How we handle your data

01Who we are

R3P Fit is operated by Mani Shitta as a sole trader, based in the United Kingdom. For the purposes of UK GDPR, we are the data controller for any personal information we collect through r3p.fit.

If you have any questions about this policy or your data, contact us at hello@r3p.fit.

02What information we collect

Information you provide directly

When you join our waitlist, we ask for:

• Email address (required, so we can contact you)
• Answers to a short optional questionnaire about your fitness habits, preferences, and interests — including your typical activity level, activity type, current fitness tracker, reward interests, willingness to pay for premium features, and current frustrations with fitness apps

The questionnaire is optional. You can skip questions and still join the waitlist with just your email address.

Information collected automatically

When you visit r3p.fit, we automatically collect:

• Traffic source — a source parameter in the URL (for example, indicating whether you came from Instagram, LinkedIn, or a paid ad)
• Technical information — IP address, browser type, device type, operating system, and referring website. This is standard information collected by every website.
• Usage data — pages viewed, time spent, and interactions with the waitlist form

What we do NOT collect

On the r3p.fit waitlist, we do not collect:

• Names, phone numbers, or postal addresses
• Health data or fitness tracker data
• Location data (beyond approximate country/region inferred from IP)
• Payment information
• Social media logins or profile data

Some of these may be collected by the R3P Fit mobile app when it launches. That will be covered by a separate policy at that time.

03How we use your information

We use the information we collect to:

• Send you a welcome email confirming your waitlist registration
• Send you occasional updates about R3P Fit's launch progress and product news
• Understand what our future users want, using aggregated questionnaire responses
• Understand which marketing channels bring engaged users (using source tracking)
• Maintain the security and reliability of the website
• Comply with legal obligations

We do not use your information for automated decision-making, profiling that has legal or significant effects, or sale to third parties.

04Legal bases (UK GDPR)

Under UK GDPR, we rely on the following legal bases:

• Consent — when you join the waitlist, you consent to receive our welcome email and occasional launch updates. You can withdraw consent at any time by unsubscribing from any email we send.
• Legitimate interests — for security, understanding marketing channel effectiveness, and aggregated product research. We have assessed that these interests do not override your rights.
• Legal obligation — where we are required by law to process or retain certain information.

05Who we share your information with

We do not sell your personal information to anyone. We share it only with the following service providers, who process it on our behalf under contractual agreements:

• Supabase Inc. (United States) — hosts our database where waitlist information is stored securely
• Resend Inc. (European Union) — delivers our welcome emails and future launch updates
• Vercel Inc. (United States) — hosts the r3p.fit website

Where personal data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses or equivalent safeguards approved under UK GDPR.

We may also share information if legally required — for example, in response to a valid legal request from a UK authority — or to protect our rights or the safety of others.

06How long we keep your information

We keep your waitlist information until R3P Fit publicly launches, and for approximately 12 months after launch to support your transition into the full service. After that, we will either delete your information or anonymise it for statistical purposes.

You can request deletion of your data at any time by emailing hello@r3p.fit.

07How we keep your information safe

We protect your information through:

• Encryption in transit (HTTPS on r3p.fit)
• Encryption at rest (managed by Supabase)
• Restricted access — only Mani Shitta accesses waitlist data
• Regular security reviews of our infrastructure

No internet transmission is 100% secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. If you become aware of a security concern, please contact us immediately at hello@r3p.fit.

08Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — ask us to delete your data (the "right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restrict processing — limit how we use your data
• Object — object to processing based on legitimate interests
• Withdraw consent — for anything you originally consented to (e.g. marketing emails)

To exercise any of these rights, email hello@r3p.fit. We will respond within 30 days of receiving your request.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

09Cookies and tracking

r3p.fit uses only essential cookies and analytics necessary for the site to function. Specifically:

• Essential cookies — set by Vercel and Supabase for website functionality, session management, and security
• Traffic source tracking — a URL parameter that tells us which marketing channel brought you to r3p.fit (for example, an Instagram post vs. a paid ad). This is stored only if you join the waitlist.

We do not use advertising cookies, cross-site tracking pixels, or third-party marketing trackers on r3p.fit. This may change if we run paid advertising campaigns — this policy will be updated to reflect any changes before they take effect.

Most browsers let you refuse cookies. If you do, some site features may not work correctly.

10Children

R3P Fit is intended for adults aged 18 and over. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly. If you believe we have collected information from a child, please contact us at hello@r3p.fit.

11Changes to this policy

We may update this policy as R3P Fit evolves. Significant changes will be communicated to waitlist members via email. The "Last updated" date at the top of this policy indicates when it was last revised.

When the R3P Fit mobile app launches in summer 2026, this policy will be updated (or replaced with a new policy) to cover the app's data practices.

12Contact us

For questions about this policy, your data, or to exercise your rights, contact us:

If we need to provide a postal address for a formal request, we will supply one on request via email.