Privacy Policy

This Privacy Policy describes how Povver collects, uses, stores, and shares your personal data when you use the Povver mobile application and website (together, the "Service"). The Service is operated by BVA Technologies Oy (trading as Povver), a limited liability company registered in Finland (Business ID: 3629043-3).

By creating an account or using the Service, you consent to the practices described in this policy, including the processing of health-related data as described in Section 3.

1. Data Controller

Povver is the data controller for the personal data processed through the Service. This means we determine the purposes and means of processing your data.

BVA Technologies Oy
Business ID: 3629043-3
Lupajantie 1 F 16, 00970 Helsinki, Finland
Email: info@povver.ai

2. What We Collect

2.1 Account Information

When you create an account, we collect your email address, display name (if provided), and authentication credentials. Authentication is handled by Firebase Authentication, with sign-in by email, Sign in with Apple, or Google Sign-In — we do not store passwords directly.

If you sign in with Google, Google gives us your name, your email address and basic profile information such as a profile picture link. We use your name and email address to create and identify your account, to send service notifications and to answer support requests (Section 4). We do not use the picture link. We do not use any of this for advertising, and only the providers in Section 6 process it for us.

2.2 Workout and Training Data

The core of the Service involves recording your training. This includes exercises performed, sets, repetitions, weights, reps in reserve (RIR), rest times, workout dates, durations, personal notes, templates, routines, and training programs. This data may reveal information about your physical capabilities and health status, and we treat it accordingly (see Section 3).

Profile data: your height, bodyweight, training goal, experience level, available equipment, timezone, and language. Bodyweight is used in the analysis (see Section 5.4), and we treat it as health-related data.

2.3 AI Coaching and Analysis Data

When you interact with the AI coach, we process the messages you send, the responses generated, and the workout context used to produce those responses. Your workout history and performance trends are provided to the AI model so it can generate personalized coaching. See Section 5 for details on how AI processing works.

After each workout, we run a background analysis that computes training metrics from your session — such as estimated strength levels, training load, and volume trends across muscle groups. These computed metrics are stored alongside your workout data and used to generate coaching recommendations. See Section 5 for details.

The AI coach may also store notes about your preferences, equipment, and training context (such as injuries you've mentioned or exercises you prefer) so it can provide continuity across conversations. You can view and delete these notes at any time through the app.

Photos you attach: you can attach a photo to a message to the coach, taken with your camera or chosen from your photo library. The app accesses the camera or photo library only when you choose to attach a photo. Attached photos, and the description the AI model writes of them, are stored with your account and sent to our AI model provider (Anthropic or Google Vertex AI) so the coach can read them.

We also use the AI model to write a short title and summary for each coaching conversation, which are stored with the conversation.

2.4 Device and Usage Data

We automatically collect device type, operating system version, app version, feature usage patterns, interaction events, crash reports, and performance diagnostics. We also store a per-app device identifier (Apple's identifier for vendor) and the device name set in your iPhone's settings with your account. For analytics we collect country-level location, not precise GPS coordinates. Section 2.11 describes how the app uses your location to find your gym.

2.5 Payment Data

All subscription payments are processed by Apple through the App Store. We do not collect or store your payment card details, billing address, or financial information. We receive only a transaction confirmation and subscription status from Apple.

2.6 App Store Ad Attribution

On first launch, and on later launches until Apple has answered, the app gets an attribution token from Apple, and our server asks Apple whether an Apple Search Ads ad led to the install. If one did, Apple returns the campaign, ad group, keyword, and ad, the country, and the date of the tap. None of this contains your name, email address, or an advertising identifier. For every install we also store an install identifier and the time of first launch. We store the attribution with your account and in our analytics warehouse to measure which ads work.

2.7 Feedback and Support

When you send feedback from the app or email us, we store your message, your contact email address, your account email and identifier, and the app version, and receive them in our support inbox (Google Workspace).

2.8 Analytics and Diagnostics

In the app: We use Google Firebase Analytics to understand how features are used (for example, which screens you visit and which actions you take), Firebase Performance Monitoring to measure how fast the app responds, and Google Firebase Crashlytics to detect and diagnose crashes and errors. These tools collect your account identifier, device type, operating system version, app version, interaction events, and diagnostic data, and process it on Google's infrastructure to help us keep the app stable and improve it. You can opt out of app analytics and performance monitoring at any time in the app's settings, and doing so does not affect any other functionality. Crash reports are always sent, because we need them to fix crashes. Firebase App Check, using Apple's App Attest, confirms that requests come from a genuine copy of the app.

On our website: povver.ai uses Google Analytics 4 to collect anonymized usage data such as page views, referral sources, and device information. Until you accept the cookie banner, and if you decline it, the analytics tag runs in consent mode: it sets no cookies and stores no identifier, and sends only cookieless pings (for example that a page was viewed) that carry no persistent identifier, cannot be linked to you across visits, and are used only in aggregate. If you accept, Google Analytics sets its cookies so that visits can be counted per visitor. You can withdraw consent at any time by clearing this site's data in your browser, after which the banner is shown again.

2.9 Data We Do Not Collect

We do not collect biometric identifiers or biometric information (such as fingerprints, facial geometry, voiceprints, or retina scans). We do not collect your precise location: the app uses it on your phone only, and stores only the gyms you confirm (see Section 2.11). We do not access your microphone or contacts. We access your camera and photo library only when you choose to attach a photo (see Section 2.3).

2.10 Imported Workout History

You can bring your training history from another app, such as Strong, Hevy or Fitbod, by uploading the export file that app gives you (CSV, TSV, TXT or JSON, up to 20 MB). Import works with or without a subscription. The AI steps below run only when you start an import.

What the file contains: usually the date of each workout, workout and exercise names, sets, repetitions, weights, durations, distances, effort ratings, and any notes you wrote in the other app. We treat it as health-related data, like the workouts you log in Povver (see Section 3). Your notes are not added to the workouts you import.

How we process it: our servers in the EU (Google Cloud, Europe) read the file and turn it into workouts. If we do not recognize the file's layout, we send a sample of it to our AI model provider (Anthropic or Google Vertex AI) so the model can tell us which column holds what. The sample has the column names and up to 50 rows, with the columns we recognize as notes removed and long values shortened. It also includes any description of the file you type in the app. Exercise names we cannot match on our own are sent to the model, which works out what each name means (for example a shortened name, or one in another language) and picks the closest exercise from our catalog. After the import, the model writes the short summary sentences you see, based on figures we have already calculated. Section 5.6 applies to these requests too.

Imported workouts: when you confirm the import, the workouts become part of your workout history. We store, use and delete them in the same way as workouts you log in Povver.

The file you uploaded: we keep a copy of the original file in Cloud Storage for Firebase, in the United States, for up to 90 days after you upload it, and then delete it. Real files let us run our importer again and fix what it reads wrong. If you cancel an import before its preview, we delete the file then. If we cannot read a file at all, we keep a copy of it for up to 90 days so we can learn to read that format. Only we can open it, and it is never shown to other users. A record of each import, such as its file name, size and summary, stays with your account until you delete your account.

Removing an import: in the app, open Profile > Imported history and remove the source. This deletes the workouts that source brought in, the file you uploaded, and the workout data we read from it. Workouts you logged in Povver are not affected, and neither is a training plan we already built for you from the import. Deleting your account also deletes every imported workout and file.

2.11 Your Gym

When you start a workout, Povver can tag it with the gym you are at. This lets it treat a session on another gym's machines differently, so a lighter weight on an unfamiliar machine is not read as lost strength. The first time, the app asks for permission to use your location while you use the app. If you say no, you can pick one of your gyms from a list, type a gym's name, or start without a gym.

Your location stays on your phone. When you start a workout, the app reads your position once. On your phone, it compares that position with the gyms you have used before. Only if you are somewhere new does the app send the position to Apple Maps to find gyms nearby; Apple handles that request under Apple's privacy policy. We never receive or store your own position, and the app does not track your location in the background.

What we store: for each gym you confirm, its name and, when it came from Apple Maps, Apple's identifier for the place and its public position, rounded to about 11 metres. Each workout stores only an internal identifier for its gym. A gym's position can still be personal data: if you train at home, it is your home's position, and together with your workout dates it shows where and when you train.

Who sees it: your gyms are stored with your account, and only you and our servers can read them. Povver's AI coach and AI assistants you connect (Section 5.5) can see the name of the gym a workout was logged at. Our analytics warehouse holds only the internal gym identifier, never a gym's name or position. Your gyms are included when you export your data and deleted when you delete your account. You can turn off location for Povver at any time in your iPhone's settings.

2.12 Apple Health

Apple Health is off until you turn it on, and Povver reads nothing from it before then. When you turn it on, a consent screen comes first. There you confirm that you are 18 or older and agree to what this section describes. Then iOS asks for its own permission.

What Povver reads and saves: sleep, heart rate variability, resting heart rate, body weight, body fat, workouts (including ones your watch or another app recorded), heart rate, steps and active energy. Each type has its own switch. Povver saves each reading as Apple Health gives it: its time and time zone, whether you entered it yourself, the details Apple Health keeps with it, and the name of the app or device that recorded it, such as your Apple Watch. For a workout, those details include its type, duration, calories, distance and heart rate.

What Povver writes: a separate switch lets Povver add your Povver workouts to Apple Health, so they show up in Fitness. Each one goes in as a strength training workout with its start and end time and how many exercises, sets and reps you did. Povver adds no weights, calories or heart rate.

When it syncs: your iPhone sends new readings to Povver when you open the app. While your iPhone is unlocked, it also syncs in the background, and when Apple Health gets new data.

What it is used for: Povver stores your Health data and shows you whether it is syncing. In this version it does not use it to shape your training. We never use it for advertising or marketing, and we do not sell it or share it with anyone. It does not go to the AI coach, to our AI model providers (Section 5), or to AI assistants you connect (Section 5.5). It is not in our analytics warehouse, Google Analytics or crash reports. If Povver ever uses it for something new, it will ask for your consent first.

Where it lives: your Health data is stored in the EU (Google Cloud, Europe), and our servers in the EU read and write it. Only a request to delete or export your account runs on our servers in the United States (Section 7).

How long Povver keeps it:

Heart rate, steps and active energy: about 90 days from the day the reading was recorded, then deleted automatically.
Sleep, heart rate variability, resting heart rate, body weight, body fat and workouts: about 2 years from the day of the reading, then deleted automatically.
Povver also limits how much it keeps for each person. Over the limit, it deletes the oldest heart rate, steps and active energy first. It never deletes the other types to stay under it.
Backup copies are erased within 35 days of deletion (Section 8).

Turning it off and deleting it:

Turn off a type in Povver. Povver stops reading it and deletes it after 30 days. Turn it back on within 30 days and nothing is lost.
Tap "Delete my Health data now". Povver turns every type and the Fitness switch off, ends your consent, and deletes the data, normally within a day. We keep a record that you agreed and when. To connect again, you agree again.
Stop Povver from reading Apple Health in the iPhone Settings app, under Health, Data Access & Devices.
Delete your Povver account. Your Health data is deleted with it, and Povver removes the workouts it added to Apple Health from the iPhone you delete the account on.
Workouts Povver added to Apple Health stay there if you only turn the Fitness switch off or delete your Health data, or if you have stopped Povver from writing to Health in the iPhone Settings app. You can delete them in Health.

The legal basis is your explicit consent (Section 3). Turning off a type or deleting your Health data withdraws it, at any time.

3. Legal Basis for Processing

We process your data under the following legal bases, as required by the GDPR and other applicable privacy laws:

Contractual necessity (GDPR Art. 6(1)(b)) — processing that is necessary to provide the Service you signed up for, including storing your workouts, generating AI coaching, computing training metrics, and delivering personalized recommendations.
Explicit consent for health-related data (GDPR Art. 9(2)(a)) — workout data may reveal information about your physical health, fitness level, and physical capabilities. We treat your training data as sensitive personal data and process it only with your explicit consent, which you provide when you create an account and begin logging workouts. The App Store also discloses our Health & Fitness data collection before you download the app.
Explicit consent for Apple Health data (GDPR Art. 9(2)(a)) — if you connect Apple Health (Section 2.12), we process the data you connect on your explicit consent. You give it on its own screen, apart from the consent above, where you also confirm you are 18 or older. You can withdraw it at any time.
Consent for advertising measurement (GDPR Art. 6(1)(a)) — where we share limited data to measure advertising or offer relevant promotions (see Section 4), we do so on the basis of your consent, which you can decline or withdraw at any time.
Legitimate interest (GDPR Art. 6(1)(f)) — service improvement based on aggregated usage patterns, security monitoring, fraud prevention, and measuring which of our App Store ads led to an install (Section 2.6). We balance these interests against your privacy rights and only process what is necessary.
Legal obligation (GDPR Art. 6(1)(c)) — where required by applicable law, such as responding to lawful requests from authorities.

Withdrawing Consent

You can withdraw your consent at any time:

Advertising consent — where advertising measurement relies on your consent, you can decline or withdraw it at any time, and the Service continues to function identically.
Apple Health consent — turn off any type in the app, or delete your Health data now (see Section 2.12).
Health-related data consent — you can stop AI processing of your data by letting your subscription end. The coach and AI analysis stop, while logging and your workout history remain. History import uses AI on any plan, and only when you start an import (see Section 2.10). To withdraw consent for all data processing, you can delete your account, which triggers deletion of your personal data within 30 days (see Section 8).

Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

4. How We Use Your Data

Providing the Service — storing your workouts, generating AI coaching recommendations, tracking your training progress, and building personalized programs.
AI Coaching and Analysis — your workout history and messages to the AI coach are sent to our AI model provider (Anthropic or Google Vertex AI) to generate responses. After each workout, we also run a background analysis to compute training metrics (such as estimated strength, muscle-specific volume, and fatigue trends) and generate personalized recommendations. If you enable Auto-Pilot, low-impact recommendations (such as small weight increases) may be applied to your training templates automatically. You can disable Auto-Pilot at any time. See Section 5 for details.
Service Improvement — analyzing anonymized usage patterns, identifying bugs, and developing new features. We do not use your individual workout data for this purpose without anonymization.
Communication — sending service-related notifications and responding to support requests. We will only send marketing communications with your explicit opt-in consent.
Security and Fraud Prevention — detecting and preventing unauthorized access, abuse, or other harmful activity.
Legal Compliance — meeting our obligations under applicable law, including responding to lawful requests from authorities.

We do not sell your personal data. We do not share your personal data with third parties for their own independent marketing purposes.

Advertising and measurement: We promote Povver through advertising platforms such as Apple Search Ads and Reddit. We do not send your personal data to these platforms. We do receive Apple's install attribution described in Section 2.6. In the future, we may introduce privacy-preserving measurement or offer relevant promotions — for example, by sharing hashed identifiers that cannot be read as your real name or email. If we do, it will be only with your consent where required, we will update this policy beforehand, and we will never share your name, email address, workout data, conversation history, or any health-related information with advertising partners.

5. How AI Processing Works

Povver uses AI to provide coaching, post-workout analysis, and program generation. The AI coach is an automated system, not a human. When you send messages to the AI coach, those messages are transmitted to our third-party AI model providers (Anthropic or Google Vertex AI) for processing. By using the AI coaching features, you acknowledge and consent to this transmission.

5.1 Real-Time Coaching

When you chat with the AI coach, your message, any photo you attach, and relevant training context (such as your recent workouts, your current program, and active workout state) are sent to our AI model provider (Anthropic or Google Vertex AI) to generate a response. We do not routinely review individual conversations; access is limited to authorized personnel and only for security, debugging, abuse prevention, or legal compliance.

5.2 Post-Workout Analysis

After you complete a workout, Povver runs a background analysis. This process works in two stages:

Deterministic computation: We calculate training metrics directly from your workout data — such as estimated strength levels per exercise, training load ratios, and volume per muscle group. This stage does not involve AI and runs entirely on our infrastructure.
AI-powered assessment: After every workout during your trial or subscription, the session's sets, repetitions, weights, reps in reserve, and your session notes are sent to our AI model provider (Anthropic or Google Vertex AI), with the computed metrics, to write your post-workout summary. If the analysis detects meaningful signals (such as a strength plateau, elevated fatigue, or a progression opportunity), the metrics are also used to generate specific recommendations.

5.3 Automatic Recommendations (Auto-Pilot)

You can enable Auto-Pilot, which allows the system to automatically apply low-impact recommendations to training templates — such as small weight increases when you've consistently hit your targets. Weight increases, small rep increases, most deloads, and moving your plan to its next phase (which can change set counts) can be applied automatically. Exercise swaps, added exercises, standalone volume adjustments, and rep-range changes are always presented for your review. You can disable Auto-Pilot at any time, and all automatic changes are logged and visible in the app.

Auto-Pilot recommendations are based on your logged training data and general exercise science principles. They do not account for injuries, pain, illness, or day-to-day physical condition that you have not reported to the coach. You are responsible for evaluating whether any recommendation — automatic or otherwise — is appropriate for your current condition.

5.4 Data Derived from Your Workouts

We compute and store the following data from your workouts to power coaching and analysis:

Estimated one-rep maximum (e1RM) per exercise
Weekly training volume and intensity per muscle group
Fatigue and recovery status (based on workload ratios)
Progression and plateau detection
Bodyweight trend (from your profile)
A training profile that reflects your learned preferences (such as how aggressively you prefer to increase weight)

This derived data is stored alongside your workout data, is subject to the same protections, and is deleted when you delete your account.

5.5 External AI Integrations (MCP)

Subscribers can optionally connect external AI tools — such as Claude — to their Povver data through the Model Context Protocol (MCP). When you connect an external tool, it can read your profile, workout history, training programs, and analysis data to provide additional coaching or insights, and — acting on your behalf — make changes to your training.

You control which tools are connected and can revoke access at any time through the app.
In addition to reading your data, connected tools can make changes on your behalf: create, edit, and delete routines and workout templates; set or pause a periodization plan; record injury notes; and delete a logged workout. Tools that delete or overwrite data are marked as such so the assistant asks before making destructive changes.
You can also create API keys for scripts and clients that cannot sign in through a browser. A key has the same access as a connected tool, and you can revoke it at any time in the app.
All changes made by external tools are recorded in a change log attributed to the tool. Contact us for a copy.
We are not responsible for how external AI tools process your data once it leaves our servers. Review the privacy policy of any tool you connect.

5.6 AI Provider and Data Use

AI Model Providers: We use Anthropic to run its Claude models and Google Vertex AI (operated by Google LLC) to run Google's Gemini models. They power the coaching and analysis features. Which of the two handles a request can change, so we name both. Requests are processed on the providers' global infrastructure, which may be outside the EU, including in the United States.
Data retention by the AI providers: Under our agreements, data sent to Anthropic or to Google Vertex AI for inference is not used by them to train or improve their models. Google's data processing terms apply to Vertex AI. Anthropic keeps the inputs and outputs of our requests in the United States and deletes them within 30 days of receiving them. It may keep them longer only where needed to enforce its usage policy or to comply with the law.
No third-party model training: Your personal workout data is never used to train AI models — not by us, and not by our AI providers.

6. Third-Party Data Processors

We use the following third-party services to operate the Service. Each processes data on our behalf, under data processing agreements, and subject to their own privacy policies:

Google LLC (United States / global infrastructure)
- Firebase Authentication and Google Sign-In — account creation and sign-in
- Cloud Firestore — secure storage of workout data and account information
- Cloud Storage for Firebase — storage of photos you attach to the coach, and of history files you import (Section 2.10)
- Cloud Functions, Cloud Run, and Cloud Tasks — the servers that run the Service
- Cloud Logging — server logs used for debugging and security, which contain account identifiers
- Google Vertex AI — AI model inference for coaching features, post-workout analysis and history import
- Firebase Analytics — in-app usage analytics
- Firebase Crashlytics — crash and error diagnostics
- Firebase Performance Monitoring — app performance measurement
- Firebase App Check — confirming requests come from a genuine copy of the app
- Google BigQuery — internal, access-restricted analytics data warehouse
- Google Analytics 4 — anonymized website usage analytics
- Google Workspace — our support email inbox
Anthropic (United States / global infrastructure)
- Claude API — AI model inference for coaching features, post-workout analysis and history import
Apple Inc. (United States)
- Sign in with Apple — authentication
- App Store — payment processing and subscription management
- Apple Search Ads — install attribution (Section 2.6)
- Apple Maps — finding gyms near you when you start a workout somewhere new (Section 2.11)
Advertising Platforms (various jurisdictions)
- We promote Povver through advertising platforms such as Apple Search Ads and Reddit. We do not send your personal data to these platforms. If we later introduce privacy-preserving measurement or retargeting, any data shared would be limited to hashed identifiers, subject to your consent where required, and would never include your workout data, conversation history, or health-related information.

We may integrate additional service providers in the future. When we do, we will update this policy and notify you of material changes. Any new provider will be bound by a data processing agreement before receiving access to personal data.

For details on how these providers handle data:

7. International Data Transfers

Povver is based in Finland (EU). Your data may be transferred to and processed in countries outside the European Economic Area, including the United States, where our third-party service providers maintain infrastructure.

Your account data, workouts, and backups are stored in the EU (Google Cloud, Europe). Many interactive requests from current versions of the app, such as logging a workout or editing a plan, are processed by our servers in the EU. All other requests, including those from older app versions, account deletion and export, the AI coach, AI-generated features (your post-workout recap, a routine built from pasted content, and onboarding personalization), and background processing still run on our servers in the United States. AI requests run on our AI model providers' global infrastructure (Anthropic keeps the content of those requests in the United States and normally deletes it within 30 days; see Section 5.6), and photos you attach to the coach are stored in the United States. Apple Health data is stored and processed in the EU, except when you delete or export your account (see Section 2.12). History files you import are processed by our servers in the EU and stored in the United States (see Section 2.10).

These transfers are protected by:

The EU-U.S. Data Privacy Framework (for transfers to certified U.S. organizations)
Standard Contractual Clauses (SCCs) approved by the European Commission
The UK International Data Transfer Agreement (UK IDTA) for transfers from the United Kingdom

We ensure that any international transfer of your data is accompanied by appropriate safeguards that provide a level of protection equivalent to that available within the EEA.

8. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide the Service. Specific retention periods:

Workouts, templates, and routines (including workouts you import) — retained for the lifetime of your account. Your training history is what makes coaching and progression tracking work.
AI conversations and coach memory — retained for the lifetime of your account to provide continuity across coaching sessions.
Training recommendations — stop being offered after 7 days, and are retained while your account is active so we can learn which suggestions helped you. Deleted when you delete your account.
Post-workout insights and weekly training reviews — retained while your account is active to power your progress trends, training history, and coaching. Deleted when you delete your account.
Subscription event records — retained for 180 days for billing audit purposes, then deleted.
Derived training metrics (muscle state, training profile, periodization plan) — retained for the lifetime of your account, deleted on account deletion.
Photos you attach to the coach — retained for the lifetime of your account, deleted on account deletion.
Your gyms (name, and for a gym found through Apple Maps its identifier and public position) — retained for the lifetime of your account, deleted on account deletion (see Section 2.11).
History files you import, including files we could not read, are kept for up to 90 days after upload, and then deleted. They are deleted sooner if you remove the import or delete your account (see Section 2.10).
Apple Health data — heart rate, steps and active energy for about 90 days, the other types for about 2 years, from the day of the reading, then deleted automatically. Povver deletes a type sooner: 30 days after you turn it off, normally within a day of "Delete my Health data now", and when you delete your account (see Section 2.12).
Records of AI usage (which feature called the AI model, and how much) — retained for 90 days in our app database.
App Store ad attribution — retained for the lifetime of your account.
Feedback and support emails — kept in our support inbox until you ask us to delete them.
Internal analytics warehouse — we export certain data, which may include personal data, to an internal analytics data warehouse (Google BigQuery) that we use to operate, monitor, and improve the Service. This data is not shared externally, and access is restricted to authorized personnel. It is kept for as long as we operate the Service, except as described below for deleted accounts.

When you delete your account in the app, we delete your account, workouts, conversations, photos, imported history files, Apple Health data, and the data derived from them from our app database and storage straight away. Copies in our internal analytics warehouse and support inbox are not yet removed automatically: tell us at info@povver.ai and we will delete them within 30 days. Encrypted backup copies may persist in access-restricted disaster recovery storage for up to 35 days, after which they are automatically purged. If you request deletion of specific data (such as a conversation or workout) without deleting your account, we will process that request within 30 days. Data that we are required by law to retain will be kept for the minimum period required and then deleted.

You can request account deletion at any time through the app or by contacting us at info@povver.ai.

9. Your Rights

Regardless of where you are located, you have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate or incomplete data.
Deletion — request deletion of your personal data.
Restriction — request that we limit how we process your data.
Portability — receive your data in a structured, commonly used, machine-readable format (JSON), on request.
Objection — object to processing of your data based on our legitimate interests.
Withdraw consent — where processing is based on your consent, you may withdraw it at any time. For health-related data, you can withdraw by letting your subscription end (which stops AI processing, except in a history import you start) or by deleting your account. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
Control over advertising data — where we offer advertising measurement that relies on your consent, you can decline or withdraw it at any time without affecting any other functionality of the Service.
Human review of automated decisions — where automated processing (such as Auto-Pilot recommendations) may significantly affect your training, you have the right to request human review. Contact us at info@povver.ai.

To exercise any of these rights, contact us at info@povver.ai. We will respond within 30 days. If a request is complex or we receive a large number of requests, we may extend this by an additional 60 days — we will notify you if this is the case.

If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority. For users in Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi). Users in other jurisdictions may contact their local data protection authority.

10. Data Security

We implement technical and organizational measures to protect your personal data, including:

Encryption in transit (TLS 1.2+) and at rest
Authentication-gated access to all personal data
Principle of least privilege for system access
Regular security reviews of our infrastructure and code

No method of electronic transmission or storage is completely secure. While we implement industry-standard protections, we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
Document the breach, its effects, and the remedial actions taken.

12. Age Restriction

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly. If you believe someone under 18 has provided us with personal data, please contact us at info@povver.ai.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as new categories of data collection, new third-party processors, or changes to how AI processing works — we will notify you through the app and/or by email before the changes take effect.

The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you should stop using the Service and delete your account.

14. Regulatory Compliance

Povver is designed and operated to comply with the following data protection and privacy frameworks:

GDPR — EU General Data Protection Regulation (Regulation (EU) 2016/679)
UK GDPR — United Kingdom General Data Protection Regulation and Data Protection Act 2018
Finnish Data Protection Act (Tietosuojalaki 1050/2018)
CCPA / CPRA — California Consumer Privacy Act and California Privacy Rights Act
PIPEDA — Canada's Personal Information Protection and Electronic Documents Act
Australian Privacy Act 1988 and Australian Privacy Principles (APPs)
EU AI Act — Regulation (EU) 2024/1689, as applicable to limited-risk AI systems

Where local law provides additional rights beyond those described in this policy, those rights apply to users in the relevant jurisdictions. If you have questions about your specific rights under local law, contact us at info@povver.ai.

15. Contact

For questions about this Privacy Policy, data protection requests, or concerns about how your data is handled: