytics information on your device based on your consent under Section 25(1) TDDDG. You can withdraw consent at any time using the “Privacy settings” control shown on every page. Withdrawal does not affect processing that occurred before withdrawal. When you withdraw, the Website disables future analytics collection and removes analytics cookies and local analytics data that it can identify.
Advertising storage, advertising user data and advertising personalisation remain disabled even when you accept analytics. We do not use Website analytics consent for personalised advertising.
| Service | Purpose and data | Browser storage | Provider |
|---|---|---|---|
| Google Analytics 4 | Visits, page views, engagement, traffic sources, approximate location, browser and device information | _ga and _ga_* cookies, with a default
expiry of up to two years |
Google Ireland Limited / Google LLC |
| PostHog | Pseudonymous usage events, session information, browser, device and operating system information | ph_* cookies or local browser storage |
PostHog Inc.; EU data region selected |
| Vercel Web Analytics | Aggregated page views, referrers, coarse location, browser, device and operating system information | No third-party cookies; Vercel uses a request-derived daily hash | Vercel Inc. |
| Vercel Speed Insights | Real-user performance information, including Core Web Vitals and page paths | No advertising storage configured by us | Vercel Inc. |
Google and Vercel may process data in the United States. Where required, transfers are protected by applicable safeguards such as the EU-US Data Privacy Framework and Standard Contractual Clauses. Google Analytics user-level and event-level retention is controlled in the Google Analytics property settings. We configure Google signals and ad personalisation signals as disabled in the Website tag.
Provider information: Google Privacy Policy, PostHog Privacy Policy, and Vercel Privacy Policy.
The controller responsible for the processing of your personal data is:
ViaVia UG (haftungsbeschränkt) Marchgrabenplatz 4 80805 München, Germany
Commercial Register: Amtsgericht München, HRB 308987 Managing Director: Klemen Kocic Email: info@viavia.travel
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for ViaVia UG is:
Bayerisches Landesamt fur Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach, Germany Phone: +49 981 180093-0 Email: poststelle@lda.bayern.de Website: https://www.lda.bayern.de
| Data | Source | Legal Basis |
|---|---|---|
| Email address | Provided by you or via Apple/Google Sign-In | Art. 6(1)(b) GDPR (contract performance) |
| Display name | Apple or Google Sign-In (if available) | Art. 6(1)(b) GDPR (contract performance) |
| Authentication tokens | Generated during sign-in | Art. 6(1)(b) GDPR (contract performance) |
| Data | Source | Legal Basis |
|---|---|---|
| Age range | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Training experience and history | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Movement capability (squat, hinge, push, pull) | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Injury information | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Training location and equipment | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Training frequency preference | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Focus areas (accessory preferences) | Provided during onboarding assessment | Art. 6(1)(b) GDPR (contract performance) |
| Data | Source | Legal Basis |
|---|---|---|
| Training plans generated by Charles | Generated by AI based on your assessment | Art. 6(1)(b) GDPR (contract performance) |
| Workout session logs (exercises, sets, reps, weights, duration) | Recorded by you during workouts | Art. 6(1)(b) GDPR (contract performance) |
| Session feedback and exercise flags | Provided by you after workouts | Art. 6(1)(b) GDPR (contract performance) |
| Exercise preferences (avoid/prefer) | Inferred from your feedback or set by you | Art. 6(1)(b) GDPR (contract performance) |
| Health condition tracking | Derived from session feedback patterns | Art. 6(1)(b) GDPR (contract performance) |
| Data | Source | Legal Basis |
|---|---|---|
| Subscription status and plan type | RevenueCat (synced from App Store/Play Store) | Art. 6(1)(b) GDPR (contract performance) |
| Trial start date | Recorded at account creation | Art. 6(1)(b) GDPR (contract performance) |
We do not store or have access to your payment card details. All payment processing is handled by Apple (App Store) or Google (Play Store).
| Data | Source | Legal Basis |
|---|---|---|
| Device type and operating system | Collected automatically | Art. 6(1)(f) GDPR (legitimate interest: app stability) |
| App version | Collected automatically | Art. 6(1)(f) GDPR (legitimate interest: app stability) |
| Crash reports and stack traces | Firebase Crashlytics | Art. 6(1)(f) GDPR (legitimate interest: app stability) |
| Pseudonymous usage analytics (events keyed by your Supabase user UUID; no email, no name) | PostHog | Art. 6(1)(f) GDPR (legitimate interest: product improvement) |
In each training phase you can book one optional video call with our coach. Coach calls are only for athletes aged 18 or over. If you book a call, we process the following data.
| Data | Source | Legal Basis |
|---|---|---|
| Name and email address | Taken from your account and filled in on the booking page | Art. 6(1)(b) GDPR (contract performance) |
| Charles user ID and phase ID | Added to the booking link by the App | Art. 6(1)(b) GDPR (contract performance) |
| Anything else you enter on the booking page | Provided by you on Cal.com | Art. 6(1)(b) GDPR (contract performance) |
| Booking details (Cal.com booking ID, start and end time, status: booked or cancelled, Google Meet link) | Sent to us by Cal.com when you book, move or cancel a call | Art. 6(1)(b) GDPR (contract performance) |
| Call transcript, only if you agree at the start of the call | Made by Google Gemini during the call and kept in our Google Workspace account, not in the App or its database | Art. 9(2)(a) GDPR (explicit consent) |
| Changes to your plan and your data made in the call, each with the reason for it | Entered by our coach during or after the call | Art. 6(1)(b) GDPR (contract performance) |
How a call works. The booking page is run by Cal.com and opens inside the App. Cal.com sends you a confirmation and reminders by email. It also adds the call to our coach’s Google Calendar with a Google Meet link. The call takes place on Google Meet. We do not make a video recording of the call.
Transcripts. At the start of each call, our coach asks whether he may make a transcript, which is a written record of what is said. You give or refuse your consent by telling him in the call. If you say no, no transcript is made and the call goes on as normal. If you say yes, Google Gemini makes the transcript through our Google Workspace account. It is kept in that Google Workspace account, not in the Charles App or its database. Our coach uses it right after the call to check and complete the changes to your plan. We delete it at the latest 7 days after the call. You can withdraw your consent at any time, by telling our coach in the call or by writing to info@viavia.travel. We then delete the transcript straight away. Withdrawal does not affect processing that took place before it.
Health data. In a call you may tell us about injuries, pain, medical conditions or what you eat. This is health data, a special category of personal data under Art. 9 GDPR. A transcript can contain it, and so can the reason our coach saves with a change to your plan. We use it only to coach you, to adjust your plan, and to improve Charles as described in the next paragraph. We never use it for advertising and never sell it.
How calls help Charles improve. Each change our coach makes with you in a call is saved with the reason for it. We use these changes, across all athletes, to improve how Charles builds plans for everyone. A change made for you can help Charles build a better plan for someone else. Some of these changes contain health data, for example a change made because of an injury. You give your consent to this use (Art. 6(1)(a) and Art. 9(2)(a) GDPR) when you create your account and accept our Terms of Service and this Privacy Policy. If you already had an account before 4 October 2026, we told you about this change before that date. You can withdraw this consent at any time by writing to info@viavia.travel. We then stop using your changes to improve Charles for other athletes, and you can still book calls. Withdrawal does not affect use that took place before it.
If you choose to connect Apple Health (iPhone) or Health Connect (Android) in the App, Charles reads one summary value per day for:
On iPhone, Charles also reads the workouts you record in other apps, such as a run or a football match, so that training outside Charles appears in your calendar. For each one we keep only the kind of activity, sorted into seven broad groups, when it started and ended, and the energy burned if it was recorded. We never read routes, heart rate during the workout, distance or steps.
Charles also writes your finished strength sessions to Apple Health or Health Connect, so they count in your activity overview. On iPhone this includes the energy burned.
This is health data, a special category of personal data under Art. 9 GDPR. We process it only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you connect Apple Health or Health Connect in the App. It is stored in our database in the EU and on your device. When you ask Charles in the chat about recovery, sleep or body weight, your stored daily summaries are sent to Google Gemini to answer you (see section 5). Health data is never sent to our analytics or crash reporting providers, never used for advertising and never sold.
You can withdraw your consent at any time by disconnecting in the App. Charles then stops reading and writing health data and deletes the daily summaries and imported workouts we have stored. Workouts you entered by hand stay in your training log. Access you granted in your phone’s settings stays until you remove it there.
In the chat, for example when you tell Charles how a session went, you can tap the microphone button and speak instead of typing. The microphone is on only while dictation is running, from your tap until you stop it.
Your speech is turned into text by the speech recognition built into your phone: Apple’s on iPhone, Google’s on Android. When you are online, your phone may send the sound to Apple or Google to do this. When you are offline, it happens on your phone. This is governed by Apple’s (https://www.apple.com/legal/privacy/) and Google’s (https://policies.google.com/privacy) privacy policies. We never receive, store or send the sound, and no recording is saved to a file.
We only receive the text, which you can read and change before you send it. Once sent, it is handled exactly like a typed message in the chat (see section 5, Google Gemini). The legal basis is contract performance (Art. 6(1)(b) GDPR). The microphone permission is optional, and typing always works.
We do not collect:
We process your personal data for the following purposes:
Providing the service (Art. 6(1)(b) GDPR): Generating personalised training plans based on your assessment, tracking your workout progress, adapting your programme over time, and managing your subscription.
AI-powered plan generation and chat (Art. 6(1)(b) GDPR): Your assessment data and training history are sent to Google Gemini API to generate and refine your training programme. Only the data necessary for plan generation is transmitted: age, movement capabilities, training history, frequency, focus lifts, injury/pain information, and equipment. When you write to Charles in the chat, your message and the training data needed to answer it are sent to Gemini too. Your name and email address are not sent to Gemini.
App improvement (Art. 6(1)(f) GDPR): Analysing pseudonymous usage patterns (events keyed by your Supabase user UUID) to improve features and fix issues. Your email address and name are not sent to our analytics provider. Our legitimate interest in providing a stable, high-quality application does not override your fundamental rights and freedoms.
Crash reporting (Art. 6(1)(f) GDPR): Collecting crash reports and performance data to identify and fix bugs. Our legitimate interest in maintaining app stability does not override your fundamental rights and freedoms.
Trial notifications (Art. 6(1)(a) GDPR): Sending local, on-device reminder notifications about your free trial period. These notifications are processed entirely on your device and do not transmit data to our servers.
Legal compliance (Art. 6(1)(c) GDPR): Retaining purchase records as required by German tax law.
Coach calls (Art. 6(1)(b) GDPR; Art. 9(2)(a) GDPR for transcripts): Booking and holding your optional coach call, making a transcript if you agree, and changing your plan with you. See section 3.6.
Improving Charles for all athletes (Art. 6(1)(a) and Art. 9(2)(a) GDPR, your consent): Using the changes our coach makes in calls, and the reasons for them, to improve how Charles builds plans for every athlete. See section 3.6.
Apple Health and Health Connect (Art. 9(2)(a) GDPR, your explicit consent): Reading your daily recovery and body summaries and your outside workouts, and writing your Charles sessions back, if you connect. See section 3.7.
We use the following third-party services, which process personal data when you use Charles. For Supabase, the Google Gemini API, Google Workspace and LangChain, data processing terms under Art. 28 GDPR are part of the provider’s service terms that we have accepted.
| Data Type | Retention Period | Legal Basis for Retention |
|---|---|---|
| Account data | Until account deletion + 30 days | Account recovery window |
| Assessment data | Until account deletion | Required for service provision |
| Training data (plans, sessions, sets) | Until account deletion | Required for service provision |
| Health conditions and exercise preferences | Until account deletion | Required for service provision |
| Subscription and purchase records | 10 years after transaction | German tax law (AO ss 147) |
| Crash reports | 90 days | Bug fixing (legitimate interest) |
| Anonymised analytics data | 12 months | Product improvement (legitimate interest) |
| Server logs (IP addresses) | 7 days | Security and abuse prevention (legitimate interest) |
| Coach call bookings (booking ID, time, status, meeting link) | Until account deletion | Required for service provision |
| Changes made in a coach call, with their reasons | Until account deletion | Required for service provision |
| Call transcripts (kept in our Google Workspace account) | At most 7 days after the call, or until you withdraw your consent if that is sooner | Your explicit consent |
| Daily health summaries from Apple Health or Health Connect | Until you disconnect or delete your account | Your explicit consent |
| Workouts imported from Apple Health | 180 days (older ones are deleted the next time the App syncs), or until you disconnect or delete your account | Your explicit consent |
After account deletion: When you delete your account through the App, we permanently delete all your personal data (account data, assessment data, training data, health conditions, exercise preferences, health summaries, imported workouts, coach call bookings and changes made in coach calls) within 30 days. Data subject to legal retention obligations (purchase records) is retained for the legally required period and then deleted. Anonymised data that can no longer be attributed to you may be retained for statistical purposes.
You have the following rights regarding your personal data:
Right of access (Art. 15 GDPR): You may request confirmation of whether we process your personal data, and if so, request a copy of that data along with information about the processing.
Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate personal data or the completion of incomplete data.
Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data (“right to be forgotten”). You can delete your account directly in the App under Account settings, which triggers immediate deletion of your data (subject to legal retention periods).
Right to restriction of processing (Art. 18 GDPR): You may request that we restrict the processing of your personal data in certain circumstances (e.g., while we verify the accuracy of contested data).
Right to data portability (Art. 20 GDPR): You may request to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller.
Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests (Art. 6(1)(f) GDPR) at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.
How to exercise your rights: Contact us at info@viavia.travel. We will respond within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests (Art. 12(3) GDPR). We will inform you of any such extension within one month.
We will verify your identity before processing any rights request. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.
Some of the services we use are based in the United States. Transfers of personal data outside the European Economic Area (EEA) rely on the following safeguards:
We implement appropriate technical and organisational measures to protect your personal data in accordance with Art. 32 GDPR, including:
Charles is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are under 13, please do not use the App or provide any personal data.
For users aged 13 to 15: Under the GDPR, the processing of personal data of a child below the age of 16 based on consent requires the consent of the holder of parental responsibility (Art. 8 GDPR). Germany applies an age threshold of 16 for consent-based processing. For processing based on contract performance (Art. 6(1)(b) GDPR), users aged 13 and older may use the App with parental awareness.
Coach calls (section 3.6) are only for athletes aged 18 or over.
If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will delete that data promptly. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at info@viavia.travel.
Charles uses AI (Google Gemini) to generate personalised training plans based on your assessment data. This constitutes automated decision-making within the meaning of Art. 22 GDPR. However, the training plans generated are recommendations only and do not produce legal effects or similarly significantly affect you. You are free to modify exercises within your plan and provide feedback to adjust future recommendations. In an optional coach call, a person, our coach, reviews your plan with you and can change it.
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. We will notify you of material changes through the App or by email before the changes take effect. The effective date at the top of this document indicates the most recent revision.
We recommend reviewing this Privacy Policy periodically. Continued use of the App after changes take effect constitutes your acknowledgement of the updated policy.
For any questions about this Privacy Policy, your personal data, or to exercise your rights:
ViaVia UG (haftungsbeschränkt) Marchgrabenplatz 4 80805 München, Germany Email: info@viavia.travel