Gymly

Privacy Policy

Last updated: 7 October 2026

This policy explains what personal data [LEGAL ENTITY NAME], [STREET, POSTCODE CITY, COUNTRY] ("Gymly", "we") processes when you use Gymly at https://gymly.shop, why, and what rights you have. For any privacy question or request write to [support@gymly.shop].

1. Two roles

  • Gym owners and staff. For the accounts of the people who sign up for Gymly and the staff they invite, we are the controller of their data.
  • Gym members. The data a gym keeps about its members in Gymly belongs to that gym. The gym is the controller and we process the data only on its behalf and on its instructions. If you are a member, contact your gym first; we will help them answer your request.

2. What we collect

  • Account data: name, email, username, phone number, country, language, a hash of your password (never the password itself), and your Google account ID if you sign in with Google.
  • Organization data: gym name, locations, currency, settings, and your plan.
  • Data gyms enter about members: name, contact details, date of birth, notes, memberships, payments, check-ins, training sessions and programs, and body measurements (such as weight, body fat and heart rate) when the gym records them.
  • Billing data: your plan, subscription status and transaction history. Payment card details are handled by Paddle and never reach us.
  • Technical data: the IP address and browser of each signed-in session, and a log of important actions in your organization (an audit log) for security.

3. Why we use it, and on what legal basis

  • To provide the Service you signed up for: running your account, organization and subscription (performance of a contract).
  • To send emails the Service needs: email confirmation, password resets, receipts and the notifications you turn on (performance of a contract).
  • To keep the Service secure, prevent abuse and fix problems (our legitimate interest).
  • To meet accounting, tax and other legal obligations (legal obligation).

We do not sell personal data, show advertising, or use member data for our own purposes.

4. Health data

Body measurements and training notes can be data about health. Gyms must record them only with the member's explicit consent. They are visible only to the gym's authorized staff and to the member in the member portal.

5. Who we share it with

We use these service providers, each bound to protect the data and use it only to provide their service to us:

  • AlphaVPS Ltd. (Bulgaria, EU): servers that host the Service and its database.
  • Paddle.com: our reseller and Merchant of Record, which processes subscription payments, taxes and refunds. Paddle handles your payment details under its own privacy policy.
  • Google: only if you choose "Sign in with Google".
  • Our email provider: delivers the emails the Service sends.
  • Meta (WhatsApp): only for gyms that connect their own WhatsApp Business account to message their members; the gym controls these messages.

We may also disclose data when the law requires it. When a provider processes data outside the European Economic Area, we rely on safeguards approved by the European Commission, such as Standard Contractual Clauses.

6. How long we keep it

  • Account and organization data: while the account exists. After an organization is closed, we delete its data within 90 days.
  • Sign-in sessions: they end after 30 days without use.
  • Billing records: as long as tax and accounting law requires (usually up to 10 years).
  • Member data: as long as the gym keeps it, and deleted with the gym's organization.

7. Cookies

We use only cookies the Service needs to work: to keep you signed in, to remember your language, and to protect the Google sign-in. We do not use analytics or advertising cookies. Paddle's checkout may set its own cookies when you pay.

8. Security

Connections are encrypted (HTTPS), passwords are stored as one-way hashes, stored access tokens for connected services are encrypted, and each gym's data is kept separate from every other gym's. Access inside a gym is limited by staff roles and permissions.

9. Your rights

You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent you gave. Write to [support@gymly.shop]; we answer within one month. You also have the right to complain to the data protection authority of your country.

10. Changes

We will post any changes here and update the date above; for important changes we will also tell account holders by email. See also our Terms of Service.