In force
Privacy Policy
What personal data we process and why, who we share it with, how long we keep it and your rights. Written for the EU General Data Protection Regulation (GDPR), the UK GDPR and Turkish Law No. 6698 (KVKK); people in Türkiye should also read the KVKK Privacy Notice.
- Version
- 2026-11-03
- Effective date
- (new customers)
(existing customers) - Published
- Provider
- Laten Lukken Yazılım Sanayi Ticaret Ltd. Şti.
- Contact
- support@workoutos.app
This version applies to customers who sign up from 3 November 2026 as soon as they sign up. For customers who accepted the earlier version 2026-10-29, it takes effect on 3 December 2026; until then the previous version applies to them. You can request the text of the previous version at support@workoutos.app.
Contents
1Who we are
Workout OS and Workout Studio are provided by Laten Lukken Yazılım Sanayi Ticaret Ltd. Şti. ("Laten Lukken", "we"), a company established in Türkiye. Our registered address is published in the Turkish Trade Registry Gazette; we send it straight away on request by e-mail. For any privacy question or request: support@workoutos.app.
EU and UK representative (Art. 27 GDPR and UK GDPR): as we are not established in the EU or the UK, a representative has to be appointed; once appointed, their name and contact details will be published here. Until then, people in the EU and the UK can send every request to support@workoutos.app.
We have not appointed a data protection officer (DPO); our processing is not of a scale or kind that requires one. All requests: support@workoutos.app.
2When we are the controller
Our role depends on whose data it is:
| Data | Our role |
|---|---|
| Website visitors, demo and contact requests, the early access list | Controller |
| Account data of owners, representatives and staff of subscribed businesses | Controller |
| Subscription, billing and records of acceptance of our terms | Controller (Polar is also an independent controller for payment data) |
| Member, client and staff records that businesses enter into the Service; the member and client apps | Processor. The business is the controller. |
This policy covers the first three rows. Member and client data is governed by the business's own privacy notice and its Data Processing Agreement with us. If you are a member of a gym or a client of a studio, please contact that business first; if you write to us, we will pass your request on to them.
3Data we collect
| From | Data |
|---|---|
| Website visitors | Server and security logs: IP address, browser details, requested address and time. No cookies or analytics tools are used. |
| Early access list and contact form | E-mail; optional name, type of business, city or country; your message; the text, version and time of your consent; an irreversible hash of your IP address |
| Demo requests | Name, business name, phone, e-mail, city, product of interest, member or client count range, your message |
| Account holders and panel users | Name, e-mail, phone, role, password hash, session and sign-in records, language preference, audit logs of actions in the panel |
| Subscription and billing | Business and billing name, country, tax ID (if you entered one at Polar), plan, subscription status and payment history. We never see card details; Polar and Stripe process them. |
| Acceptance of our terms | Which version of which document you accepted, when and how, your e-mail address, an irreversible hash of your IP address and browser details |
| Support | What you send us by e-mail and any attachments |
Sources: we get most data directly from you. We also receive payment and subscription status from Polar (billing name, country, payment result); if you were invited as staff, your name, e-mail and role come from the business owner who invited you.
Is it required? Account and billing data are needed for the contract; without them we cannot open the account or move it to a paid plan. Demo and early access details are optional; without them we only cannot answer that request.
4Purposes and lawful bases
| Purpose | GDPR Art. 6(1) | KVKK Art. 5 |
|---|---|---|
| Answering your demo or contact request, preparing an offer | Steps prior to a contract (b), legitimate interests (f) | Formation of a contract (2-c), legitimate interests (2-f) |
| Opening the account, providing the Service, support and essential service notices | Performance of a contract (b) | Performance of a contract (2-c) |
| Subscription and billing records, tax and commercial law | Legal obligation (c) | Legal obligation (2-ç) |
| Proving acceptance of our terms, establishing and defending legal claims | Legitimate interests (f) | Establishing and protecting a right (2-e) |
| Security, abuse prevention, error tracking, improving the Service | Legitimate interests (f) | Legitimate interests (2-f) |
| Early access and product news e-mails | Consent (a) | Explicit consent (1) and consent to commercial messages under Law No. 6563 |
The legitimate interests we rely on: protecting the Service and accounts against abuse, attacks and fraud; finding and fixing errors; understanding which parts of the Service are used, in aggregate and not linked to you, to improve the product; proving the contract through acceptance records; answering your demo request.
You can object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds. You can withdraw consent at any time with the link in every e-mail or by writing to us.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile you.
5Who we share data with
We do not sell data or share it for marketing. We share only what is needed to run the Service with:
- Our sub-processors bound by contract: hosting and database (Railway), transactional e-mail (Resend), error tracking (Sentry), website and business e-mail (Hostinger), app notifications (Expo); if you write to our Turkish WhatsApp support line, Meta Platforms Ireland Ltd. (WhatsApp)
- Polar, which collects all subscription payments as merchant of record and issues invoices; Polar is an independent controller for payment and invoicing data under its own privacy policy. Card data is processed by Polar and its payment processor Stripe.
- Public authorities and courts, where the law requires and only to the extent required
- In a merger or transfer of business, the acquiring party under the same safeguards
The full list of providers, their locations and transfer safeguards: Sub-processors.
6International transfers
Laten Lukken is established in Türkiye. The Service's database and servers run in the EU, in Railway's region in the Netherlands (Amsterdam); transactional e-mail is processed in Ireland and error logs in Germany. Some providers, such as Polar, Stripe and Expo, are located or headquartered in the United States.
- Transfers from the EU/EEA and the UK: as there is no adequacy decision for Türkiye, they rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK Addendum; for US providers, also on EU-US Data Privacy Framework certification where the provider has it
- Transfers out of Türkiye: Transfers rely on appropriate safeguards under Article 9 KVKK, the standard contracts published by the Personal Data Protection Board: a standard contract is signed with each recipient abroad and notified to the Board within 5 business days of signature.
- Supplementary measures: encryption in transit, encrypted storage of secret keys, data minimisation (for example, personal data is stripped from error logs) and restricted access
You can request a copy of the safeguards we use at support@workoutos.app.
7Retention
| Data | Period |
|---|---|
| Demo requests (if you do not become a customer) | 12 months after the last contact |
| Early access list | 12 months after launch, or until you withdraw consent, whichever comes first |
| Support and contact correspondence | 2 years after the request is resolved |
| Account data | While the account is open; deleted 90 days after the account is closed (unless deletion must be paused for a legal obligation, an authority's request or your written request) |
| Subscription and payment records | 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253) |
| Records of acceptance of our terms | 10 years after the contract ends (Turkish limitation period) |
| Session records (IP address, browser) | While the session is active; an unused session expires within 7 days at the latest. Expired session records are deleted, at the latest together with the account data. |
| Server logs | Up to 30 days |
| Error logs (Sentry) | Up to 90 days |
| Backups | Nightly backups 14 days, weekly backups 8 weeks; kept in the EU (Railway), expired backups are deleted |
When a period ends, data is deleted, destroyed or anonymised. Data deleted from the live system also disappears from backups as they expire, within 8 weeks at most.
8Security
- All connections are encrypted with TLS
- Businesses are isolated from each other with database row-level security
- Passwords are stored as irreversible hashes; payment and messaging keys are encrypted with AES-256-GCM. In records of acceptance of our terms and on the early access list, IP addresses are stored only as irreversible hashes; session records and server logs keep IP addresses for security
- Role-based access, audit logs in the panel, regular backups
- Personal data is stripped and masked before anything is sent to error tracking
- Our team's access is limited to what is needed, uses personal accounts and is bound by confidentiality
9Your rights
Depending on where you are, under the GDPR, UK GDPR or KVKK you have the right to:
- Access your data and get a copy
- Have inaccurate or incomplete data corrected
- Have your data erased
- Restrict processing
- Data portability
- Object to processing based on legitimate interests and to direct marketing
- Withdraw consent at any time where processing is based on consent
- Know the recipients of your data and claim compensation for unlawful processing (KVKK Art. 11)
Send requests to support@workoutos.app with enough information for us to verify your identity. We reply free of charge within 30 days. If you are not satisfied, you can complain to the data protection authority of the EU country where you live or work, to the ICO in the UK, or to the Turkish Personal Data Protection Board.
10Children
Our websites and business panels are not directed at children under 16; account holders and panel users must be over 18. We do not knowingly collect data from children.
Where a business serves minors as members or clients, the business is the controller of their data and is responsible for meeting legal requirements, including parent or guardian consent. The Service provides tools such as guardian consent forms for this.
11Cookies
Our marketing websites use no cookies. The panels use only strictly necessary cookies that keep you signed in. Details: Cookie Policy.
12Changes
When we update this policy we change its version and date. We announce material changes to customers at least 30 days in advance by e-mail or in-panel notice.