Privacy Policy

1. Who we are

BodyTrajectory operates this site and is the data controller for the personal data described below. Our registered address is available upon request. For any privacy question or to exercise a right, contact us at morphme2026@outlook.comCopy, and we will action it.

2. What we collect

We collect only what is needed to compute and deliver your projection:

• Your email address, so we can deliver your report and answer you if something goes wrong.
• The body details you type in: height, weight, age, gender and activity level.
• Your choices: the scenarios you select and the goal timeline in weeks, plus any optional fields you choose to fill in (for example a current waist measurement or a body-fat category).
• Order and payment records: order status, amounts and timestamps. Card and bank details are handled by our payment provider and never reach us.

3. What we do not collect

We do not collect photographs. BodyTrajectory does not ask you to upload a picture and there is no photo upload anywhere in the product. We do not run facial recognition, face detection or any other biometric analysis, and we do not create an account or a profile for you.

4. Special category data (GDPR Article 9)

This section is worth reading carefully, because it is the part that concerns your health. To produce a projection we calculate body mass index, estimated body fat, lean mass and six circumference measurements from the details you enter. Information about your body composition and measurements is data concerning health, which GDPR Article 9 treats as a special category of personal data needing a stronger basis than ordinary personal data.

Our basis is your explicit consent (Article 9(2)(a)). We ask for it before your order is created, it is a separate confirmation from the age check and from accepting our terms, and it is not pre-ticked. The consent is enforced on the server: a request without it is rejected and no report is generated.

You can withdraw it at any time. Ask us at morphme2026@outlook.comCopy and we will stop processing on that basis and delete the data concerned, unless we are required to keep it for tax or accounting purposes. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it. You may also ask us not to send your measurements to DeepSeek at all, in which case your report is produced from our built-in template and is still delivered in full (see section 6).

5. Why we use it

Your body data is used for one purpose only: to generate your prediction and your report, and to deliver it to you. We do not sell your data, we do not use it for advertising, and we do not send your measurements to our analytics (section 7). We may use anonymised, aggregated results to improve our models; no personally identifiable information is used for that.

6. Who processes it, and where

We work with trusted processors to run the service: Vercel (hosting), Supabase (database), PayPal (payments) and Resend (email delivery). Each is bound by a data processing agreement, and where personal data is transferred outside the EEA we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment. Copies of those safeguards are available on request at morphme2026@outlook.comCopy.

DeepSeek, and transfers to China. If you choose a personalised action plan, the details needed to tailor it (age, gender, height, weight, activity level, BMI, estimated body fat, lean mass, goal timeline and scenario name) are transmitted to DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) for processing under its own terms as our processor. No email address and no identifying account information is included in that request. Transfers to China are covered by the Standard Contractual Clauses. If you would prefer that your measurements are not sent to DeepSeek, tell us before or after your order and we will generate your report from our built-in template instead.

7. Analytics and cookies

We use Umami for analytics. It is cookieless, does not collect personal data, does not fingerprint you and does not build a profile of you across other sites. It records aggregate page views and a small set of product events, such as whether a report was generated or a share card was created. We do not send your body measurements, your body fat, your circumferences or your BMI to analytics, and we do not send your email address either. We do not set tracking or advertising cookies. A small preference may be stored in your browser to remember your cookie choice.

8. How long we keep it

Order records, including your email address, the body details you entered and their timestamps, are kept for 24 months for refund, tax and accounting purposes, then deleted or anonymised. Free body-score records are subject to the same retention period. Records needed to honour an unsubscribe request are kept for as long as necessary to keep honouring it. There are no photographs to retain.

9. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, email us at morphme2026@outlook.comCopy and we will respond within one month. If you are not satisfied with our response you may complain to your local supervisory authority.

10. Children

BodyTrajectory is not intended for anyone under 18. We do not knowingly collect personal information from children under 13 (COPPA) or from minors under 18. If you believe a child's data was submitted, contact us and we will delete it.

11. California and Washington residents

Under the California Consumer Privacy Act (CCPA), California residents may request details about the personal information we collect, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes other than providing the service.

Washington residents have additional rights over "consumer health data" under the My Health My Data Act. See our Consumer Health Data Privacy Policy.

12. Security and breach notification

Access to stored data is restricted to the service role and to administrators, and the database is reachable only with server-side credentials. In the event of a personal data breach, we will notify affected users and the relevant authorities as required by law.

13. Changes to this policy

If we change how we handle your data we will update this page and the date at the top. Material changes affecting existing orders will be communicated by email. The summary form of this policy also appears in our FAQ; if the two ever disagree, this page is the authoritative version.