Privacy policy

This policy explains what personal data GymFlow ("we") handles and why. It covers two groups: gym owners and staff who use GymFlow, and the gym members whose details gyms store in GymFlow.

Our role

For gym owners' and staff accounts, we are the data controller. For gym members' data, the gym is the controller and we process it on the gym's behalf, only to provide the service.

What we collect

• Account details: name, email, password (stored hashed), gym name and country.
• Member records a gym adds: names, contact details, date of birth, photos, memberships, payments, class bookings and check-ins.
• Billing details for gym subscriptions, handled by Stripe. We never see or store full card numbers.
• Technical data: IP address, browser and log data needed to keep the service secure.
• Website join requests that visitors send to a gym.

How we use it

• To provide and secure the service, and to support you.
• To bill gym subscriptions.
• To send service emails, such as member app invites and password links.

We do not sell personal data and do not use member data for advertising.

Sharing

We share data only with providers that help run the service (hosting, email delivery, Stripe for payments), under contracts that protect it, or when the law requires it.

Retention

We keep data while the gym's account is active. When a gym account is deleted, its data is deleted from our systems, apart from what we must keep for legal or accounting reasons.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to processing. Gym members should contact their gym first; gyms and members can also email us at hello@gymflow.app.

Security

Data is sent over encrypted connections, passwords are hashed, and each gym's data is kept separate from every other gym's.

Changes

If we change this policy in an important way, we will tell gym owners by email before the change applies.