Privacy Policy

1. What data we collect

1. Account data: name, email address, password (encrypted).
2. Gym business data: information you provide about your gym through the Growth Assessment, weekly reviews, and conversations with the mentor, including but not limited to member counts, revenue figures, pricing, churn, staffing, and challenges you describe.
3. Conversation data: your messages to the AI mentor and the mentor's responses, stored to provide continuity between sessions.
4. Payment data: we do not collect or store your card details. Payment is handled entirely by Stripe, our payment processor. We hold only your subscription status and billing history metadata.
5. Usage data: standard technical data such as log-in times and general usage of the Service, for security and service improvement.

2. How we use your data

We use your data to: provide and personalise the Service, including the AI mentor's understanding of your gym; process payments via Stripe; communicate with you about your account; improve the Service; and comply with legal obligations.

3. AI processing

1. To provide the mentor feature, generate your business assessment report, and generate documents, your gym business data and conversation history are sent to Anthropic (provider of the underlying AI model) for processing. To power search and retrieval within the mentor's knowledge base, portions of your queries are also processed by OpenAI (for text embedding only).
2. These providers process your data as our data processors, under their own data processing terms, solely to provide the Service to you. We do not permit these providers to use your data to train their general-purpose models outside the terms of our processing agreements with them.
3. Your data is also stored and processed by Supabase (our database and infrastructure provider) and Lovable (our application hosting provider), both acting as data processors on our behalf.

4. Who we share data with

We share data with the service providers named in Section 3, each acting as a data processor under contract, solely to provide the Service. We do not sell your data. We do not share your gym's business data with other users, other gym owners, or any third party for marketing purposes.

5. International transfers

Some of our processors (including Anthropic and OpenAI) may process data outside the UK. Where this happens, we rely on appropriate safeguards required under UK GDPR, such as Standard Contractual Clauses, to ensure your data remains protected.

6. Data retention

1. While your account is active, we retain your data to provide the Service.
2. If you cancel your subscription, we retain your account and gym data for 90 days, so that you can reactivate your account and pick up where you left off without losing your history.
3. After 90 days, if you have not reactivated, you may request deletion of your data at any time by emailing jamie@thegymengine.com, and we will delete it within a reasonable period.
4. If neither reactivation nor a deletion request occurs, we will delete your account data automatically 12 months after cancellation.
5. We may retain minimal billing records for longer where required by law (e.g. UK tax record-keeping requirements).

7. Your rights

Under UK GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (subject to Section 6); request a copy of your data in a portable format; object to or restrict certain processing; and complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data. To exercise any of these rights, contact jamie@thegymengine.com.

8. Security

We use industry-standard measures (including encryption and access controls via our infrastructure providers) to protect your data. No system is perfectly secure, and we cannot guarantee absolute security.

9. Cookies

We use essential cookies and similar technologies required for the Service to function, including cookies that keep you logged in (authentication session cookies) and cookies set by Stripe during payment processing. We do not currently use advertising or third-party tracking cookies.

10. Children

The Service is not directed at or intended for use by anyone under 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will give reasonable notice of material changes.

12. Contact

Questions about this policy or your data: jamie@thegymengine.com

You can also complain to the ICO at ico.org.uk if you are unhappy with how we've handled your data.