Privacy Policy
How MaxCals collects and uses your data when you train with the coaching bot on Telegram or WhatsApp.
Last updated: 3 October 2026
Who we are
MaxCals is a fitness coaching service delivered over Telegram and WhatsApp ("MaxCals", "we", "us"), operated by Wiramu Limited (company no. NI718907), Office 514, 92 Castle Street, Belfast, BT1 1HE. We are the data controller for the personal data described in this notice. Contact: hello@maxcals.com.
What we collect
| Data | Why we collect it |
|---|---|
| Name (as given in onboarding) | To personalise coaching messages |
| Machine type (rower, ski erg, bike erg, air bike, watt bike) | To select the right workout programme |
| Fitness level (self-reported) | Collected at onboarding and stored encrypted. It does not currently change your workouts. Included in your /export |
| Workout results (times, watts, splits, RPE, free-text descriptions you send us) | To track progress and adapt future workouts |
| Telegram user ID and chat ID (if you use Telegram) | To deliver messages to the right person |
| WhatsApp phone number (if you use WhatsApp) | To deliver messages to the right person on WhatsApp |
| Consent timestamp | To prove when you agreed to this notice |
| Health-screening answers (the 7 PAR-Q+ yes/no questions before your first workout, then a yearly "has anything changed?" check) and when you confirm you have been cleared to exercise | To check it is safe to send you workouts. Any "yes" pauses your workouts until you confirm a doctor or qualified exercise professional has cleared you. Stored encrypted. Included in your /export and erased by /delete |
| Payment status (paid/free) | To determine what programme content you can access |
We do not currently collect machine-screen photos in the live product. If that is added, this notice will be updated first.
Why we process it (legal basis)
- Contract: delivering the coaching service you sign up for (workouts, adaptation, progress tracking) requires processing your training data.
- Consent: you explicitly opt in during onboarding before any data is stored, and you can withdraw consent at any time (see "Your rights").
- Legitimate interest: basic operational logs (error and metric events) to keep the service reliable, kept to the minimum necessary.
Workout results, fitness level and health-screening answers are special category (health) data under UK GDPR. We rely on your explicit consent (Article 9(2)(a)) for this category, given during onboarding.
Automated decision-making
After each workout you submit, an automated "progressive overload" engine adjusts your next workout's volume and intensity based on your reported results. This is an automated decision under Article 22. It only ever changes training prescriptions (never medical, financial or legal outcomes), and you can always message us to request a manual review or to stop receiving adapted programming.
Sub-processors
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Anthropic (Claude API) | Reads your workout-result messages to extract structured numbers, and drafts workout copy | Your free-text results, workout numbers, first name |
| Railway | Hosts our application and Postgres database | All stored data |
| Stripe | Payment processing | Payment status; card details are handled entirely by Stripe, never by us |
| Telegram | Message delivery | Your Telegram user ID and the messages exchanged with the bot |
| Meta (WhatsApp Business Platform) | Message delivery on WhatsApp | Your WhatsApp phone number and the messages exchanged with the bot |
We do not sell your data or use it for third-party advertising.
How long we keep it
We keep your account and workout history for as long as your account is active, plus 12 months after your last activity to allow you to resume your programme. When you send /delete and confirm by replying DELETE, your account and all the training data linked to it are permanently erased in a single operation, subject to backups being rotated out within our standard backup retention window. If you contact us on WhatsApp but never give consent, the contact record created for you (including your phone number) is erased automatically after 30 days.
Your rights
You can, at any time, by messaging the bot:
- /export — receive a copy of your stored data.
- /delete — permanently delete your account and all associated data.
You also have the right to object to processing, to restrict processing, and to lodge a complaint with the ICO (ico.org.uk). Contact us first at hello@maxcals.com so we can try to resolve it directly.