AIRfasting Privacy Policy

Version: Draft v1.0 · Last updated: 29 July 2026

1. Introduction

This Privacy Policy explains how Jovere Collective S.L. ("Jovere Collective," "AIRfasting," "we," "us") collects, uses, shares, and protects your personal data when you use the AIRfasting digital wellness platform.

We built AIRfasting around the principle that your health data belongs to you. This policy is written in plain language, and we encourage you to read it fully, particularly the sections on health data, since AIRfasting processes special category personal data under Article 9 of the GDPR.

This Privacy Policy should be read alongside our Terms of Service and Cookie Policy.

2. Who Is Responsible for Your Data (Data Controller)

Jovere Collective S.L., incorporated in Spain, is the Data Controller responsible for your personal data processed through AIRfasting.

Contact: support@airfasting.com

Registered address: Calle Quevedo, Núm. 16, 03700 Dénia (Alicante), Spain

If Jovere Collective S.L. appoints a Data Protection Officer, their contact details will be provided here.

3. Other Parties Involved in AIRfasting

Investor / holding company. AIRfasting is financially supported by a holding company that co-owns AIRfasting's intellectual property. This entity does not currently process your personal data.

Strategic wellness partner. AIRfasting collaborates with a wellness partner recognized for expertise in fasting and metabolic health, who contributes methodologies, educational content, and scientific expertise. This partner does not currently process identifiable personal data about you. If this changes, we will update this Privacy Policy, put in place appropriate data processing agreements, and implement international transfer safeguards where required, before any such processing begins.

4. What Personal Data We Collect

4.1 Account & Contact Data

Name, email address, password (hashed), account preferences, language.

4.2 Health & Wellness Data (Special Category Data)

This is the core data AIRfasting uses to provide its service, and includes, where you choose to provide it:

• menstrual cycle information (or your choice to use lunar-phase planning instead);
• fasting schedules and fasting history;
• wellness logs, optional symptoms, and personal notes;
• wellness preferences and goals.

This constitutes special category personal data under Article 9 GDPR. We only process this data with your explicit consent, which you provide during onboarding and can withdraw at any time (see Section 9).

4.3 Subscription & Payment Data

Subscription status, billing history. Full card details are processed directly by Stripe and are not stored on our servers.

4.4 Usage & Analytics Data

Interaction data with the platform (e.g., pages visited, features used, session duration), collected via PostHog, used to improve AIRfasting.

4.5 Technical Data

IP address, device and browser type, log data, cookies and similar technologies (see our Cookie Policy).

5. Legal Bases for Processing

We process your personal data on the following legal bases under the GDPR:

Providing the core AIRfasting service and account management

Performance of a contract (Art. 6(1)(b))

Processing health and wellness data (cycle tracking, fasting logs, symptoms)

Explicit consent (Art. 9(2)(a))

Sending service-related and transactional emails

Performance of a contract / legitimate interest (Art. 6(1)(b)/(f))

Marketing communications

Consent (Art. 6(1)(a))

Analytics and product improvement

Consent (via cookie/analytics settings) or legitimate interest, as applicable

Fraud prevention, security, and legal compliance

Legal obligation / legitimate interest (Art. 6(1)(c)/(f))

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

6. How We Use Your Data

We use your personal data to:

• create and manage your account;
• generate personalized fasting plans and wellness insights;
• send reminders, service updates, and (with consent) marketing communications;
• process subscription payments and manage billing;
• maintain platform security and prevent fraud or abuse;
• analyze aggregated usage trends to improve AIRfasting;
• comply with legal obligations.

We do not use your health data for advertising purposes, and we do not sell your health data.

7. Who We Share Your Data With

We share personal data only as necessary, with the following categories of recipients:

• Service providers (processors) who process data on our behalf under data processing agreements: see our Subprocessor Register for the current list (currently including Supabase for authentication/database, Stripe for payments, Resend for transactional email, and PostHog for analytics).
• Strategic wellness partner: currently receives no identifiable personal data (see Section 3).
• Legal and regulatory authorities, where required by law.
• Successors, in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

We do not sell your personal data, and we do not share your health data with advertisers or data brokers.

8. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms recognized under GDPR Chapter V. Details of subprocessor locations are set out in our Subprocessor Register.

9. Your Rights

Under GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to certain exceptions;
• Restrict processing in certain circumstances;
• Data portability — receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interests or for direct marketing;
• Withdraw consent at any time, including consent for health data processing, without affecting the lawfulness of prior processing;
• Lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), or the supervisory authority of your EU member state of residence.

To exercise these rights, contact us at support@airfasting.com. We will respond within the timeframes required by GDPR (generally one month).

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Account and health data: retained while your account is active, and in a limited read-only state after subscription cancellation or expiry, unless you request deletion.
• Payment records: retained as required by applicable tax and accounting law.
• Data after account deletion: deleted immediately upon a verified deletion request, except that residual copies may persist in backups for up to 30 days before being purged, and except where retention is required by law.

You may request deletion, correction, or export of your data at any time through your account settings or by contacting us.

11. Data Security

We implement technical and organizational measures appropriate to the sensitivity of the data we process, including encryption in transit and at rest, access controls, authentication safeguards, and regular security review of our infrastructure and subprocessors. Further detail is provided in our Security & Privacy Overview.

12. Automated Decision-Making

AIRfasting does not use automated decision-making that produces legal or similarly significant effects on you without human involvement, including in relation to your access to services, pricing, or legal rights.

13. Cookies

AIRfasting uses cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy.

14. Children

AIRfasting is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected data from a child, we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the services and partners involved in AIRfasting. We will notify you of material changes, including any new subprocessors or partners that will process health data, in advance of the change taking effect, and will seek fresh consent where legally required.

16. Contact Us

For any questions about this Privacy Policy or to exercise your data protection rights:

Jovere Collective S.L.

Calle Quevedo, Núm. 16, 03700 Dénia (Alicante), Spain

support@airfasting.com

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos or your local EU supervisory authority.

This document is part of AIRfasting's Legal Framework and should be read together with the Terms of Service, Cookie Policy, Health & Wellness Disclaimer, Security & Privacy Overview, and Subprocessor Register.