Privacy policy

Who is responsible

StakeLab Pte. Ltd., 9 Raffles Place #06-01, Republic Plaza, Singapore 048619, publishes Gymmy and is the data controller for the website and gym accounts. Contact: [email protected].

For member data entered by a gym, the gym is the controller and Gymmy acts as its processor, on its behalf and following its instructions.

Data we process

Account: name, email, hashed password or Google or Apple sign-in.

Gym: name, address, member count, plans and prices, schedule and programming.

Members: name, contact details, membership, payment status, bookings, logged scores and loads.

Conversations: messages sent to the Gymmy assistant and forms (migration, referents).

Technical: access logs and cookies required for the service to work.

Why

To provide the service and support (contract), bill the subscription (legal obligation and contract), secure and improve the platform (legitimate interest), and answer migration or partnership requests (pre-contractual steps).

Our processors

Railway: application and database hosting.

Resend: email delivery (sign-in, notifications).

Stripe: payments and invoicing. Card data is handled by Stripe and never stored by Gymmy.

Geoapify, geo.api.gouv.fr and Zippopotam: address and city autocomplete.

xAI (United States): AI model behind the Gymmy assistant and programming imports. It receives the messages, attached screenshots and the gym figures the assistant looks up to answer. Gymmy asks xAI not to store the conversation; xAI may keep technical logs for a limited time, under its API terms.

Google and Apple: sign-in, if you choose these options.

GitHub: internal tracking of some requests sent through our forms.

Some of these providers are located outside the European Union, notably in the United States. Transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard.

Retention

Account and gym data are kept for the length of the subscription, then deleted or anonymized within 90 days after cancellation, except what the law requires us to keep (invoices: 10 years). Form requests that go nowhere are deleted after 3 years.

Conversations with the Gymmy assistant and the screenshots sent in them: kept for the life of the account, then handled like the rest of the gym's data. You can ask us to delete them at any time by writing to [email protected] (see Your rights).

Gymmy assistant and aggregate statistics

The Gymmy assistant only reads your own gym's data (members, attendance, schedule, programming, revenue) when you ask it a question, to answer you. It never sees another gym's data.

To help you compare, Gymmy computes anonymous benchmarks across similar gyms (size, activity), for example the median fill rate. Only aggregate per-gym figures are used, never member data, and a benchmark is only shown when it covers at least 5 gyms. No gym is ever named.

Each gym can opt out of these benchmarks in its settings (Profile, “Anonymous benchmarks”). It then no longer sees the benchmarks either.

Facebook and Instagram (Meta)

If a gym links its Facebook Page to Gymmy, Gymmy receives from Meta the leads submitted through the forms of its Facebook and Instagram ads: name, email address, phone number, answers to the form's questions, form, campaign and ad names, date and platform (Facebook or Instagram). Gymmy also keeps, encrypted, the Page access tokens provided by Meta, the Page name and the Facebook ID of the person who connected it. Gymmy never posts anything and does not read the Page's messages or posts.

This data is only used to create the lead's record in the gym's space, to notify the gym and to let it contact the person back. The gym is the controller of this processing and Gymmy acts as its processor. If the gym turns it on, Gymmy sends back to Meta the stage the lead reached (lead received, trial booked, joined) with its Meta lead ID and, hashed, its email and phone number, so Meta can measure and improve the gym's ads.

Leads stay in the gym's space for as long as the gym keeps them and are deleted with the rest of its data. Access tokens are deleted as soon as the gym disconnects its Page, the person removes Gymmy from their Facebook settings, or on a deletion request.

To delete this data: disconnect the Page in Settings, Website, or remove Gymmy in Facebook (Settings and privacy, Settings, Business integrations) and request the deletion of your data. Meta forwards the request to us, we delete the tokens and connections tied to your Facebook account, and you get a confirmation code to check on the “Data deletion” page. You can also write to [email protected].

Your rights

You can access, correct, delete or export your data, and restrict or object to some processing. Write to [email protected]. If you are a gym member, contact your gym first: we will help them answer you.

You can also lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.

Security

Encrypted connections (HTTPS), hashed passwords, access limited to people who need it. No system is perfect: if an incident affects your data, we will tell you within the time limits set by the GDPR.