Skip to content

Privacy Policy

Last updated: April 20, 2026

This Privacy Policy explains how IYC GROUP LLC (hereinafter “we”) collects, uses, and protects your personal data when you use TwelveReps.

This policy is aligned with the General Data Protection Regulation (GDPR 2016/679), the California Consumer Privacy Act (CCPA), and other applicable legislation.

1. Data Controller

IYC GROUP LLC
75 E 3rd St, Sheridan, WY 82801, USA
EIN: 41-5289848
Data Protection Officer (DPO) email: privacy@iycgroup.com

2. Data We Collect

2.1 Data you provide

  • Contact details: email, full name.
  • Health & wellness data: age, gender, height, weight, weight goals, activity level, dietary preferences, medical conditions (only what you declare in the questionnaire).
  • Payment information: securely processed through our payment provider and not stored by us.

2.2 Data collected automatically

  • Technical data: IP address, device type, operating system, browser.
  • Usage data: interactions with the Service, pages you visit, time and duration of your visit.
  • Cookies & similar tools — see the “Cookies” section below.

3. Purpose & Legal Basis for Processing

  • Providing the Service (performance of a contract): creating a personalized plan based on your answers.
  • Payments (performance of a contract): managing subscriptions and billing.
  • Communication (consent / legitimate interest): updates about your plan, news, offers.
  • Security & fraud prevention (legitimate interest).
  • Legal compliance (legal obligation).

4. Sharing Your Data

We do not sell your data. We share data only in the following cases:

  • Service providers: hosting (Vercel), email (Resend), payments (Stripe), analytics. All are bound by data protection agreements.
  • Authorities: where required by law or a court order.
  • In the event of a corporate transfer (merger, sale), with prior notice to you.

5. International Data Transfers

Because the company is based in the U.S., your data may be transferred outside the European Economic Area. We apply the EU Standard Contractual Clauses (SCCs) and appropriate technical measures to protect it.

6. Retention Period

  • Account details: for as long as you keep your account + 2 years.
  • Payment records: 10 years (tax obligation).
  • Marketing data: until you withdraw your consent.

7. Your Rights

You have the right to:

  • Request access to your data.
  • Request correction or deletion.
  • Restrict processing or object to it.
  • Receive your data in a structured, portable format.
  • Withdraw your consent at any time.
  • File a complaint with your local supervisory authority (e.g. the ANPD in Brazil, or your EU data protection authority).

To exercise your rights, send an email to privacy@iycgroup.com. We will respond within 30 days.

8. Security

We use TLS encryption for data in transit, at-rest encryption for stored data, restricted staff access, and regular security audits.

9. Cookies

We use cookies and similar technologies that are essential for the website to function, as well as analytics and advertising cookies (e.g. Google, Meta, TikTok) that help us measure performance and improve our marketing. You can block or delete cookies at any time through your browser settings.

10. Minors

The Service is not directed to individuals under 18. If you have reason to believe that a child has provided us with data, please contact us immediately.

11. Changes to This Policy

We will notify you before any material change. The last update date is shown at the top of the page.

12. Contact

For questions: privacy@iycgroup.com or via our contact form.

13. Users in Brazil (LGPD)

If you are in Brazil, we process your personal data in accordance with the General Data Protection Law (LGPD, Law No. 13.709/2018). Our Data Protection Officer (encarregado) can be reached at the DPO email above. The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD). We rely on the legal bases set out in Article 7 of the LGPD (including consent, performance of a contract, and legitimate interest), and you may exercise the rights set out in Article 18 (confirmation, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent).