Privacy policy

Last updated: 13 November 2026

This policy explains what data GYMO AI (the “Service”) processes, why, who receives it and how you can control it. The data controller is [configura GYMO_TITULAR] (contact: [configura GYMO_CONTACTO_EMAIL]).

1. Data we process

• Telegram account: your Telegram ID, time zone, usage profile and the assistant name you choose.
• Content you send: text messages, voice notes and photos, used to answer you. The conversation is kept in temporary server memory (about 2 hours) and is not stored in the database. Photos and audio are processed and deleted.
• Data you choose to save: your personal tables, workout log and projects, kept until you delete them.
• Usage: counters (messages per day, most-used topics and tools, hours) to apply usage limits and improve suggestions. These counters never contain the content of your messages.
• Plan and promo codes: your plan, its expiry date and the codes you redeemed.

2. Google user data

If you connect your Google account with /conectar, we request only these permissions:

• Google Calendar (calendar.events): read, create and edit events in your calendar when you ask the assistant to.
• Gmail (gmail.send): send an email from your account only when you ask for it and confirm with a button. We do not read your inbox.
• Account email and ID (openid, email): to show which account is connected.

How we use it: only to carry out the action you request. We store your access token encrypted; we do not store your calendar events or your emails. To write the answer, the content of the events you query may be sent temporarily to the AI provider listed below.

We do not sell your data, use it for advertising, or use it to train AI models, and no human reads it unless needed for security, to comply with the law, or with your consent.

3. Who receives data

Only providers needed to run the Service, acting on our behalf: Telegram (messaging), Render (hosting), Supabase (database), Groq (language models, voice transcription and image analysis), Tavily (web search; receives the search text) and Google (Calendar and Gmail). Some are located outside the European Economic Area and rely on safeguards such as standard contractual clauses.

4. Retention and deletion

• Send /borrar_mis_datos to the bot to delete all your data from the Service and revoke Google access.
• Send /desconectar_calendario to revoke only the Google connection.
• You can also remove access at myaccount.google.com/permissions.
• If you stop using the Service for a long period, we may delete your data.

5. Security

Encryption in transit (HTTPS), Google tokens encrypted at rest, restricted database access, and secrets kept in environment variables, never in code.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [configura GYMO_CONTACTO_EMAIL]. You may also lodge a complaint with your data protection authority (in Spain, the AEPD). The legal basis is performance of the service you request and your consent to connect Google.

7. Children

The Service is not directed to children under 14.

8. Changes

If we change this policy we will update the date and, for important changes, notify you in the bot.