Privacy Policy

Who decides what happens to your data

Alpha CRM is software that gyms use to run their membership. That gives you two different counterparties, and it matters which one you are dealing with.

• Your gym is the controller of the records it keeps about you as a member — your contact details, your attendance, your training, what you have paid. It decides what to collect and how long to keep it. Nathanail Kinnis processes those records on your gym’s instructions, under a written agreement, and for no purpose of its own.
• Nathanail Kinnis is the controller of the accounts that gym staff use to sign in, of its own billing relationship with the gym, and of the technical records described under “Security and logs” below.

If you are a member and you want something changed, erased or explained, the fastest route is your gym. You can always write to us at info@alphacrmcy.com and we will pass it on and support it.

What is held about a member

A gym does not have to fill in everything below; this is the complete set of what the product is able to store, so that nothing is a surprise. There is no public sign-up — a member account exists only because a gym invited it.

• Who you are: name, email address, phone number and date of birth.
• Emergency contact: the name and phone number of the person the gym should call.
• A photograph of you, if the gym uploads one to your record.
• Progress photos, if you add them: pictures you upload yourself in the portal, with the date taken and any caption. They are private to you: nobody at your gym, owner included, can open them — the database refuses them to staff, rather than the page simply not showing them — and you can delete any of them at any time.
• Membership and payments: your plan, its status and dates, and your payment history — both card payments (amount, currency, outcome and date) and payments recorded off-card by staff (amount, method, bank reference and any note they wrote). We also hold the Stripe customer and subscription identifiers that point at your billing record with Stripe. We never see or store a card number. Refunds of off-card payments are recorded the same way, with their reason, and so are personal-training session packs and each session used, with any note staff wrote.
• Attendance: each check-in and check-out, whether it was by PIN, by QR code or at the front desk, any paid drop-in visit, and every class you booked, cancelled or were promoted into from a waiting list.
• Training: the programs and plans assigned to you, any routine written for you alone, any changes you make to your own copy of a program, and the sessions you logged — the date, how hard it felt, any note you wrote on the session or on a single exercise, and each set you recorded with its exercise, reps and weight. If you rate a program, your rating, how hard you found it and any comment are kept too.
• Your settings and devices: your language and your light or dark appearance, and, for each device you turn notifications on for, the address your browser gave us to reach it, its encryption keys and a label such as “Chrome on Android”.
• Messages: support conversations between you and the gym, including every message body, and the notifications sent to you, including the messages your gym sends to groups of members by email, text message or portal notice.
• What staff write about you: free-text notes on your record, follow-up tasks, and — if you enquired before joining — the enquiry record you were converted from, which can hold where the enquiry came from, whether you agreed to marketing, and the gym’s own notes.
• Access credentials: your check-in PIN and the token behind your QR code. Your password is not one of them: it is held by Supabase Auth and never reaches this application, which only stores the account identifier that service issues.
• Requests you make: any erasure request you file, including the reason you gave, and the gym’s decision; and any change of email address or password reset you asked for.

What is held about gym staff

A staff account holds a name, an email address, a role (owner, trainer or front desk), a preferred language, whether two-step sign-in is on — the authenticator itself is held by Supabase Auth, not by this application — and, while it is on, a one-way fingerprint (a hash) of each unused recovery code, never the code itself, deleted when two-step sign-in is turned off or the account is erased; and, if an owner removed its access, when. Actions taken in the product — creating a program, sending an invitation, recording a payment, deciding an erasure request — are attributed to the account that took them, which is what makes the record auditable.

Why, and on what legal basis

• To provide the membership you signed up for — your account, programs, bookings, check-ins and payments. Performance of a contract.
• To keep accounts and the gym’s books — payment and subscription records. A legal obligation, which is also why these records survive an erasure (below).
• To run the gym and keep the service secure — emergency contacts, staff notes, follow-up tasks, and the technical records under “Security and logs”. Legitimate interests.
• Marketing, and measuring page speed — consent, recorded against the enquiry record in the first case and given in the cookie banner in the second. You can withdraw either at any time.
• Progress photos — your consent, given by choosing to add one. Deleting a photo removes it, and nothing else in the product depends on it.

A date of birth and a photograph are held for identification and for the gym’s own age-related rules, not to infer anything about you. We do not ask for health data, but some of what is recorded can reveal it: how hard a session felt, a note or comment about your training, a message to your gym about an injury, or a progress photo. Only you can see your progress photos; your gym’s staff can see the rest. We do not profile you automatically, and nothing here makes a decision about you without a person involved.

Who processes it for us

These are the services this deployment actually uses. Except where a row says otherwise, each processes personal data on our instructions under data processing terms agreed with us, and none of them is permitted to use it for their own purposes. We do not sell personal data, and there is no advertising network anywhere in this product.

Your own gym’s staff see your records. No other gym on this platform can: every query runs under a database policy that scopes it to one gym, rather than relying on application code to remember to filter.

Where your data is

The application runs in the European Union — the servers in Frankfurt, the database in Ireland. Some of the providers above may also process data outside the European Economic Area. Where one of them does, the transfer is covered by the European Commission’s Standard Contractual Clauses, or by the EU–US Data Privacy Framework where the provider is certified under it, in that provider’s data processing terms with us. Write to us at the address above for a copy of the relevant terms. The browser push services are the exception: your browser chooses them, not us, and we have no agreement with them, which is why what they carry is encrypted so that only your device can read it. If you would rather nothing went through them, leave notifications off — every notification is also in your inbox in the portal.

How long it is kept

The platform-wide setting is 1095 days (about 3 years) from the point your membership becomes inactive, and we can set a shorter or longer period for a gym that asks.

Be clear about what that period does: it makes your record eligible for erasure. Erasure itself is carried out by your gym, not by a job that runs on its own — so a record past its window is one your gym can and should remove, rather than one the system has already removed. (Closed enquiry records are the exception, including the one you joined from, if there was one: a daily housekeeping task deletes those once they are past the window.) If your membership has lapsed and you want your record removed now, ask — you do not have to wait for the window.

Two things outlive an erasure by design: payment and subscription records, which the gym is legally required to keep as part of its books, and the log of data-protection requests, which records that a request was made and answered without keeping the data it was about.

Your rights, and how to use them here

Under the GDPR you can ask for a copy of your data, have it corrected, have it erased, restrict or object to how it is used, and withdraw a consent you gave. Here is what each one looks like in this product.

• A copy of your data. Sign in to the member portal, open the Profile tab, and use Your data → Download my data for a machine-readable file straight away — profile, photograph, programs, training plans, workout logs with the sets and notes you recorded, program ratings, check-ins, class bookings, memberships, session packs, payment history and refunds, support messages, notifications, your language and appearance settings, how many devices have notifications on, links to download your progress photos, any erasure requests and any change of email address you asked for. The gym’s own administrative records about you (status changes, invitations, follow-up tasks, automatic “not trained lately” prompts, the enquiry you joined from, any routine written for you alone) are not in that file; for a complete copy, ask your gym or write to the address above, and a person will answer within one month.
• Correcting something. Gym staff can edit your record. You can change your own email address yourself from the member portal, which confirms the change by email before it takes effect.
• Erasure. Sign in to the member portal, open the Profile tab, and use Your data → Request deletion of my data. Your gym must answer within one month, and must give you a reason if it refuses.
• Objecting, restricting, or withdrawing consent. Write to the address above. Withdrawing consent to page-speed measurement needs no message at all — clear this site’s data in your browser and answer the banner again.

You can also complain to a data-protection supervisory authority. In Cyprus that is the Office of the Commissioner for Personal Data Protection; elsewhere in the EU, the authority where you live.

What erasure actually does

It is worth being precise about this, because “delete” is not quite the right word for what happens.

• Your name is replaced, and your email, phone, date of birth, emergency contact, notes and photograph are removed. Your photograph, your progress photos, any routine written for you alone, your notification devices, your language and appearance settings, your program ratings and your notes on single exercises are deleted outright. Your check-in PIN is cleared, your QR code is invalidated and your portal sign-in stops working.
• Free text that could name you is scrubbed from: workout notes, the name and description of your own copy of a program and the trainer’s notes on its exercises, support messages and their subjects, staff task titles and staff alerts, automatic training prompts about you and any comment a trainer added to them, notification text, the note and bank reference on off-card payments and refunds, session-pack notes, a trainer’s brief for a drafted program, the enquiry you joined from, invitation, email-change and password-reset records, and the reason you gave for your own request. A program that other members are also on is left as written, because it is their training too.
• What remains is a record with nobody attached to it: dates, amounts, reps and weights, attendance times. It is kept so the gym’s history and books stay intact, and it no longer identifies you.
• One thing erasure also does: it cancels any card subscription you have at Stripe straight away. If Stripe cannot be reached at that moment, your gym is alerted to cancel it by hand.

Security and logs

Sign-in uses two session cookies that scripts in the page cannot read. They expire 30 days after your session was last renewed while you used the site, or straight away when you sign out. Passwords are handled by Supabase Auth and never reach this application. Every gym’s records are separated at the database layer rather than by application code, so a bug in a page cannot reach another gym’s data.

We do not store your browser’s user agent — only, if you turn on notifications, a rough device label derived from it, such as “Safari on iPhone”, so that you can tell your devices apart. To slow down repeated requests — attempts to sign in or reset a password, and error reports — your IP address, and for sign-in and resets the email address being tried, are kept in the database as counters. Each counter is deleted after its window closes, by a clean-up that runs every day — or sooner, an hour after the window, if more attempts come in — so none is normally kept for more than a day beyond its window. Our hosting provider keeps its own server logs of requests, as any host does.

When a page fails, an error report is sent to us containing the error message, an internal identifier and the path of the page — not your name, your account or the contents of any form. On this deployment those reports also leave our servers, so that we find out something failed: each new error is emailed to our team through Resend; each new error is filed with GitHub, as the table above describes.

Cookies

Four cookies, all first-party, none for advertising, and one consent question that controls page-speed measurement only. The Cookie Policy names each one and says how long it lasts.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change affects what we do with data already collected, your gym will be told so that it can tell you.