1.Who is who
- Your gym (data controller) decides why and how your data is used: it creates your account and manages your membership, bookings, payments, training and messages. Its privacy notice is available in the app.
- FitFlow Go CommV (data processor), a company under Belgian law (company number 1036.552.391, Oude Begijntjesweg 12, 9800 Deinze, Belgium), provides the app and processes data only following your gym's instructions, under a data processing agreement (Article 28 GDPR). This includes the app's technical and security records.
For the data FitFlow processes as controller (for example, the contact details of the gyms that are our customers), see our company privacy policy. We have not appointed a data protection officer; for any privacy question, write to [email protected].
2.Data processed in the app
| Type | Examples |
|---|---|
| Account and contact | Name, email, phone number, date of birth, gender |
| Membership | Plan, packs, subscriptions, bookings, waiting lists, attendance, absences |
| Training | Programmes, logged exercises, weights and reps, performance tests |
| Health data (only if your gym records it) | Injuries, assessments, notes from physiotherapists or other professionals. This is a special category of data: only gym staff authorised by your gym can see it, and your gym needs a valid legal basis, usually your explicit consent |
| Messages | Chat with your gym's staff and notices from your gym |
| Payments | What you bought, when, the amount and its status; card brand, last 4 digits and expiry date. Your card number is handled by Stripe and never stored by us |
| Device and notifications | A device identifier, if you enable push notifications |
| Technical and security | Sign-in records, IP address to protect the app against abuse (for example, limiting failed sign-in attempts), error diagnostics with emails and tokens removed |
3.Why the data is processed
As controller, your gym decides the purposes and legal bases. Typically: to provide the service you contracted with your gym (performance of a contract), to keep the app secure (legitimate interest), to comply with legal obligations (for example, keeping purchase records) and, for health data, your explicit consent. Your gym's privacy notice gives the details.
FitFlow does not use your data for its own purposes. We only use aggregated, anonymised statistics that cannot identify you, to improve the app.
4.Payments
Payments are processed by Stripe through your gym's own Stripe account: your gym is the seller. Prices, refunds, invoices and payment questions are handled by your gym.
5.Service providers
FitFlow uses these providers (sub-processors), under contracts with data protection safeguards:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Frankfurt, Germany) |
| Hetzner | Application servers | EU (Germany) |
| Resend | Transactional emails (access codes, invitations) | Sent from the EU (Ireland); account records in the US |
| Google Firebase Cloud Messaging and Apple Push Notification service | Push notifications | Global |
| Sentry | Error diagnostics | EU (Frankfurt, Germany) |
| Upstash | Sign-in protection | EU (Frankfurt, Germany) |
| HighLevel (GoHighLevel) | Only if your gym connects its customer-management system: name, email, phone, tags and appointments | US |
| Anthropic (Claude) | AI tools used by FitFlow for support and operations, only with the data needed for each task. It does not use your data to train its models | US |
If your gym uses other management software (for example, Aimharder or TIMP), the app connects to it only at your gym's request.
6.Transfers outside the European Economic Area
The app's data is stored in the European Union. When a provider processes data outside the European Economic Area (mainly in the United States), the safeguards required by the GDPR apply: the EU-U.S. Data Privacy Framework adequacy decision or the European Commission's standard contractual clauses.
7.How long data is kept and deleting your account
Your data is kept while your account is active, according to what your gym determines.
Delete your account from the app: Profile → Delete account. This erases or anonymises your name, email, phone number, login, chat messages, trainer notes and saved payment methods, cancels any active membership payments and removes your contact from your gym's customer-management system, if it is connected.
Without the app: ask your gym, or write to [email protected] from the email linked to your account. We will pass your request to your gym and help it carry it out.
Residual copies may remain in backups for up to 7 days and in certain technical records of the service. Anonymous training statistics may be kept, and records that your gym must keep by law (such as purchase records) are kept by your gym for the legally required period. If your gym stops using FitFlow, its data is deleted within 30 days after its contract ends.
8.Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to receive a copy (portability) and to withdraw your consent at any time. Exercise these rights with your gym. You can also write to [email protected]: we will forward your request to your gym and help it respond. You can see your data in the app (My data).
You can lodge a complaint with a data protection authority: in Spain, the AEPD (aepd.es); in Belgium, the APD/GBA (autoriteprotectiondonnees.be); or the authority of your country.
9.Security
The app uses encrypted connections, keeps each gym's data separate, lets your gym set what each staff member can see, protects sign-in against repeated attempts and makes daily backups. Keep your sign-in details safe and don't share your account. FitFlow will never ask you for your access code.
10.Children
If you are under 14, your gym must obtain the consent of your parent or guardian before using the app with your data.
11.Changes
If we make material changes to this policy, we will announce them in the app before they take effect. The date of the last update appears at the top.