Privacy Notice

Required by section 43 of the Electronic Communications and Transactions Act 25 of 2002 (ECTA).

• Legal name: Tiaan Wessels, trading as Crown Peaks
• Legal form: Sole proprietor registered in South Africa
• Nature of business: a subscription mobile web app providing AI-generated gym programs, nutrition plans and progress tracking
• Email: admin@crownpeaks.co.za (all support, legal, privacy and billing queries)
• Physical address: available on request from admin@crownpeaks.co.za
• Place of business: South Africa
• Website: this website, where these terms, the privacy notice, the refund policy and full pricing are published before you pay

POPIA requires a lawful justification for each processing purpose. Ours are consent, performance of our contract with you, compliance with a legal obligation, and our legitimate interests.

• Account information — email address, password credentials, display name. To create and secure your account (contract).
• Profile and health information you choose to give us — goal, age, sex, height, weight, experience, equipment, dietary style, allergies, injuries, supplements, country and region. To generate your training and nutrition plans (consent — see the next section).
• Training and progress information — logged sets, cardio, weigh-ins, benchmarks, calendar entries and goals. To track progress and adapt your plans (contract, and consent for the health elements).
• Coach conversations and uploads — messages and photos you send the AI coach. To answer you, estimate nutrition, and remember your preferences (contract and consent).
• Technical and usage information — device identifiers, IP address, browser type, push notification tokens, and logs of errors and feature use. For security, fraud prevention, support and improving the product (legitimate interests).
• Support messages — what you send us when you ask for help (contract and legitimate interests).
• Transaction records — the fact and date of your membership payments, kept for tax and accounting (legal obligation).

Giving us your profile and health information is voluntary, but without it we cannot generate a personalised plan. Payment card details are collected and processed by Paddle, not by us — we never see or store your card number.

Your weight, body measurements, injuries, medical limitations, allergies and any religious or philosophical dietary preferences are special personal information under sections 26 to 28 of POPIA. We process it only with your explicit consent, which you give by entering it into the app, and only to build and adapt your training, nutrition and recovery plans. We do not use it for advertising or profiling beyond your own plan.

You can withdraw that consent at any time by deleting the relevant fields, or by deleting your account or emailing admin@crownpeaks.co.za. Withdrawing consent does not affect processing that already happened, and the app will no longer be able to personalise your plans.

Crown Peaks is for people aged 16 and over. Under POPIA, anyone under 18 is a child, so if you are 16 or 17 a competent person (a parent or legal guardian) must consent to our processing of your personal and health information. If we learn that we hold a child's information without that consent, we delete it and close the account.

• Operators (service providers) — hosting, database and authentication providers, push notification delivery, and the AI providers that generate plans and coach replies. They process on our written instructions, are bound to confidentiality, and must keep the information secure as required by section 21 of POPIA.
• Paddle.com, our Merchant of Record, for the sale of the membership, subscription management, payments, invoicing and tax compliance.
• Professional advisers — legal and accounting, when needed.
• Authorities — where we are required to by law.

We do not sell your personal information and we do not use it for direct marketing without your consent.

Some of our operators process information outside South Africa (including in the European Union and the United States). Section 72 of POPIA allows this where the recipient is bound by rules or a contract giving substantially similar protection, where the transfer is necessary to perform our contract with you, or where you consent. We rely on contractual safeguards such as standard contractual clauses with each provider.

We keep your account, profile and training information for as long as your account is active. If you delete your account or ask us to erase your information, we delete or de-identify it within 30 days, except where we must keep records for legal, tax or accounting purposes — transaction records are kept for five years as required by South African tax law.

Under POPIA you may:

• ask what personal information we hold about you and request a copy (section 23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, misleading or unlawfully obtained (section 24);
• object to processing based on legitimate interests (section 11(3));
• withdraw consent at any time;
• object to a decision based solely on automated processing (section 71);
• ask us not to use your details for direct marketing (section 69);
• complain to the Information Regulator.

Where the GDPR applies to you, you additionally have rights to restriction and data portability. Email admin@crownpeaks.co.za and we will respond within a reasonable time — we aim for 30 days. Formal access and correction requests may be made on the Regulator's Form 2 and Form 3, and our PAIA manual is available from the same address.

We use appropriate technical and organisational measures as required by section 19 of POPIA — encryption in transit, encrypted storage, row-level access controls so members can only reach their own records, and restricted administrative access.

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify both you and the Information Regulator as soon as reasonably possible, and we will tell you what happened and what to do about it.

We use strictly necessary cookies and browser storage to keep you signed in and remember app preferences. Our checkout provider, Paddle, sets its own cookies during payment. We do not use advertising cookies. You can clear or block cookies in your browser settings, but the app will not stay signed in without them.

Our Information Officer, as required by POPIA, can be reached at admin@crownpeaks.co.za. If you are not satisfied with how we handled your request, you may complain to:

• The Information Regulator (South Africa) — JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; P.O. Box 31533, Braamfontein, 2017. General enquiries: enquiries@inforegulator.org.za. POPIA complaints: POPIAComplaints@inforegulator.org.za. inforegulator.org.za
• Your local supervisory authority, if you are in the EU or UK.

See also our terms and refund policy.