1. Controller and contacts
The data controller is VORREI GROUP S.R.L., Piața Victoriei 5, Timișoara, Romania, identifier RO52017137.
For privacy questions, access or deletion requests you can write to info@vorreigroup.com.
2. Which data we process
Account and role data
Name, username, email, optional profile image, protected credentials, optional gym membership, activation code or coupon used, assigned role — among the individual client, gym client, personal trainer and gym owner paths — and operational relationships between gym, personal trainer and member. Codes and coupons are stored as cryptographic hashes and not in clear text; we also keep the masked last part, the recipient indicated by the administrator, the expiry date and the essential redemption data.
Training-related data
Programs, exercises, sets, repetitions, loads, rest times, notes, calendar, completed or skipped sessions and history needed to show progress and activity to authorized people.
Optional Wellness data
If you voluntarily enable the feature, we process the routines you choose, days and times, values or notes you enter, completed, postponed or skipped activities, time zone and reminder preferences. They may cover, for example, supplements already chosen, hydration, meals, sleep, mobility, recovery, check-ins, measurements and appointments. MakoSet does not calculate dosages, does not make diagnoses and does not infer sports fitness.
Optional gallery and photo check-ups
If you choose to use this feature, we process front, side and back photographs, optional videos, capture date, pose, notes and optional weight. If you separately request AI analysis, we also process the selected comparison, the technical image quality, the structured result, the model used, tokens and the technical cost of the request. These are particularly sensitive data and the feature is reserved for adults.
Technical data
IP address, essential browser and device information, sessions, security logs and data needed to diagnose errors, prevent abuse and keep the service running.
3. Wellness and push notifications
Wellness is personal, optional and separate from operational panels: the gym and personal trainer cannot automatically view routines, supplements, sleep, pain, measurements, notes or completions. Technical support may access the data only when strictly necessary for security or authorized assistance.
Notifications are enabled only after an explicit action by you. We store in encrypted form the endpoint and technical subscription keys, the browser or device type, essential delivery outcomes and identifiers needed to avoid duplicates. The browser or operating system push provider receives the technical data indispensable for delivery.
By default, a generic text appears on the lock screen. You can choose to show the activity name, set quiet hours, disable a device or fully revoke the feature. The operating system may delay a notification: the internal timeline remains the reference for activity status.
From the Wellness area you can export your data, disable the feature while keeping history, or delete routines, records and push devices. Operational deletion is immediate; any technical backup copies follow the normal security rotation.
4. Private gallery and AI photo check-up
The gallery is optional and private by default. The gym, owner and personal trainer cannot view it automatically. Any future sharing will require a separate, specific and revocable user command; simply uploading does not authorize any sharing.
We require two distinct choices: one to keep content in the private gallery and one to send only the photographs needed for the requested AI comparison. You can use the gallery without enabling analysis, and the first capture creates only the initial reference without calling the model.
Photographs are resized and re-encoded to remove EXIF metadata and GPS location before storage. Videos recorded inside MakoSet do not require the microphone; those chosen from the device are re-encoded without audio and the server rejects files in which it detects a sound track. Files are stored in a private Backblaze B2 container in the European Union; MakoSet saves only opaque references and technical metadata in its own database. Viewing happens through temporary personal authorizations. Files do not enter the app offline cache.
When you request a comparison, the selected photographs are sent to the OpenAI API with the parameter store: false; MakoSet does not enable application-level retention of the response at the provider, without prejudice to any technical security logs provided for by the provider’s policies. The result only describes possible visible variations and the comparability of the shots. It does not perform facial recognition, does not estimate body-fat or muscle-mass percentages, does not make diagnoses, does not assess injuries and does not automatically change the program.
You can delete a single check-up from the gallery controls. Removal covers the database, files and thumbnails in the private container; any technical security copies follow the planned rotation. To prevent abuse and account for the service, minimal technical metadata of the call already made may remain, such as date, tokens and cost, without photographs, notes or result. Deleting a session does not return AI availability already used. You can also request access, export or full deletion by writing to info@vorreigroup.com.
5. Optional connection to Google, YouTube and Spotify
You can choose to connect an external account to see your playlists and use the player inside MakoSet. The connection happens in the provider’s official window via OAuth: MakoSet does not receive the password of your Google or Spotify account.
Data requested from Google and YouTube
Account identifier, name, email, avatar and read-only access to authorized YouTube data, including available playlists and their identifiers, titles and images. The requested scopes are openid, profile, email and youtube.readonly.
Data requested from Spotify
Account identifier, display name, optional avatar returned by the provider and authorized private or collaborative playlists, with identifiers, titles and images. The requested scopes are user-read-private, playlist-read-private and playlist-read-collaborative. The Spotify connection remains limited to accounts allowed by the Spotify program until the provider authorizes wider distribution.
Access and refresh tokens are stored encrypted and used to retrieve authorized content. The information obtained is used exclusively to show the account, playlists and player requested by the user and to keep the connection active.
MakoSet does not sell data received from Google, YouTube or Spotify and does not use them for behavioral advertising.
MakoSet’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revocation and disconnection
The connection is optional. You can disconnect it from MakoSet settings or revoke access from the connections of your Google account or from the provider’s security settings. Disconnection removes the associated connection credentials from MakoSet; a reasonable technical time may be needed before removal reaches rotating backup copies.
To request deletion of the connection or the entire account you can also write to info@vorreigroup.com from the address associated with the profile. We may ask you to verify your identity before proceeding.
6. Purposes and legal bases
- Provide the service: create access, separate roles, deliver programs, record workouts and show history. The basis is performance of the contract or measures requested before the contract.
- Optional Wellness: store routines, reminders and records only after your explicit activation and to offer you the requested feature. You can revoke the choice, export or delete the data from the available controls.
- Optional gallery and photo comparison: store content and, only if you request it with separate consent, analyze the images needed to produce the comparison. You can leave AI off or delete check-ups without giving up other MakoSet features.
- Connect external services: show the playlists and player chosen by the user based on their optional authorization to the provider.
- Protect MakoSet: prevent abusive access, fix errors and ensure service integrity on the basis of the legitimate interest of the controller and users.
- Meet obligations: retain what is required by tax, accounting or administrative rules or by lawful orders of the authorities.
- Analytics and marketing measurement: use tools such as Google Analytics or Meta Pixel only after consent, to understand site use or measure campaigns. You can refuse or change the choice anytime.
7. Who may receive the data
Operational data are visible only according to role: the member sees their own path; the trainer sees the clients assigned to them; the gym manages people, programs and relationships of its own facility; technical administration accesses only when needed for support, security and operation. Wellness content and the photo gallery remain excluded from gym and trainer views.
We may use technical providers for hosting, email, security and maintenance. Payments are processed by Stripe. Backblaze provides the private media container and OpenAI processes images only when you request the AI comparison. When you connect a music service, Google/YouTube or Spotify process data under their respective terms and policies. We do not disclose data to third parties to sell them.
If a provider processes data outside the European Economic Area, we adopt the applicable safeguards required by law, also taking into account the conditions of the provider chosen by the user.
8. Retention and security
We retain accounts, roles and training data for the time needed to provide MakoSet and, after closure, for the period reasonably needed to manage legal obligations, disputes and security. Wellness data and photo check-ups remain available while you use the related feature or until you delete them. Revoked push subscriptions are no longer used and are deleted with Wellness data deletion. Data linked to Google or Spotify remain available while the connection is active or until you request removal.
We adopt technical and organizational measures proportionate to the risk, including access control, separation by role and gym, protected connections and encryption of external tokens. No Internet-connected system can however be considered free of all risk.
10. Your rights
In the cases provided by the GDPR you can request access, rectification, erasure, restriction, portability and objection to processing, and revoke an authorization without affecting operations already lawfully carried out. You can also lodge a complaint with the competent supervisory authority.
Write to info@vorreigroup.com. We will reply without undue delay and within the time limits set by law, after the checks needed to protect the account.
11. Changes to this policy
We may update this page when MakoSet, connected providers or applicable obligations change. The date at the top indicates the latest version; for material changes we will also use, when appropriate, a notice in the service.
This text describes the processing planned for the service and is provided for information; it does not constitute legal advice for gyms, trainers or other parties that use MakoSet as their own organizational tools.