Privacy Policy

Dor Pinhas, trading as forconn.ai, a sole trader based in Israel. That trader is the data controller. Contact us about anything in this policy at forconn.ai@gmail.com.

We do not have a Data Protection Officer; we are not required to appoint one. Requests go to the address above and are handled by us directly.

• Account details. Your email address, and your name and account identifier from Google when you sign in. We do not receive or store your Google password.
• Purchase records. What you bought, when, currency, amount, subscription status, and renewal dates. We never see or store your card details or billing address — those go to Lemon Squeezy, LLC, who takes the payment.
• Plan and delivery history. Which weekly plans were sent to you, and whether the email was delivered, opened, or clicked.
• Emails you send us. If you reply to one of our emails or write to forconn.ai@gmail.com, we store the message so we can answer it.
• Technical data. Standard server logs from our hosting and security providers, including IP address, browser, and request times.

We do not collect health data. We do not ask for your weight, measurements, injuries, medical history, or training results, and there is nowhere on the site to enter them. Please do not send us health information by email.

For anyone in the EU or UK, these are our legal bases under the GDPR and UK GDPR:

• Performance of a contract. Running your account, delivering the plans you paid for, and handling billing status.
• Legitimate interests. Keeping the service secure, preventing abuse, understanding whether our emails are arriving, and answering your messages. We use the least data that achieves this.
• Legal obligation. Keeping records we are required to keep, including for tax.
• Consent. Only where we ask for it explicitly — for example any future marketing email unrelated to your subscription. You can withdraw consent at any time.

We do not sell your data and we do not share it for advertising. We use these providers to run the service, each bound to process data only on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — website hosting and server logs.
• Lemon Squeezy, LLC — payments, invoicing, and tax. They are the seller of record and an independent controller of the payment data you give them.
• Resend — sending the weekly plan and account emails.
• Cloudflare — domain, network security, and receiving email sent to us.
• Google— sign-in. Google tells us your email, name, and account ID; what Google does with your use of its own account is governed by Google's privacy policy.

We may also disclose data where the law requires it, or to establish or defend legal claims.

We are based in Israel and our providers operate internationally, so your data is transferred outside the EU and UK.

Israel holds an adequacy decision from the European Commission, which permits transfers from the EU without additional safeguards. For transfers to providers elsewhere, we rely on Standard Contractual Clauses or an equivalent approved mechanism in our agreements with them.

• Account and plan history — while your account exists, and deleted when you delete it.
• Purchase and tax records — up to seven years after the transaction, because tax law requires it. This survives account deletion; we keep only what the obligation covers.
• Emails you send us — up to two years after the conversation ends.
• Server logs— typically 30 days, per our providers' defaults.

Wherever you live, you can exercise these by emailing forconn.ai@gmail.com. We respond within 30 days and do not charge for it.

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your account and data deleted, except records we must keep by law.
• Portability — receive your data in a machine-readable format.
• Restriction and objection — ask us to pause or stop a particular use, including anything based on legitimate interests.
• Withdraw consent — where we relied on consent, at any time, without affecting what came before.

If you are in the EU or UK you may also complain to your national data protection authority — the ICO in the UK — and in Israel to the Privacy Protection Authority. We would rather you told us first, but you do not have to.

We use strictly necessary cookies only: the ones that keep you signed in and protect the site. They are required for the service to work, so there is no consent banner and nothing to opt out of beyond signing out or blocking cookies in your browser.

We do not use advertising cookies or third-party tracking pixels. If that ever changes we will ask for your consent first and update this policy.

This service is for adults. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

Access is protected by Google sign-in — we never handle a password. Data is encrypted in transit and at rest by our providers, and access to the production database is limited to the operator of this site. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as the law requires.

If we change this policy materially we will email account holders before it takes effect. The date at the top always reflects the current version.