Privacy Policy

Last Updated: October 11, 2026

1. Introduction

This Privacy Policy explains how KRAUCH ("we", "us", or "our") collects, uses, stores, and protects personal data when you use our website and Digital Products and Services.

"Digital Products and Services" means our online courses, electronic books (e-books), subscription-based applications (including calorie tracking tools), coaching and consultation services, and any other digital content or digital services we provide through the website and Telegram bot.

We process personal data in accordance with the General Data Protection Regulation (GDPR), Czech data protection laws, and other applicable international privacy regulations.

2. Data Controller

The data controller responsible for your personal data is:

Olena Lishchuk (OSVČ)
Business name: KRAUCH
Address: Kaprova 42/14, 110 00 Praha 1, Czech Republic
Email: coach@krauch.fit

3. Information We Collect

3.1 Personal Data You Provide

When you create an account, purchase Digital Products and Services, or contact us, we may collect:

  • Name (first and last name)
  • Email address
  • Phone number
  • Billing details needed for invoicing and tax compliance
  • Language preference (for email communications)

3.2 Payment Information

Payments are processed securely by Stripe. We do not store full payment card details. Stripe processes payment data under its own privacy policy and may act as a separate controller or a processor depending on the operation.

3.3 Free Tools Data

We offer free tools on our website. When you use these tools, we may collect and process certain data depending on the tool. Our current tools include:

  • Why Don't You Get Lean Quiz, Water Intake Calculator, Calorie Calculator, Macro Calculator

Why Don't You Get Lean Quiz: When you complete our Why Don't You Get Lean quiz, we collect your quiz responses about your health, lifestyle, habits, and goals, along with your calculated readiness score and timestamp of submission. Your email address is used only to send your results and is not stored. Quiz responses are stored in a fully anonymized format with no personally identifiable information.

Water Intake Calculator: When you use our Water Intake Calculator, we collect the parameters you enter (weight, gender, activity level, climate) and the calculated result. This data is stored anonymously and is not linked to your account or any personally identifiable information.

Calorie Calculator: When you use our Calorie Calculator, we collect the parameters you enter (weight, height, age, gender, goal, steps per day, training frequency, activity intensity) and the calculated result. This data is stored anonymously and is not linked to your account or any personally identifiable information.

Macro Calculator: When you use our Macro Calculator, we collect the parameters you enter (weight, height, age, gender, goal, target weight, steps per day, training frequency, activity intensity, and optionally body composition) and the calculated macro targets. This data is stored anonymously and is not linked to your account or any personally identifiable information.

You control what you enter in our tools. Please avoid entering sensitive medical information. We do not provide medical advice. These tools are for informational purposes only.

Legal basis: Your explicit consent, given when you submit data through any of these tools.

3.4 Contact Form Data

When you submit an inquiry through the contact form on our course pages or promotional pages, we collect:

  • Your name (first and last name)
  • Your email address
  • The content of your question or message
  • The course, module, and lesson you submitted the inquiry from
  • The source page of your inquiry

Purpose: To respond to your inquiry and provide assistance related to your course or promotional offer.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in responding to customer inquiries, and contract performance (Art. 6(1)(b) GDPR) as the inquiry relates to services you have purchased.

Retention: Contact form data is automatically deleted after 6 months. You can also request early deletion of your inquiries at any time by contacting us.

3.6 Coaching, Consultation, and Telegram Bot Data

When you use our coaching or consultation services via the Telegram bot, we collect:

  • Telegram user ID and username
  • Questionnaire responses: age, sex, weight, fitness goal, training experience, activity level, health limitations, consultation topic, and optional comments
  • Selected service package and promo codes used
  • Payment status and Stripe session identifiers
  • Initial consultation topic or question submitted via the bot (visible only to coaches, not shared publicly)
  • Selected coach and scheduled consultation date and time

Purpose: To process your service request, match you with appropriate coaching guidance, process payment, and enable the coach to provide the selected service.

Legal basis: Contract performance (Art. 6(1)(b) GDPR) for service delivery, and your explicit consent given when you submit questionnaire data.

Retention: Questionnaire data is retained for the duration of service delivery plus 6 months. Payment records are retained up to 10 years for tax compliance. You can request deletion of non-legally-required data at any time.

Coaching and consultation services are not medical, dietetic, or psychological services. We share personal experience and knowledge. Results are individual.

3.5 Technical and Usage Data (With Your Consent)

With your consent, we may collect technical information such as:

  • Browser type and version
  • Operating system
  • Pages visited and interaction data
  • Referring URL
  • Date and time of access

3.7 Application and consultation booking form data

On the application page for the Desired Body Workshop and the free diagnostic consultation booking page we collect the data you enter yourself:

  • name
  • Instagram handle
  • answers to the form questions: your request, target weight loss and readiness to invest in the work
  • phone number — only if you left one in the earlier version of the form; the form no longer asks for it
  • technical data: IP address, browser details, the page address and the link tag you arrived through; Meta advertising identifiers only if you allowed the marketing category in the cookie banner

Purpose: to contact you about your application, prepare for the consultation and understand which posts bring applications. If you allowed the marketing category in the cookie banner, we send Meta — in hashed form — the fact of the application, the payment option you chose and, if you later pay, the amount, so we can see which advertising brings clients. A payment is linked to the application the coach marks in the contract; for applications from the earlier form, also by phone number. Without that consent nothing is sent to Meta.

Legal basis: steps taken prior to entering into a contract (Art. 6(1)(b) GDPR) for handling the application and contacting you; your consent (Art. 6(1)(a) GDPR) for sending data to Meta, which you give in the cookie banner. Consent can be withdrawn at any time in the cookie settings or by writing to us.

Retention period: kept for as long as it is needed to contact you and work on your request, and deleted when you ask us to. Answers from incomplete forms are not stored: a record is created only when the final step is submitted. Separately, we count how many times the form was opened and sent — these are only daily totals, with no data about the visitor. Your IP address does not enter these counts: the server holds it in memory for about an hour, solely to protect against abuse.

4. Cookies and Tracking Technologies

We use browser storage (localStorage and sessionStorage) and similar technologies to ensure website functionality and improve user experience. Below is a complete list of data we store in your browser:

4.1 Essential Storage (Required, No Consent Needed)

This data is strictly necessary for the website to function and cannot be disabled:

  • krauch_cookie_consent - Records whether you have made a cookie consent decision (localStorage, persists until cleared)
  • krauch_cookie_preferences - Stores your cookie category preferences as JSON (localStorage, persists until cleared)
  • krauch-language - Stores your preferred language setting: English, Russian, or Ukrainian (localStorage, persists until cleared)
  • accessToken - JWT authentication token for logged-in users (localStorage, cleared on logout)
  • refreshToken - Token used to maintain your session securely (localStorage, cleared on logout)
  • countdown_target_date - Stores the target date for promotional countdown timers (localStorage, persists until cleared)
  • krauch-lang - Stores your preferred website language (cookie, 1 year expiry)
  • krauch.form.<form>.<tag> - Marks that you have already sent an application through this link, so that reopening it shows the confirmation instead of an empty form (localStorage, kept until cleared)

4.2 Analytics Cookies and Data (Consent Required)

With your consent, we use the following cookie and collect analytics data:

  • analyticsSessionId - A session cookie containing a randomly generated session identifier (expires when you close your browser)
  • Ad source tracking - If you arrive via a marketing campaign (UTM parameters in URL), we record the source, medium, and campaign name
  • Page view tracking - We record which pages you visit to understand popular content
  • Application form completion - On the Workshop application and consultation booking pages: how far a visitor got, which fields they started filling in, which field showed them an error hint and on which field they left the page. Your answers themselves are not sent. This data is kept only as daily totals — with no cookie, no visitor identifier and no link to a browser fingerprint — and we do not link it to submitted applications.

The data in the first three items is associated with an anonymous browser fingerprint (derived from technical browser characteristics) and is not linked to your personal account unless you are logged in. Form completion statistics are not linked to a fingerprint.

4.3 Marketing Cookies (Consent Required)

With your consent, mini-course pages and the Workshop application and consultation booking pages use the Meta (Facebook) Pixel to measure advertising performance:

  • _fbp - Meta Pixel cookie holding a browser identifier that links your visit to an ad (expires after 90 days)
  • _fbc - stores the ad click identifier (fbclid) from the link you arrived through (expires after 90 days)
  • Conversion events - mini-course page views, checkout starts and completed purchases. Purchases are additionally reported to Meta from our server (Conversions API), sending your name, email and phone as irreversible SHA-256 hashes, along with the amount and course name
  • Application sent - on the application pages: the fact that an application was sent and the payment option you chose. This event is also reported to Meta from our server (Conversions API), sending your name as an irreversible SHA-256 hash, along with your IP address, browser details and Meta advertising identifiers

This data is used to measure advertising performance and show relevant ads. Without your consent the pixel is not loaded and no purchase data is sent to Meta. You can withdraw your consent at any time via "Cookie Settings" in the site footer.

4.4 Third-Party Services

We use the following third-party services that may set their own cookies:

  • Stripe - Payment processing. Stripe may set cookies for fraud prevention and payment security. See Stripe's Cookie Policy at stripe.com/cookies-policy/legal
  • Bunny.net - Video content delivery. May set technical cookies for video playback optimization
  • Twilio - SMS verification codes. Used to send verification codes for password changes and account security. See Twilio's Privacy Policy at twilio.com/legal/privacy
  • Google OAuth - Authentication service. Used for account login and registration via Google. Google may set cookies for authentication purposes. See Google's Privacy Policy at policies.google.com/privacy
  • Facebook Login - Authentication service. Used for account login and registration via Facebook. Facebook may set cookies for authentication purposes. See Facebook's Privacy Policy at facebook.com/privacy/policy
  • Meta (Facebook) - Advertising analytics. The Meta Pixel and Conversions API are used on mini-course and application form pages to measure advertising performance (only with your consent to marketing cookies). See Meta’s Privacy Policy at facebook.com/privacy/policy

4.5 Essential Service Tracking (No Consent Required)

To enforce our Terms and Conditions (including our refund policy), we track the following when you access course content:

  • Lesson views - When you navigate to a lesson, we record which lesson was viewed, the timestamp, and associate it with your user account

This data is necessary for the performance of our contract with you (specifically, to verify content consumption when processing refund requests as described in our Terms). This tracking only occurs when you are logged in and actively using purchased course content.

4.6 Managing Your Preferences

You can manage your preferences at any time:

  • Use our cookie consent banner when you first visit the site
  • Click 'Cookie Settings' in the website footer to change your preferences
  • Clear your browser's localStorage and sessionStorage through browser settings or developer tools

Note: Clearing essential storage data will log you out and reset your language preference. You will need to log in again and reconfigure your settings.

5. How We Use Your Personal Data

  • To create and manage your account
  • To provide access to purchased Digital Products and Services (including enabling app features)
  • To process payments and issue invoices
  • To send quiz results and personalized recommendations
  • To analyze quiz responses in anonymized aggregate form
  • To send service-related updates and notifications
  • To respond to inquiries and provide support
  • To send marketing communications (only with your consent where required)
  • To improve our website, app, and services
  • To prevent fraud and ensure security
  • To comply with legal obligations
  • To track course content access for refund policy enforcement (see Section 4.4)

6. Legal Basis for Processing (GDPR)

  • Contract performance: to provide Digital Products and Services you purchased (account creation, access, app functionality)
  • Consent: analytics cookies and marketing communications where required
  • Legal obligation: accounting, tax, and compliance requirements
  • Legitimate interests: improving services, preventing fraud, and ensuring security (where not overridden by your rights)

You may withdraw consent at any time. This does not affect the lawfulness of processing based on consent before withdrawal.

7. Data Sharing and Disclosure

We do not sell your personal data. We may share data with service providers and where legally required.

7.1 Service Providers

  • Stripe: payment processing
  • Twilio: SMS verification codes for account security
  • Email service providers: transactional and marketing emails
  • Telegram: the messenger hosting the closed programme chats and the consultation bot. For the messenger itself Telegram acts as an independent controller: you use it under your own account and your own agreement with Telegram, and we have no data processing agreement with them
  • Analytics providers: only with your consent
  • Tally: form service used for participant questionnaires (EU)
  • Cloudflare: website hosting and protection against attacks and bots
  • MongoDB: database, servers in the European Union
  • Bunny.net: video content delivery (EU)
  • Sentry: tracking technical errors on the website and server — details of the failure, the request address and the browser type
  • Fly.io: hosting for the server that handles forms, payments and the personal account (Frankfurt, EU)

7.2 Legal Requirements

We may disclose information if required by law or to protect our rights, users, and the security of our services.

8. Data Retention

  • Account and access data: for as long as your account exists and/or access remains active
  • Accounting and invoicing data: up to 10 years as required by Czech and EU law
  • Marketing data: until you withdraw consent (or as otherwise permitted by law)
  • Coaching/consultation questionnaire data: for the duration of service delivery plus 6 months
  • Telegram bot interaction data: for the duration of service delivery plus 6 months

Where legal obligations apply, certain data cannot be deleted upon request.

9. Your Rights

Depending on your location, you may have the right to:

  • Access your personal data
  • Correct inaccurate or incomplete data
  • Request deletion where legally possible
  • Restrict processing or object to processing
  • Data portability
  • Withdraw consent at any time

To exercise your rights, contact us at: support@krauch.fit

9.1 How to Request Data Deletion

If you wish to have your personal data deleted from our systems, you can submit a data deletion request by sending an email to support@krauch.fit with the subject line "Data Deletion Request". Please include your full name and the email address associated with your account. We will process your request in accordance with applicable data protection laws and respond within 30 days. Please note that certain data may be retained for legal or legitimate business purposes as outlined in our data retention policy.

10. Automated Processing

Some processing is automated (for example, granting or restricting access after payment confirmation, subscription status changes, or access expiration). These processes do not produce legal or similarly significant effects.

11. Data Security

  • SSL/TLS encryption
  • Secure password hashing
  • Access control and authentication
  • Secure cloud infrastructure

No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

12. International Data Transfers

Personal data may be transferred outside the EEA. Where this happens, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

13. Children’s Privacy

Our services are not intended for individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete such data.

14. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices.

15. Data Protection Officer

We are not required to appoint a Data Protection Officer under GDPR. For any privacy inquiries, contact us directly via email.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with an updated revision date.

17. Supervisory Authority

If you are located in the EEA, you may lodge a complaint with your local data protection authority.