Privacy Policy

1. Who is who

Moj Klijent is an app for personal trainers. A trainer manages clients and sends them workouts, and a client opens a workout through a personal link and enters results. That is why there are two roles when it comes to data:

Trainer account

The controller is the Operator of the app (see below). We decide why and how the data in a trainer’s account is processed.

Client data

The controller is the trainer who manages the client: the trainer decides which data to enter and what it is used for. The Operator is the processor. It stores and processes the data only on the trainer’s instructions and to the extent needed for the app to work, on the basis of the Terms of Use (the section on processing data on behalf of the trainer).

Technical data about how the app runs

Error logs and security logs. The controller is the Operator.

Card payments

For payment data (card, billing address, receipts) Paddle is an independent controller (see “Who else processes data”). For the subscription data we keep with the trainer’s account, the controller is the Operator.

2. What data we process

3. Why and on what basis

Trainer account and running the app

Creating an account and confirming the email, signing in, storing and showing workouts, sending the emails needed for the app to work (for example the email confirmation code and a new password). Basis: performance of a contract (the Terms of Use).

Plans, invoices and contact with the trainer

Activating and following plans, agreeing on a plan and support (email and phone). For every new account the app administrator receives an email with the trainer’s name, email and phone number. Basis: performance of a contract; for invoices and for keeping accounting documents, also a legal obligation.

Card payments

Starting a payment through Paddle, activating and extending a plan after payment, changing, resuming and cancelling a subscription. Basis: performance of a contract. We keep the log of payment events for support and for fixing billing errors; basis: our legitimate interest.

Managing clients, workouts and measurements

Processing on behalf of the trainer, on the trainer’s instructions. The trainer determines the basis: usually a contract with the client, and for health data the client’s explicit consent.

Emails about workouts

An email to the client when a new workout arrives or at the trainer’s request, and an email to the trainer when a client finishes a workout. They are sent on the trainer’s behalf. Every email to a client has an unsubscribe link, and the trainer turns off finished-workout notifications in Settings.

Security and preventing abuse

Lockout after wrong PINs, a limit on the number of attempts, email confirmation by code, the check when an account is created (Cloudflare Turnstile) and a limited number of registrations from one IP address, server logs. Basis: our legitimate interest in keeping the app secure.

Finding and fixing errors

Error logs. Basis: our legitimate interest in the app running reliably.

Legal obligations

Keeping documents the law requires (for example accounting documents, if the service is paid for) and replying to the competent authorities. Basis: legal obligation.

Where processing is based on consent, you can withdraw your consent at any time. This does not affect the lawfulness of processing before the withdrawal.

4. How long we keep data

• Trainer account: for as long as the account exists. A trainer deletes the account in Settings, with Delete account („Obriši nalog“), immediately and permanently, or we delete the account on a request sent by email, within 30 days at the latest. Plan requests are deleted with the account; issued invoices and the data needed for them are kept for as long as accounting regulations require.
• Card payment data: the customer and subscription ID and the subscription data are kept for as long as the account exists and are deleted with the account (the subscription is cancelled before deletion). Paddle keeps receipts and payment history according to its own rules and the law.
• Log of payment events: 180 days from when we receive the event, after which it is deleted automatically, also when the account has already been deleted.
• Client data: for as long as the trainer keeps it in the app. A client asks for their data to be deleted in the app (Profile → Your data): the trainer receives an email about the request and can delete the data right away, and if the trainer does not, the data is deleted automatically 15 days after the request. Until the data is deleted, the client can withdraw the request. The client and the personal link (which stops working), workouts, results and measurements are deleted. A trainer can also pause a client; without a request from the client, we delete a client at the trainer’s request sent by email, manually, within 30 days at the latest. When a trainer deletes the account, the data of all of that trainer’s clients is deleted immediately. The exception is anything the law requires to be kept.
• Sessions: a client’s session on a device lasts up to 90 days from the last activity (a device can be signed out earlier). A trainer’s session lasts a limited time (7 days by default) and is extended by activity.
• Link for a trainer’s new password: valid for a short time and can be used only once.
• Email confirmation code: valid for 15 minutes and can be used only once. An account whose email is not confirmed is deleted after 7 days.
• Number of attempts per IP address: until the limit window expires, at most 24 hours from the last attempt.
• Database backups: they are made and kept according to the settings of the hosting provider (Railway); we do not promise an exact retention period. Data deleted from the app may remain in backups for some time, until the provider replaces the copies with newer ones.
• Server logs and error logs: a short time, according to the provider’s settings (from a few days to 90 days at most).
• Data on the client’s device: until the device is signed out or the browser data is cleared.

5. Who else processes data

To provide the service, we engage providers that process data for us, on our instructions and under a data processing agreement. The region in which each of them stores data is stated in its description.

Railway (Railway Corporation)

Hosting of the app and the database. Region: EU West (Amsterdam, the Netherlands). All the data from the section “What data we process”.

Resend (Resend, Inc.)

Sending emails. Region: EU (Ireland). The recipient’s email address and name, the text of the message and the link in it.

Data processing agreements with these providers: the standard data processing agreements (Data Processing Addendum) that Railway and Resend offer to their customers.

When a provider is based outside the EU (for example in the USA), any transfer of data outside Serbia and the EU is based on appropriate safeguards (standard contractual clauses).

We do not sell data and we do not give it to third parties for advertising. We give it to the competent authorities only when the law requires it.

6. How we protect data

• Trainers’ passwords and clients’ PINs are stored only as hashes (PIN: argon2id). We cannot read them.
• A client’s personal link is a hash in the database. An additional copy, which lets the trainer copy the same link again, is encrypted (AES-256).
• All traffic goes over HTTPS. Session cookies are protected (httpOnly, Secure, SameSite).
• Each trainer sees only their own clients and their own data. Access is checked on the server on every request.
• Five wrong PINs lock access for 15 minutes, and sign-in attempts are limited.
• A PIN is never sent by email. When a trainer resets a client’s PIN, the old PIN is deleted and the client sets a new one when opening their personal link.
• Pages with a client’s personal link are not in search results and do not pass their address on.
• Only authorised persons of the Operator access production data, and only when necessary (for example support or fixing an error).
• We notify the trainer of a data breach without delay, and the Commissioner within 72 hours when this is required.

No system is completely secure, but we regularly review and improve our measures.

7. Cookies and data on your device

• We use only necessary cookies: the trainer’s sign-in cookie, the client’s session cookie (up to 90 days from the last activity) and the language cookie. The app cannot work without them.
• The language cookie (trainingapp_client_lang) remembers the language the client chose (Serbian or English), so that pages that do not know the client, for example “Open your link”, are shown in that language. It is functional, is not used for tracking and lasts up to 400 days.
• We do not use cookies for tracking, analytics or ads, so there is no cookie consent banner either.
• On the client’s phone, the app in the browser keeps a copy of the workouts and exercise images that were sent (so that it works without internet), results that have not been sent yet, and the theme. This data stays on the device and is deleted by signing out of the device or clearing the browser data. The chosen language is no longer stored on the device; it is stored on the server.
• Result images for Instagram are made on your phone; a photo you pick as the background is never sent to our server or stored. If you turn on “My trainer may show my first name” in Profile, your trainer can put your first name (never your surname) on an image of your result that they share. It is off by default and you can turn it off at any time; images your trainer has already shared stay where they were shared.

8. Emails

We send emails from the address obavestenja@mojklijent.rs. They are received by the trainer (an invitation for an account, the email confirmation code, a new password, a reminder 7 days before a manual plan (invoice or pilot) expires and on the day it expires, confirmation that a plan is activated, an email when a card subscription renewal fails, a notice about changes to the Terms, a notice when a client asks for their data to be deleted, confirmation of account deletion and a notice about a client’s finished workout, which can be turned off in Settings) and by the client (a new workout, a personal link at the trainer’s request and a notice about the deletion of the trainer’s account, after which the link no longer works). Receipts and card payment confirmations are sent by Paddle.

The app administrator receives an email about a new account when the trainer confirms the email (name, email and phone number), about a new plan request (with invoice details), about a payment event that needs attention (type and reference of the event and the trainer’s email), about a blocked trainer’s subscription that was not cancelled at Paddle (the trainer’s email) and a daily overview: plans that expire in the next 7 days (name, email, phone number, plan and date) and accounts created in the last 24 hours (with a mark that the email is not yet confirmed).

Every email to a client has an unsubscribe link. After unsubscribing, the client does not receive emails about workouts, and the trainer can still send the link another way.

9. Your rights

You have the right to:

• get confirmation of whether we process your data and a copy of that data (access);
• ask for inaccurate data to be corrected and incomplete data to be completed;
• ask for your data to be deleted;
• ask for processing to be restricted;
• receive your data in a common, machine-readable format (for example CSV or JSON) and transfer it to another controller (portability);
• object to processing that is based on legitimate interest;
• withdraw consent, if processing is based on consent;
• not be subject to a decision based solely on automated processing (we do not carry out such processing).

10. Minors

The app for managing clients is used by adult trainers. If a client is a minor, the trainer must obtain the consent of a parent or another legal guardian; for a child under 15, consent is given by a parent or guardian.

11. Changes to this policy

When the policy changes, we change the date at the top of the page, and we notify trainers of significant changes by email or in the app. You can ask us for earlier versions.

12. Contact and complaints

For any question about privacy, write to info@mojklijent.rs. The Operator is Đorđe Milanović PR Računarsko programiranje ByteNS Raševica, Branka Ćopića 1, 35206 Raševica.

If you believe the processing of your data is unlawful, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs). Before that, we will gladly try to solve the problem together.