Who we are
ShapeMax (“we”) provides a physique-scoring web app. This policy explains how we process personal data when you scan, create an account, or browse the site. Contact is available from the in-app account screen.
Data we process
Photos: processed in memory only, never stored, never sent to a third-party vision API. Derived data: geometric landmarks, scores, progression points, optional training plan, height/weight/sex/goal you enter. Account: email and a hashed password if you register. Device: a random device identifier used to limit the free scan to once per device. We do not generate a biometric identification template.
Legal bases
Consent for photo processing and age confirmation (18+). Contract / legitimate interest for account, scores history, and abuse prevention (one free scan per device). You can withdraw consent by deleting your account; photos are already discarded after each request.
Retention
Images: none. Scores and landmarks: until you delete your account, or at most 24 rolling months. Device identifier and “already scanned” flag: up to 13 months. Session token lives in your browser until you sign out.
Your rights
Access, rectification, erasure, restriction, portability, and objection, under GDPR. Use Delete my account in the app for erasure of stored scores. You may also lodge a complaint with the CNIL (cnil.fr).
Transfers and processors
Inference runs locally on our API host. Payment, if enabled, is handled by Stripe. We prefer EU regions. No photos are used to train models.