Last updated: 10 September 2026
BEVA is operated by Intervalle Technologies Ltd, a company registered in Ireland, whose registered office is at Unit 103, Castleknock Square, Castleknock, Dublin, D15 X2FK, Ireland.
For the purposes of the General Data Protection Regulation (GDPR), Intervalle Technologies Ltd is the data controller for the personal data described in this policy.
You can reach us about anything in this policy at hello@getbeva.com.
This policy explains what personal data BEVA collects, why we collect it, what we do with it, who else sees it, and the rights you have over it. It applies to the BEVA website at getbeva.com and to the BEVA mobile applications.
Account data. Your name, your email address, and a cryptographically hashed version of your password. We never store your password itself.
Profile data. Your date of birth, sex, height, weight, training experience, available equipment, how many days a week you can train, how long your sessions can be, and your goals.
Health data. Injuries and physical limitations you tell us about, pain or discomfort you report, medical conditions you disclose, your body measurements and how they change over time, how you describe your recovery, sleep and energy, and the notes you write during or after a session.
Training and activity data. The sessions BEVA writes for you, the exercises, sets, repetitions and weights you log, and the records you keep of other activities such as running, football or boxing — including duration, distance, how hard it felt, and any notes you add.
Messages to the coach. Everything you write to BEVA's AI coach, and the replies it gives you.
Photos. A profile photo, if you choose to upload one.
Technical data. A session cookie that keeps you signed in, and standard server logs recording requests to our service, including IP address and browser type, kept for security and diagnostic purposes.
We do not collect payment card details, and we do not use advertising or analytics trackers.
Most of what BEVA needs to coach you well — injuries, pain, medical conditions, body measurements, how you are recovering — is health data, which GDPR treats as a special category of personal data under Article 9. Special-category data may only be processed on narrower grounds than ordinary personal data.
We rely on your explicit consent under Article 9(2)(a). That is why BEVA asks you to consent separately, in clear terms, before you can use the service, rather than bundling it into our terms.
You can withdraw that consent at any time, from Settings. Withdrawing it is as easy as giving it. When you withdraw:
Because coaching is what BEVA does, withdrawing consent means the service can no longer function for you. We would rather say that plainly than pretend otherwise.
| What we do | Why | Legal basis |
|---|---|---|
| Create and maintain your account | To give you access to BEVA | Performance of a contract — Article 6(1)(b) |
| Generate and adapt your training programme | Because it is the service you asked for | Contract — Article 6(1)(b), and explicit consent for health data — Article 9(2)(a) |
| Calculate nutrition targets | Same | Contract, and explicit consent for health data |
| Answer your questions through the AI coach | Same | Contract, and explicit consent for health data |
| Screen what you write for signs of pain or injury, and respond | To keep you safe, and to stop BEVA giving you advice that could hurt you | Explicit consent — Article 9(2)(a), and our legitimate interest in user safety — Article 6(1)(f) |
| Keep the service secure, prevent abuse, and diagnose faults | To run a service that works and is not attacked | Legitimate interests — Article 6(1)(f) |
| Send you service emails, such as password resets | To operate your account | Contract — Article 6(1)(b) |
We do not sell your personal data. We do not share it with advertisers. We do not use it to build profiles for anyone other than you.
We use a small number of service providers, each of which processes data only on our instructions and under a written data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Neon | Hosts our database | Germany (EU) |
| Vercel | Hosts and serves the application | Germany (EU) |
| Vercel | Stores your profile photo | Ireland (EU) |
| A specialist AI provider | Generates the AI coach's replies | United States |
| Resend | Sends service emails | Ireland (EU) |
We will name our current service providers to any user who asks — write to hello@getbeva.com.
International transfers. Your messages to the AI coach, and the context needed to answer them — which can include health information you have written — are sent to a specialist AI provider in the United States to generate a reply. That transfer is made under the European Commission's Standard Contractual Clauses, together with the supplementary measures required by them. That provider does not use this content to train its models.
Our hosting provider is a company established in the United States. Your account data, your health data and your training history are stored and processed on infrastructure located in the European Union, but limited operational and diagnostic records — such as request logs — may be processed by that provider outside the European Union, under Standard Contractual Clauses.
Apart from those two cases, your data stays within the European Union.
We keep your data for as long as your account exists, because a training programme that adapts over time needs your history to adapt from.
When you delete your account, we delete your personal data permanently, across every table that holds it. Deletion is irreversible: we cannot restore an account or a photo once it has been deleted. Server logs containing technical data are retained for up to 30 days and then discarded.
If you withdraw your consent to health-data processing without deleting your account, we delete your health data and programmes at that point.
Under GDPR you have the right to:
To exercise any right that isn't already a button in the app, write to hello@getbeva.com. We will respond within one month.
If you believe we have handled your data improperly, you have the right to complain to a supervisory authority. Ours is the Data Protection Commission of Ireland — dataprotection.ie — and you may also complain to the authority in the EU country where you live.
BEVA sets one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to work, it contains no tracking identifier, and it is deleted when you sign out. We do not use advertising, analytics or third-party cookies, which is why BEVA does not show you a cookie banner.
BEVA is for adults. You must be 18 or over to create an account, and we ask you to confirm this when you sign up. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, write to hello@getbeva.com and we will delete it.
Passwords are hashed and never stored in readable form. All traffic is encrypted in transit. Your profile photo is stored in private storage that is not publicly addressable. Access to production data is restricted to those who need it to operate the service.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and, where the risk is high, notify you directly.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the app before it takes effect. Where a change affects the basis on which we process your health data, we will ask for your consent again rather than assume it.
Intervalle Technologies Ltd Unit 103, Castleknock Square Castleknock, Dublin, D15 X2FK Ireland
hello@getbeva.com
Version beda9496cd58