Privacy Policy
Last updated: August 19, 2026. We are committed to GDPR compliance.
This is the summary form of our privacy terms. The full policy, including our retention periods and the legal bases for processing, is the Privacy Policy; if the two ever disagree, that page is the authoritative version.
Data controller. BodyTrajectory is operated by BodyTrajectory. For privacy matters, contact us at morphme2026@outlook.com. The controller's registered address is available upon request.
Your body data is used for one purpose only. The metrics you enter are used solely to generate your prediction and your report. We do not sell them, and we do not use them for any other purpose.
What we collect. When you place an order we collect your email address and the body metrics you enter (height, weight, age, gender, activity level, and any optional details you choose to provide). If you use the free body score we collect your email address and your height, weight and gender. We do not collect photographs: there is no photo upload anywhere in the product.
Special category data (Article 9). This part matters most. From the details you enter we calculate body mass index, estimated body fat, lean mass and six circumference projections. Information about your body composition and measurements is data concerning health, which GDPR Article 9 treats as a special category of personal data requiring a stronger basis than ordinary personal data.
Our basis is your explicit consent (Article 9(2)(a)). We ask for it as a separate confirmation from the age check and from accepting these terms, it is never pre-ticked, and it is enforced on the server: a request without it is rejected and no report is generated. You can withdraw your consent at any time by emailing morphme2026@outlook.com; we will then stop processing on that basis and delete the data concerned, unless we are required to keep it for tax or accounting purposes. Withdrawing consent does not affect processing carried out before you withdrew it.
Our basis is your explicit consent (Article 9(2)(a)). We ask for it as a separate confirmation from the age check and from accepting these terms, it is never pre-ticked, and it is enforced on the server: a request without it is rejected and no report is generated. You can withdraw your consent at any time by emailing morphme2026@outlook.com; we will then stop processing on that basis and delete the data concerned, unless we are required to keep it for tax or accounting purposes. Withdrawing consent does not affect processing carried out before you withdrew it.
Data processors. We work with trusted processors to run the service: Vercel (frontend hosting), Supabase (database and storage), PayPal (payments), DeepSeek (AI-personalised action plan) and Resend (email delivery). Each is bound by a Data Processing Agreement, and where personal data is transferred outside the EEA we rely on the European Commission's Standard Contractual Clauses. Copies of our Data Processing Agreements are available upon request.
International transfers, including China. One of our processors is located in, and stores data in, mainland China: DeepSeek (action-plan generation). When you choose a personalised action plan, the metrics needed to tailor it (age, gender, height, weight, activity level, BMI, estimated body fat, lean mass, goal timeline and scenario name) are transmitted to DeepSeek for processing. No email address and no identifying account information is included in that request. Transfers to China are covered by the European Commission's Standard Contractual Clauses together with a transfer impact assessment; you can request a copy of these safeguards at morphme2026@outlook.com. If you would prefer that your metrics are not sent to DeepSeek, tell us before or after your order and we will generate your report from our built-in template instead, and the report is still delivered in full.
Data retention. Order records (email, plan, body metrics, timestamps) are kept for 24 months for refund, tax and analytics purposes, then anonymized or deleted.
Data breach notification. In the event of a personal data breach, we will notify affected users and relevant authorities as required by law.
Your rights. Under GDPR you have the right to access, rectify, or erase your personal data, and to object to or restrict processing. To exercise any of these rights, email us at morphme2026@outlook.com.
Free body score data. The email address and body metrics you provide for a free body score are used only to prepare and deliver your score, and are subject to the same retention policy described above.
Children's privacy. BodyTrajectory is not intended for anyone under 18. We do not knowingly collect personal information from children under 13 (COPPA) or from minors under 18. If you believe a child's data was submitted, contact us and we will delete it.How we check this: the age gate is a self-declaration. The order form requires you to tick a box confirming you are 18 or older, and the server rejects any order that arrives without it. We do not ask for a date of birth and we do not run an identity or age-verification service, so the gate stops accidental use by minors rather than proving anyone's age.
California residents. Under the California Consumer Privacy Act (CCPA), California residents may request details about the personal information we collect, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information. California residents may also limit the use or disclosure of their sensitive personal information. We do not use or disclose sensitive personal information for purposes other than providing the service. To exercise a right, email us at morphme2026@outlook.com.
Anonymous product improvement. We may use anonymized, aggregated results to improve our models. No personally identifiable information is used for this.