Privacy policy

1. Introduction

GymSmartAccess takes the privacy of the people who use its platform seriously. This policy explains what personal data we collect, why, on what legal basis, where we store it, who we share it with and how you can exercise your rights. If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR, or the UK GDPR) applies, and this policy tells you what it gives you.

2. Who is responsible for your data

The controller of your personal data is GymSmartAccess, based in Corrientes, Argentina. You can reach us about anything in this policy at contacto@gymsmartaccess.com.

3. The data we collect

3.1 Data you give us

  • Account data: first and last name, email address, phone number, profile photo and password. The password is stored transformed by a one-way algorithm: nobody, including us, can read it.
  • Gym data: name, locations and their addresses, plans and prices, the team and their roles, and what the gym publishes on its page.
  • Billing data: the plan you subscribe to, the amounts, dates and status of each payment. Your card details are entered on the payment provider’s own page and never reach our servers.

3.2 Data generated when the platform is used

  • Access records: each time someone enters a location we record the date and time, the location, how they got in (with the location’s QR code, its 6-digit code, or recorded at the front desk), whether they were let in and, if not, why, and who on the team recorded it where that applies.
  • Change records: what was changed in a member’s file, by whom and when.
  • Technical data: your IP address is used at the moment of a request to limit sign-in attempts and form submissions, and to show prices in your country’s currency (whether it is Argentina, according to the LACNIC address registry), and we do not store it. When something fails, we send an error report without your name, your email or what you typed.

3.3 The members of a gym

Gyms that use the platform enter their members’ data: first and last name, email, phone, type and number of an identity document, date of birth, address, an emergency contact, photo, the fitness declaration and its expiry date, notes, the plan, payments and access records. For that data the gym is the controller, and GymSmartAccess is its processor (GDPR art. 28): we process it only on the gym’s instructions and only to provide the service to the gym. If you are a member and want to see, correct or delete your data, you can ask your gym or write to us.

4. Google user data (Sign in with Google)

GymSmartAccess lets you sign up and sign in with a Google account through “Sign in with Google”. Gym owners and their teams can use it to create their account and enter the dashboard, and members can use it to enter the member app. Using Google is optional: you can always sign up and sign in with your email and a password.

4.1 What data we get from Google

We only request the basic identification scopes (openid, email and profile). With your permission, Google shares with us:

  • Your email address and whether it is verified
  • Your first and last name
  • Your Google profile photo
  • Your Google account’s unique identifier

We do not access your Google password or any other service or data in your account: we do not read your Gmail, Google Drive, Google Calendar, contacts or files.

4.2 How we use that data

  • Email and Google identifier: to create your account, identify you each time you sign in and link you to your gym or your plan. We also use your email to send you service messages (confirmations, payment and expiry notices, security alerts).
  • Name: to complete your profile and show it inside the platform.
  • Profile photo: we copy it once as your profile photo if you have none. If you are on a gym’s team, you can replace it from your profile whenever you like. If you are a member, we copy it to your file at the gym, where the staff see it to recognize you at the door; to change it, ask your gym. We never store or display the photo’s Google link.

We use Google data only to provide the GymSmartAccess features described here. We do not use it for advertising, we do not sell it, we do not build advertising profiles with it, and we do not use it to develop, improve or train artificial intelligence models.

4.3 How we store and protect it

The data is stored in our database and our file storage, hosted by Railway in the United States. It travels encrypted, and files such as photos are stored encrypted. Each gym sees only its own data, and each person on its team only what their role and locations allow. We do not store Google access tokens or use them to read any other data in your account.

4.4 Who we share it with

We do not share Google user data with third parties, except:

  • Your gym: if you are a member, the gym you sign up with (its owner, managers and front desk) sees your name, email and photo to manage your plan and your access.
  • Infrastructure providers: Railway (hosting, database and files) and Hostinger (email delivery), which process the data on our behalf and only to provide the service.
  • Competent authorities: when required by a court order or applicable law.

Data obtained from Google is not shared with analytics or advertising tools.

4.5 Retention, deletion and revoking access

We keep this data while your account exists: it is not deleted on its own when you stop using the service. You can ask us to delete your account and your data at any time by writing to contacto@gymsmartaccess.com; we act on the request within 10 calendar days. You can also revoke GymSmartAccess’s access to your Google account at myaccount.google.com/permissions. After you revoke it, Google will ask for your permission again the next time you sign in with Google. Revoking does not delete the data already stored: for that, write to us.

4.6 Compliance with Google’s policy

GymSmartAccess’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Messages you send us from the website

When you write to us from the Contact page, we store your name, your email, your gym’s name, your phone number if you give it, your message and the page’s language. We use them to answer you: we send an email confirming we received it, and it is read by the people on our team who handle inquiries. We do not use it to send you advertising, we do not share it with any gym, and gyms cannot see it.

To send it, you must accept this policy. Your IP address is used at that moment to limit submissions, and we do not store it. We keep the message until you ask us to delete it.

6. Why we process your data, and on what legal basis

Under GDPR art. 6(1), each purpose has its own legal basis:

  • To provide the service you or your gym contracted — the account, access control at the locations, payments and service messages: performance of a contract (art. 6(1)(b)).
  • To meet legal and tax obligations, such as keeping billing records: legal obligation (art. 6(1)(c)).
  • To protect the platform and prevent fraud, such as limiting sign-in attempts and recording changes: our legitimate interests (art. 6(1)(f)).
  • To answer the messages you send us from the website: our legitimate interest in answering what you asked (art. 6(1)(f)).
  • To measure website visits and the results of our ads: your consent (art. 6(1)(a)), which you give or refuse in the cookie notice and can withdraw at any time.

7. Who we share data with

GymSmartAccess does not sell, rent or trade personal data. We share it only with:

  • Railway: hosts the platform, the database and the files, in the United States.
  • Hostinger: delivers the service’s emails. It is HOSTINGER, UAB, a company established in Lithuania, in the European Union.
  • The payment provider: processes payments. It receives the payer’s email, the amount and the names of the gym and the plan, under its own privacy policy.
  • Google: when you choose to sign in with Google, it acts as identity provider (see section 4).
  • Sentry: receives the platform’s error reports, without the name, email or anything typed by the person who ran into the error.
  • Google Analytics and Meta: only on the website and in a gym’s sign-up, and only if you accept, including the notices we send them from our servers (see section 12).
  • Competent authorities: when required by a court order or applicable law.

8. Storage and security

We apply technical and organizational measures to protect data against unauthorized access, alteration, disclosure or destruction (GDPR art. 32):

  • Data travels encrypted between your browser and our servers, and between our servers
  • Files, such as photos and fitness declarations, are stored encrypted
  • The database itself keeps each gym apart: a gym cannot see another gym’s data, and each person on a team sees only what their role and locations allow
  • Passwords are stored transformed by a one-way algorithm, and an account is locked for a few minutes after several failed attempts
  • Each gym’s payment credentials are stored encrypted with AES-256
  • Our team’s access to the platform requires a second factor
  • Changes to members’ files and our team’s actions are recorded

If a personal data breach is likely to put your rights at risk, we will notify the competent supervisory authority and, where the risk is high, you, as GDPR arts. 33 and 34 require.

9. How long we keep data

  • Account data: while the account exists, or until you ask us to delete it (section 10).
  • Members’ data: while the gym keeps it. Removing a member does not erase their history: they are marked as removed, so the gym keeps their payments and access records.
  • Access records: while the gym uses the service. They are the record of who came in and when, and they are not modified.
  • Billing data: for 10 years, or longer where tax law requires it.
  • Website messages and emails sent: we keep the messages and a copy of the emails we send until you ask us to delete them.
  • Measurement identifiers: those of your browser that you accepted when you signed a gym up, until the gym’s first payment or for 90 days at most (see section 12).

When you ask us to delete your data, we anonymize it within 10 calendar days: what the law requires us to keep, such as billing, is kept without anything that identifies you.

10. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (art. 15).
  • Rectification of data that is inaccurate or incomplete (art. 16).
  • Erasure of your data, where the GDPR allows it (art. 17).
  • Restriction of processing in the cases art. 18 lists.
  • Portability: to receive the data you gave us in a structured, machine-readable format (art. 20).
  • Object to processing based on our legitimate interests (art. 21).
  • Withdraw your consent at any time, without affecting what was done before you withdrew it (art. 7(3)).

To exercise them, write to contacto@gymsmartaccess.com with a way for us to confirm who you are. We answer within one month (art. 12(3)). You also have the right to lodge a complaint with the data protection supervisory authority of the country where you live or work, or where you believe the infringement took place.

11. International transfers

The data is stored on Railway’s servers in the United States (Virginia). Emails are sent by HOSTINGER, UAB, a company established in Lithuania, in the European Union; its privacy policy says that Hostinger and its affiliates keep data in the United Kingdom, the Netherlands, Lithuania or Cyprus, and that some of its servers are outside the European Economic Area (for example, in the United States, Brazil, Singapore and Indonesia), with those transfers covered by the European Commission’s Standard Contractual Clauses (Article 46 of the GDPR). Where the GDPR applies, we transfer data outside the European Economic Area under the safeguards of its chapter V, through our providers’ data processing agreements, which include the European Commission’s Standard Contractual Clauses. You can ask us for a copy at contacto@gymsmartaccess.com.

12. Cookies and similar technologies

The platform uses only the cookies and browser storage it needs to work:

  • Session cookies: to keep you signed in, securely.
  • Preference cookies and storage: to remember the language, the visual theme, the location you chose and other display preferences.

On the public website and in a gym’s sign-up, and only if you accept in the cookie notice, we use third-party measurement tools:

  • Google Analytics: to measure visits and understand how the website is used.
  • Meta Pixel and Meta Conversions API: to measure the results of our ads on Facebook and Instagram.

These tools do not receive the data of your Google account. In the sign-up form with email, the Meta pixel may read the email and phone number you type, encrypt them and send them to Meta to measure ads. Inside the gym’s dashboard and the member app we use no third-party cookies. You can change your choice at any time from the cookie notice.

If you accepted measurement or advertising when you signed a gym up, from our servers we tell Google Analytics (if you accepted measurement) and Meta, through its Conversions API (if you accepted advertising), three facts of that sign-up: that the gym signed up, that it confirmed its email address, and that it made its first payment, with its amount and currency. These notices carry an encrypted identifier of the gym and the identifiers of your browser that you accepted: Google Analytics’ one and, for Meta, your Meta cookies, the browser you use and your IP address. They never carry your email address, your phone number or your name, encrypted or not. We keep those identifiers until the gym’s first payment, or for 90 days at most, and then delete them.

For those three notices, what you accepted when you signed up is what counts. If you later change your choice from the cookie notice, the change applies in your browser from then on, but our servers are not told: they keep using what you accepted at sign-up until those identifiers are deleted, at the first payment or after 90 days. If you want them deleted sooner, write to us (see section 15).

13. Children

GymSmartAccess is not directed at people under 18, and we do not knowingly collect children’s data. A gym that registers members who are minors must have the consent of their parent or legal guardian where the law requires it, including GDPR art. 8.

14. Changes to this policy

We may change this policy. We will tell you about any significant change through the platform or by email at least 15 days before it takes effect. If a change affects what we do with Google data, we change this policy before using that data in a new way.

15. Contact

For questions about privacy and personal data: