Privacy Policy

1. Controller

The controller responsible for processing your data on vipwell.club and in the VIPWELL Health Club is:

vipwell direct AG
Lerzenstrasse 10
8953 Dietikon
Switzerland
Email: info@vipwell.online

This policy is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) as well as the data protection laws of Kosovo, Albania and North Macedonia.

2. What data we process

• Account: name, email address, phone number, country, language, password (stored only in encrypted form), and optionally your profile picture and date of birth.
• Order and AutoVip: delivery and billing address, package ordered, prices, term, renewals, pauses, cancellations including the reason for cancelling, delivery status.
• Payment: payment method, payment status and Stripe references. We never see your full card details; they are held only by Stripe. If you pay in advance, the details of your bank transfer.
• Referral by a partner: which code or link brought you to us.
• Use of the Health Club: when you open the app and which areas you use, streaks, VIP Prestige, VIP Coins, tier, redeemed rewards, participation in prize draws.
• Community: your posts, comments, images, poll votes and reports.
• Communication: emails we send you and whether they were delivered, opened or clicked; push subscriptions of your devices; messages sent via the contact form.
• Additionally for partners: bank details (stored in encrypted form), level, team, bonus and payouts.
• Technical data: IP address, browser and device, time of access, error messages.

3. Why we process your data

• Contract: order, payment, delivery, renewal, cancellation, customer service (performance of a contract, Art. 6(1)(b) GDPR).
• Health Club: account, Community, Academy, tiers, VIP Prestige, VIP Coins, rewards and prize draws (performance of a contract).
• Support from your partner: Your partner sees the information listed in section 5 so they can help you with questions, payment problems and renewals (legitimate interest, Art. 6(1)(f) GDPR).
• Bonus: calculation and payout of the bonus to the partners who referred you and their team (performance of the contract with the partners, legitimate interest).
• System emails and reminders: e.g. order confirmation, password, payment notices, reminder before renewal (performance of a contract).
• Club emails: newsletter, welcome series, weekly Community recap and reminders if you have not been in the app for a while. We send you these emails as a Member about our own products and the club; you can unsubscribe at any time via the unsubscribe link in every email (legitimate interest or consent, Art. 6(1)(a)/(f) GDPR).
• Push notifications: only if you have allowed them on your device (consent). You can turn them off in the app or in your device settings.
• Improvement and security: analyses of app usage on our own servers (no external analytics services), troubleshooting, protection against misuse (legitimate interest).
• Legal obligations: accounting, tax, record retention (legal obligation, Art. 6(1)(c) GDPR).

4. Cookies and browser storage

We only use cookies and browser storage that are necessary for operation. We do not use analytics or advertising cookies or third-party tracking pixels.

• Sign-in (vipwell.session_token and related): keeps you signed in, up to 30 days.
• Language (vw_locale): remembers the language you chose, 1 year.
• Referral (vw_ref): remembers the partner code you came through so that your order is assigned to the right partner, 30 days.
• App settings (local storage): e.g. whether you have already seen the tutorial or a notice. This information does not leave your device.

On Stripe's payment pages and for videos from YouTube or Vimeo, the cookie rules of these providers apply (see section 6).

5. What your partner and other Members see

• Your partner (the person whose code you ordered with) sees your name, your phone number, your tier, the status of your AutoVip with your latest orders, when you last opened the app, on how many of the last 30 days you were active and whether you opened our welcome emails. They cannot see your email address, your delivery address or what you do or write in the app. When you place your first order, they receive a message with your first name.
• Partners above you in the line see your name in their team overview if you are a partner yourself.
• Other Members see your Community posts and comments with your name and profile picture, as well as your name, your profile picture and your tier in the leaderboards.

Partners are obliged to use this data only to look after you and to treat it confidentially.

6. Service providers who support us

We only pass on data to service providers that we have carefully selected and contractually bound to data protection, and only to the extent they need it for their task:

• Hostinger (hosting of our servers in Frankfurt, Germany): all platform data.
• Cloudflare (domain, protection against attacks, delivery of the website, encrypted backups in the EU): IP address and access data, backups.
• Stripe (payment processing): name, email, phone, addresses, payment data. Stripe is itself responsible for the card data.
• Resend (sending our emails, via servers in the EU): email address, name, content of the email, delivery, open and click status.
• Anthropic (AI translation of Community posts into the other club languages): only the text of your posts and comments. Anthropic does not use this data for training.
• Sentry (error monitoring, stored in Frankfurt): technical data when an error occurs, without your IP address.
• Google (email inbox info@vipwell.online): messages you write to us.
• Push services from Apple, Google, Mozilla or Microsoft (depending on your device): the content of the push notification.
• YouTube and Vimeo (videos in the Academy and in News): a video is only loaded once you click on it; the provider then receives your IP address and device data.
• Banks (transfers and bonus payouts): name, account details, amount.
• Shipping (warehouse and carriers): name, delivery address, phone number.
• Tailored Intelligence GmbH, Gontenschwil (development and operation of the platform on our behalf).

We never sell data. We only disclose data to authorities if the law requires it.

7. Transfers abroad

We process your data mainly in Switzerland and in the EU. Some service providers (Stripe, Resend, Anthropic, Sentry, Google, Cloudflare) are based in the USA or may access data from there. We only transfer data there with appropriate safeguards: certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or the European Commission's standard contractual clauses (with the adjustments required for Switzerland).

For delivery and for support from your partner, data is transferred to the country where our warehouse or your partner is located, in particular to Kosovo.

8. How long we keep data

• Account and Health Club: for as long as you have an account.
• Orders, invoices, payments, bonuses: 10 years, as required by law (Art. 958f of the Swiss Code of Obligations).
• App usage data: 12 months, after that only in aggregated form without any personal reference.
• Backups: 30 days.

If you delete your account, we remove your account data immediately. If you have already ordered something, we anonymise your account: your name, contact details, addresses, date of birth and bank details are deleted. Orders and bonus entries are kept without your name for the statutory retention period. Your Community posts remain visible anonymously.

9. Your rights

You have the right to:

• access the data we process about you,
• correct inaccurate data,
• delete your data, unless we are required to keep it,
• restrict the processing,
• receive your data in a common format (data portability),
• object to processing based on our legitimate interest, in particular to club emails,
• withdraw your consent with effect for the future.

To do so, write to us at info@vipwell.online. We will reply within 30 days. So that we can be sure the request comes from you, please write from the email address saved in your account.

You can also lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the authority in your country of residence, and in Kosovo with the Information and Privacy Agency (AIP).

10. Security

We protect your data with technical and organisational measures: encrypted connections (HTTPS), encrypted storage of passwords and bank details, access only for authorised persons with their own roles, logging of access to sensitive data and daily encrypted backups.

11. Changes

We update this Privacy Policy when our services or the legal situation change. The version published here applies. We will inform you of significant changes by email or in the app.