Privacy Policy

‍

Last updated: 31 August 2026

PLAYNICELY PTY LTD ("we", "us", "our"), a company registered in South Africa, operates the FITT16™ platform and is the party responsible for your personal information. We are committed to protecting your privacy and handling your data responsibly. This policy explains what data we collect, why we collect it, and your rights over it.

Our home data-protection framework is South Africa's Protection of Personal Information Act (POPIA), under which PLAYNICELY PTY LTD is the Responsible Party. Because FITT16 is available globally, we also apply the standards of the EU/UK General Data Protection Regulation (GDPR / UK GDPR) to all users regardless of location, and honour the equivalent rights they provide.

Payments are processed by Stripe and billed by our payments entity, PLAYNICELY MARKETING FZCO (Dubai, United Arab Emirates); FZCO's role is limited to billing for purchases (see Sections 4 and 5).

1. INFORMATION WE COLLECT

We collect:

Full name and email address
Account password (encrypted and hashed — never stored in plain text)
CliftonStrengths® Full 34 PDF (processed and then deleted from our servers)
Extracted talent theme data derived from your PDF
Your FITT16™ type and archetype
Reflective conversations with your AI Companion in the Navigator (held only transiently — see Sections 6 and 10)
Insights, notes, and summaries generated from your conversations and saved to your Journal
Career Calibration content — the reflections and realisations you record while working through the calibration, the readiness state derived from them, and the calibrated career direction you generate and confirm
Names and FITT16 types you add under "People in My Life" (stored privately for your use only)
Connections data — where you and another registered user agree to connect, we store, on each side of that connection, the other person's name, FITT16 archetype, and (used only in the background — see Section 6a) their top talent themes as they existed at the moment you connected, plus the relationship category you assign and any AI-generated relationship read and notes you keep
Marketing email preferences and consent date
Usage information (pages visited, interactions)
IP address and device metadata (including via our bot-protection provider, Cloudflare)
Payment information (handled entirely by Stripe — we do not store card details)

2. HOW WE USE YOUR DATA

We use your data to:

Generate your FITT16™ type and archetype
Display your personalised dashboard
Produce your downloadable PDF report
Power your AI Companion and Navigator sessions (self-directed reflection and navigation)
Provide session memory and continuity across your Navigator conversations
Generate the insights, summaries, and reflections that appear in your Discover area and Journal
Power the Career Calibration and generate your calibrated career direction
Power the Connections feature — generating a private read of the dynamic between you and someone you have connected with (see Section 6a)
Process payments, including optional purchases of access on behalf of another person ("sponsored seats")
Send you platform communications (account confirmations, security alerts)
Send you product updates and special offers — only if you have explicitly opted in
Improve the platform and user experience

We do not use your data for advertising. We do not sell or rent your data to third parties.

3. LEGAL BASIS FOR PROCESSING

Under POPIA, we process your personal information on the justifications it recognises (including your consent, performance of our contract with you, our legitimate interests, and compliance with the law). For users to whom GDPR / UK GDPR applies, the equivalent lawful bases are:

Account creation and platform access: Contract performance
AI navigation, report generation, Career Calibration, and other core features: Contract performance
The Connections exchange between two users: Consent (both users must explicitly invite and accept) and, thereafter, Contract performance to deliver the feature
Security and fraud prevention: Legitimate interests
Platform improvement: Legitimate interests
Marketing emails: Consent (explicit opt-in only)
Responding to data rights requests: Legal obligation

Where you enter reflective free-text into the platform, it is possible you may choose to include sensitive information (for example, about your health or beliefs). We do not ask for this and advise against entering information you would not wish to have processed; where such information is processed, we rely on your explicit consent given at sign-up and treat it with the additional care that special personal information requires.

4. WHERE DATA IS STORED

Your data is stored on servers provided by Supabase, hosted on Amazon Web Services infrastructure in the European Union (Stockholm, EU-North). Keeping the primary store in the EU is a deliberate data-minimisation and residency choice.

AI features (your AI Companion, the Navigator, Career Calibration, Connection reads, and generated insights) are powered by Anthropic's Claude API. Content sent to Anthropic is processed solely to generate your responses, reads, and interpretations, and is not used to train Anthropic's models. Before text reaches the AI, our system strips proprietary identifiers, and the full raw conversation is not retained (see Sections 6 and 10).

Email communications are sent via SendGrid (a Twilio company). Bot protection (Turnstile) and content delivery are provided by Cloudflare. Account sign-in with Google uses Google's authentication service. Payments are processed by Stripe.

Some of these providers process data outside South Africa and the EU (for example, in the United States). These transfers are covered by each provider's Data Processing Agreement and Standard Contractual Clauses (or equivalent safeguards), which we hold on file, and by your consent to the processing described in this policy.

5. THIRD-PARTY DATA PROCESSORS

We share data only with the following processors (operators), strictly for the purposes described, each under a Data Processing Agreement we hold on file:

Supabase — database, authentication, and storage (EU, Stockholm)
Anthropic — AI interpretation, navigation, Career Calibration, and Connection reads (United States; not used for model training)
Stripe — payments (United States); billing entity for purchases is PLAYNICELY MARKETING FZCO
SendGrid (Twilio) — platform and marketing emails (United States)
Cloudflare — bot protection (Turnstile) and content delivery
Google — account sign-in (OAuth)

Our application and PDF report generation run on our own hosting infrastructure (Railway); report rendering is performed on infrastructure we control and is not sent to an external document-processing service.

We do not share your data with any other third parties. We never sell your data.

6. AI PROCESSING AND PERSONALISATION

FITT16 helps you navigate your own reflection; its AI outputs are reflective prompts and interpretations you consider, not statements of fact recorded about you. We do not retain the full text of your reflective conversations. Raw Navigator and Companion conversations are held only transiently and are automatically and permanently deleted within 24 hours; the conversation itself is never shared with a coach. What persists is minimised — short distilled insights (in your own words) and abstracted trend data — and you can delete these at any time. The same minimisation applies to the content you create in Career Calibration.

Your persisting content is linked only to your account. Access to individual content is restricted. Our internal policy prohibits administrative access to personal Navigator content, Career Calibration content, or Connection reads except in specific documented circumstances such as a direct support request from you or a legal obligation. Your content is not used to train any AI model.

6a. CONNECTIONS (PEER SHARING BETWEEN USERS)

The Connections feature lets you and another registered FITT16 user agree to exchange results so the platform can generate a private read of the dynamic between the two of you.

Both people must consent. A connection is created only when one person sends an invitation and the other person actively accepts it. By accepting, each person agrees to share, with the other, their FITT16 archetype and their top talent themes so that these can power the mutual read. Nothing is exchanged until the invitation is accepted.

What the other person can see. Once connected, each of you can see the other's name and FITT16 archetype. Your underlying talent themes are used only in the background by our system to generate the AI read of your dynamic — they are not displayed to the other person and are never shown on screen.

Snapshots. The data exchanged is a snapshot taken at the time you connect. Each person holds their own private copy, along with the relationship category they choose, the AI-generated read, and any notes they keep. These are visible only to the account that holds them.

Sponsored access. You may purchase access ("a seat") to invite someone who is not yet registered. The person you invite must still create their own account and accept the invitation before any exchange occurs.

Revocation. You may remove a connection at any time. Removing a connection deletes the other person's snapshot held on your side, and your snapshot held on their side, along with the associated read. Removing a connection does not by itself delete anything the other person independently chose to save as their own notes.

The Connections read is generated by Anthropic's Claude as described in Sections 4 and 6, and is not used to train any AI model.

7. MARKETING COMMUNICATIONS

We will only send you marketing emails (product updates, new features, special offers) if you have explicitly opted in during onboarding or in your Account Settings.

You can withdraw consent at any time by:

Visiting Account Settings → Email Preferences and unticking the checkbox
Emailing us at hello@fitt16.com

Withdrawal of consent does not affect the lawfulness of processing before withdrawal. We will always send you essential platform communications (account security, service updates) regardless of marketing preference — these are contractual and do not require consent.

8. COOKIE POLICY

FITT16 uses only essential cookies to maintain your session and secure the platform. We do not use non-essential or third-party tracking or analytics cookies. Disabling essential cookies may limit platform functionality.

9. YOUR RIGHTS

Under POPIA (data-subject participation) and, where applicable, GDPR / UK GDPR, you have the following rights over your personal information. We will respond to all requests within 30 days.

Access — You may request a copy of your data at any time via Account Settings → Export my data, or by emailing hello@fitt16.com.

Correction — You may update inaccurate information via Account Settings → Profile.

Deletion — You may permanently delete your account and all associated data via Account Settings → Danger Zone → Delete my account.

Withdraw marketing consent — You may change your email preferences at any time via Account Settings → Email Preferences.

Object to processing — You may object to how we process your data by emailing hello@fitt16.com.

Data portability — You may request a portable copy of your data via Account Settings → Export my data, or by emailing hello@fitt16.com.

Lodge a complaint — You have the right to complain to a data-protection authority. In South Africa this is the Information Regulator; if you are in the EU or UK you may also contact your local supervisory authority.

10. DATA RETENTION

We retain your account data for as long as your account is active. When you delete your account, all personal data is permanently deleted from our systems within 72 hours, except where retention is required by law (for example, financial transaction records, which are retained for the period the law requires).

Raw Navigator and Companion conversations are held only transiently and are automatically deleted within 24 hours; only minimised distilled insights persist, and you can delete these at any time.

Where you hold a snapshot of another user through the Connections feature, that snapshot is deleted when you remove the connection or delete your account. Likewise, any snapshot of you held by another user is deleted when they remove the connection or delete their account.

Your CliftonStrengths® PDF is processed to extract your theme data and is then deleted from our servers after processing.

Deleted records may persist for a short additional period in our provider's automated backups before those backups age out; this is normal and does not affect the permanence of deletion.

11. DATA SECURITY

We protect your data through:

Encryption in transit (TLS) and at rest
Row-level security policies ensuring users can only access their own data, including the data exchanged through Connections
Access to all data functions verified against your signed-in identity
Restricted administrative access — no broad access to personal data
Multi-factor authentication available to all users
Secure API key management for all third-party integrations
Per-user rate limits on AI features to prevent abuse

12. CHILDREN

FITT16 is not directed at children under the age of 16. We do not knowingly collect data from anyone under 16, and sign-up requires you to confirm you are 16 or older. If you believe a minor has created an account, please contact hello@fitt16.com and we will delete the account promptly.

13. CHANGES TO THIS POLICY

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email and, where appropriate, ask you to re-confirm your acceptance.

14. CONTACT US

Responsible Party: PLAYNICELY PTY LTD (South Africa).
Payments/billing entity: PLAYNICELY MARKETING FZCO (Dubai, United Arab Emirates).
Email: hello@fitt16.com · Website: fitt16.com

‍