Goro Privacy Policy

This Privacy Policy explains how TANAB TECHNOLOGIES JOINT STOCK COMPANY (“TanabTech”, “we”, “our”, or “us”) collects, uses, stores, and shares personal data when you use Goro: Your AI workout buddy (the “Service”). It is written to support compliance with the EU General Data Protection Regulation (GDPR), Vietnam Decree No. 13/2023/ND-CP on Personal Data Protection, and similar privacy laws.

1. Who we are

Plain English: TanabTech is the company responsible for the app and for answering your privacy requests.

The data controller is TANAB TECHNOLOGIES JOINT STOCK COMPANY, business registration number 0319397744, based in Ho Chi Minh City, Vietnam. Contact us at contact@tanabtech.com.

2. Data we collect

Plain English: we collect the information needed to run your account, grade your sets, and keep your report history.

• Account data: a unique user ID, email address, and sign-in information from Google Sign-In, Sign in with Apple, or email verified with a one-time code.
• Workout video: the short training clips you record in the app or choose from your photo library for a form check.
• Rep report data: the exercise detected, form score, verdict, and coaching notes generated for each set, plus your report history in the Vault.
• In-app preferences: lightweight, on-device settings such as which exercise-demo variant you tend to open, used only to personalize what you see in the Exercises tab.
• Payment and subscription data: subscription status and transaction records processed directly through Apple’s and Google’s in-app purchase systems. We do not store your payment card details.
• Technical data: device model, operating system, app version, IP address, crash logs, and diagnostics.
• Usage data: feature interactions, session events, and aggregate analytics used to improve the product.

3. Workout video and AI form-check processing

Plain English: your workout video is sent to Google’s Gemini AI models so Goro can detect the exercise and grade your form; it is not reviewed by a human trainer.

When you submit a set for a form check, the video is processed by Google Gemini models to identify the exercise, observe your movement, and generate the rep report (form score, what to keep doing, and what to fix next). We use API terms with Google that restrict the use of this data to train Google’s public models. Processed video may be stored on our cloud storage so the report and its source clip remain available in your Vault.

AI feedback can be wrong, incomplete, or unsuitable for your situation. Goro is not a personal trainer, physical therapist, or medical professional — use your own judgment, and stop an exercise if something hurts.

4. What we do not do

• We do not sell, rent, or trade your personal data.
• We do not use your workout videos or reports for advertising or ad targeting.
• We do not use your videos to train public AI models.
• We do not store your full payment card details.

5. How we use your data

• Contractual necessity: creating your account, running form checks, storing your Vault history, and providing subscription features.
• Legitimate interests: improving detection accuracy, debugging, abuse prevention, security, and reliability.
• Consent: push notifications and any optional marketing communications.
• Legal obligation: tax, accounting, regulatory compliance, and responding to lawful requests.

6. Who we share data with

Plain English: we share data only with the infrastructure providers needed to run Goro, and with the app stores.

• Google: Gemini AI processing for form-check analysis, and Google Sign-In authentication.
• Cloud storage and hosting providers: workout video and media storage, plus database hosting for accounts and rep reports.
• Apple Inc. and Google LLC: app distribution, sign-in, in-app purchases, and push notification delivery.
• Professional and legal advisers: only when needed for compliance, disputes, audits, or legal obligations.

We may disclose data if required by law, court order, regulator request, or to protect the rights, safety, and security of users, TanabTech, or the public.

7. Push notifications

The Service may send optional push notifications, for example when a report is ready. You can enable or disable notifications in your device settings.

8. Data retention

• Account data: retained while your account is active, plus a limited period after deletion for recovery and operational safeguards.
• Workout videos and rep reports: retained while your account is active so your Vault history stays available, until you ask us to delete your account or specific data.
• Technical and diagnostic logs: deleted or anonymized within 90 days where practical.
• Payment records: retained for up to 7 years where required for tax, accounting, or legal compliance.

9. Your rights and choices

Depending on where you live, you may have rights to:

• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your personal data, including workout videos and rep reports;
• restrict or object to certain processing;
• export your data in a machine-readable format;
• withdraw consent where processing is consent-based;
• lodge a complaint with a supervisory authority.

To exercise any of these rights, email contact@tanabtech.com with “privacy” in the subject line. We will respond within 30 days unless law allows or requires a different timeframe.

10. Security and breach notification

We use encryption in transit, access controls, provider security controls, and limited internal access. If we discover a personal data breach, we will notify the relevant authorities and affected users within timeframes required by applicable law, including GDPR and Vietnam Decree 13/2023/ND-CP.

11. Children

The Service is intended for users aged 18 and older. Do not create an account or use the Service if you are under 18. If we learn that we collected personal data from a child or minor in violation of this policy, we will delete it promptly.

12. International transfers

To deliver the Service, your data may be transferred to and processed in countries where TanabTech and our providers operate, including Vietnam and the United States. We use contractual, technical, and organizational safeguards, including Standard Contractual Clauses where required by GDPR and transfer records required by Vietnam Decree 13/2023/ND-CP.

13. Changes to this policy

We may update this policy. Material changes will be communicated through the app, the website, or email where appropriate. Continued use of the Service after an update means the updated policy applies.

14. Contact

TANAB TECHNOLOGIES JOINT STOCK COMPANY · Ho Chi Minh City, Vietnam · contact@tanabtech.com

For the website-only policy, see Website Privacy Policy. For the AI Habit Coach app, see AI Habit Coach Privacy Policy.