Bear Intelligence Privacy Policy

Status: Additional policy

This is an additional policy. The primary privacy policy for your Masculine Frame membership is the Masculine Frame Privacy Policy, which covers your coaching data in the Access Hub. This document covers the Bear Intelligence System: the daily logs, conversations and content you put into that application, and the providers involved in generating its responses. Read both. Where the two touch the same question, the Masculine Frame Privacy Policy governs your coaching data and this one governs your Bear Intelligence account contents.

1. WHO WE ARE

Bear in Studio Ltd ("we", "us", "our") is a private limited company registered in England and Wales (company number 14642085), with its registered office at 39 Goldhawk Road, London, England, W12 8QQ.

Registration with the Information Commissioner's Office (ICO) is being completed. The registration number will be published here once it is issued.

This policy applies to the Bear Intelligence System (BSIS), an AI-assisted personal logging and planning application provided to Masculine Frame members.

It is where your daily nutrition, sleep and bodyweight logging happens, where your targets and decisions are kept, and where you can ask questions at any hour.

The Masculine Frame Programme and the Masculine Frame Access Hub, meaning your programme, your training log, your check-ins and your coach's replies, are covered by the separate Masculine Frame Privacy Policy. Nothing passes between the two systems automatically; you are the only route between them.

Both services run on the same infrastructure (DigitalOcean, Amsterdam, Netherlands; see Section 5).

For all data protection enquiries, contact us at:
Email: hello@bearinstudio.com
Post: Bear in Studio Ltd, 39 Goldhawk Road, London, W12 8QQ

2. WHAT THIS POLICY COVERS

This Privacy Policy explains:

• what personal data we collect about you
• why we collect it and the legal basis for doing so
• how and where we store it
• who we share it with
• how long we keep it
• your rights in relation to your data
• how to contact us or make a complaint

This Policy applies to the personal data we process in connection with the BSIS application. Personal data processed in connection with the Masculine Frame Programme and the Access Hub is covered by the Masculine Frame Privacy Policy.

This Policy should be read alongside the BSIS End User Agreement, the Masculine Frame Privacy Policy and the Masculine Frame Programme Terms and Conditions, which together cover how your data is used across both services.

3. DATA WE COLLECT AND HOW WE COLLECT IT

3.1 Data You Provide Directly

Account and contact data
When you register for or access our services, we collect: your name, email address, and any contact details you provide.

Health and fitness data
If you provide information about your body, physical condition, fitness levels, workout performance, nutrition, body composition, sleep, mental state, or similar topics within BSIS, we collect this data. This constitutes special category data under UK GDPR. See Section 6. The same kinds of information given to your coach in the Access Hub are covered by the Masculine Frame Privacy Policy.

Conversation and log data (BSIS)
When you use BSIS, we collect the content of your AI conversations, goals and decisions you log, daily activity notes, and other content you input into the application.

Coach-Generated Content (BSIS)
Where Bear in Studio Ltd inserts coaching notes, observations, or contextual guidance into your BSIS environment through the administrator interface, this content is stored as a distinct category within your BSIS data. You may request deletion of Coach-Generated Content separately from your own conversation data.

3.2 Data Generated Automatically

Technical and usage data
When you use our services, we automatically collect technical metadata including: session timestamps, feature usage patterns, and system performance data. We do not collect device identifiers, IP addresses, or browsing history beyond what is necessary to operate the services.

3.3 Data We Do Not Collect

We do not collect or process:

• payment card numbers or financial account data (payment processing is handled by our integrated payment processor)
• government-issued identification numbers
• data from users under 18 years of age (our services are restricted to adults)

4. WHY WE PROCESS YOUR DATA: PURPOSES AND LEGAL BASES

Legitimate Interests

Where we rely on legitimate interests as our legal basis, we have assessed that our interests are not overridden by your rights and freedoms.

Technical, security and service investigation (BSIS admin access): We have a legitimate interest in being able to investigate and resolve technical, security or service issues affecting BSIS. Access to standard-mode conversations for this purpose is not routine and is limited to what is reasonably necessary. Users are informed of this in the BSIS End User Agreement and may use Private Chat mode to prevent administrator visibility.

5. HOW AND WHERE WE STORE YOUR DATA

5.1 Primary Infrastructure: DigitalOcean Amsterdam

Data collected through BSIS is stored in a database hosted on a server physically located in Amsterdam, Netherlands, within the European Union. This server is operated through DigitalOcean, LLC.

Both the Masculine Frame Access Hub and the BSIS application run on this same infrastructure. The Netherlands is within the EU, which has UK adequacy status, meaning storage and processing of data within the EU does not in itself require additional international transfer safeguards.

DigitalOcean, LLC is incorporated in the United States. To address any potential access to data from its US operations, Bear in Studio Ltd relies on the Standard Contractual Clauses incorporated into DigitalOcean's Data Processing Agreement, together with the UK International Data Transfer Addendum, which constitute appropriate safeguards for UK GDPR Chapter V restricted transfers.

5.2 Private Chat (BSIS)

When you use Private Chat mode within BSIS, your conversation content is not stored in the BSIS application database after the session ends. Your inputs are still transmitted to Google LLC's AI APIs for the purpose of generating AI responses during the session.

In standard mode, your BSIS conversations are stored in the DigitalOcean-hosted database and may be technically accessible to authorised Bear in Studio Ltd personnel where reasonably necessary to investigate or resolve a technical, security or service issue, as described in the BSIS End User Agreement. This access is not routine and is not coaching oversight.

5.3 Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include access controls, encrypted connections (HTTPS/TLS), and restricted administrator access.

No system can be guaranteed completely secure. In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify you directly without undue delay where the breach presents a high risk to you.

6. SPECIAL CATEGORY DATA

6.1 What It Is

Data relating to your health, physical condition, body composition, mental health, and similar information constitutes "special category data" under UK GDPR and receives the highest level of legal protection.

6.2 Legal Basis

We process your special category health and fitness data only on the basis of your explicit consent (Article 9(a) UK GDPR). This consent is collected through a dedicated consent mechanism within the BSIS application, at first use of health-related features. Consent for the health data you give your coach is taken separately at onboarding in the Access Hub and is covered by the Masculine Frame Privacy Policy.

6.3 Withdrawing Consent

You may withdraw your consent to the processing of your special category data at any time by contacting hello@bearinstudio.com. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

6.4 How It Is Used

Your special category health and fitness data is processed for the following purposes only:

• AI-assisted responses within BSIS (transmitted to Google LLC as described in Section 7)
• storage on the DigitalOcean EU server
• access by authorised personnel to non-private BSIS conversations where reasonably necessary to investigate or resolve a technical, security or service issue
• Coach-Generated Content within BSIS where relevant to your coaching programme

It is not used to make automated decisions about you with legal or similarly significant effects, and it is not shared with any third party other than those identified in this Policy.

7. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data to any third party. We share data only with the processors described below, and only to the extent necessary to provide our services.

7.1 DigitalOcean, LLC (United States: server in Amsterdam, Netherlands, EU)

What we share: BSIS data is stored on DigitalOcean-hosted infrastructure. DigitalOcean does not access or process your data beyond providing server hosting.

Data protection: The server is physically in the EU (Netherlands, UK adequacy status). DigitalOcean LLC is a US-incorporated company; appropriate safeguards are provided by SCCs and the UK International Data Transfer Addendum incorporated into DigitalOcean's DPA. See Section 5.1.

7.2 Google LLC (United States): BSIS only

What we share: The content of your BSIS AI conversations and web search queries (where the search feature is used).

Why: To generate AI responses via Google's Gemini API, compile memory summaries via Gemini Pro, convert text to audio via Gemini text-to-speech, and retrieve web search results via Google Custom Search API.

Data protection: Google's processing is governed by the Google Cloud Data Processing Addendum, which incorporates the UK International Data Transfer Addendum. Google does not use BSIS data to train its AI models under the Paid Services arrangement. For full details, see the BSIS End User Agreement Section 13.4.

7.3 AlphaAI Technologies Inc., trading as Tavily (United States): BSIS web search only

What we share: Web search queries submitted through the BSIS in-app search feature.

Why: To retrieve web search results.

Data protection: Tavily acknowledges UK data protection law and processes UK personal data under SCCs and the UK International Data Transfer Addendum. Bear in Studio Ltd has disabled the "Allow use of query data" setting, preventing Tavily from using search queries for model improvement. For full details, see the BSIS End User Agreement Section 13.4.

7.4 Our Payment Processor

What we share: Payment transaction data and billing confirmation.

Why: To process membership payments securely.

Data protection: Bear in Studio Ltd does not store your full payment card details. All payment data is processed under the payment processor's own PCI-DSS compliant systems. Details of the specific processor and its privacy terms are shown at checkout.

7.5 Legal Disclosures

We may disclose your personal data to law enforcement agencies, courts, or regulatory authorities if required by applicable law or a valid court order. Where legally permitted, we will notify you of any such request.

8. INTERNATIONAL DATA TRANSFERS

All international data transfers from the UK are governed by appropriate safeguards:

Data stored and processed within the EU (Netherlands, Germany, etc.) does not require additional transfer safeguards due to UK adequacy status.

9. HOW LONG WE KEEP YOUR DATA

You may request earlier deletion of your personal data at any time. Certain data may need to be retained for longer where required by law.

10. YOUR RIGHTS

Under UK GDPR, you have the following rights in relation to your personal data held by Bear in Studio Ltd:

Right of access (Article 15)
Request a copy of the personal data we hold about you. We will respond within one calendar month.

Right to rectification (Article 16)
Request correction of inaccurate personal data.

Right to erasure (Article 17)
Request deletion of your personal data in certain circumstances. Note that data we are legally required to retain may not be subject to erasure.

Right to restriction of processing (Article 18)
Request that we temporarily limit how we use your data while a dispute is resolved.

Right to data portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, request your data in a structured, machine-readable format.

Right to object (Article 21)
Object to processing based on legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds.

Right to withdraw consent (Article 7(3))
Withdraw consent at any time for consent-based processing. Withdrawal does not affect prior processing.

Right to separate deletion of Coach-Generated Content
Request deletion of coach-generated content in your BSIS account independently of your own conversation data.

To exercise any right, email hello@bearinstudio.com with the subject line "Data Subject Request". We will respond within one calendar month.

11. AUTOMATED DECISION-MAKING AND PROFILING

11.1 We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you.

11.2 The AI features within BSIS generate automated responses to your inputs. These are informational outputs; they do not determine eligibility for services, affect your legal rights, or produce binding decisions.

12. COOKIES AND TRACKING

12.1 The BSIS application may use session cookies or local storage for the purpose of maintaining your authenticated session. These are strictly necessary for the application to function.

12.2 We do not use advertising cookies, third-party tracking cookies, or analytics cookies that track individual users across sessions or external websites.

13. CHILDREN'S DATA

Our services are restricted to individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, contact hello@bearinstudio.com and we will promptly delete that data.

14. CHANGES TO THIS PRIVACY POLICY

14.1 We may update this Policy from time to time. Updated versions will carry a revised version number and effective date.

14.2 Where changes are material, we will notify you in advance by email or through our applications. Continued use of our services following the effective date constitutes acceptance.

14.3 The current version is always available within the BSIS application.

15. COMPLAINTS AND SUPERVISORY AUTHORITY

15.1 If you have a concern about how we handle your personal data, please contact us first at hello@bearinstudio.com. We will acknowledge your concern within five business days and aim to resolve it within one calendar month.

15.2 If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk | Telephone: 0303 123 1113

15.3 You also have the right to seek a judicial remedy in the courts of England and Wales.

© Bear in Studio Ltd. All rights reserved. Company registered in England and Wales, number 14642085.