InGym Privacy Notice

1. Who we are

InGym is provided by Mohamed Wahib EI, an individual entrepreneur (entrepreneur individuel) trading as ElShore, registered in France under SIREN 108434846, whose address is 138 avenue Victor Hugo, 75116 Paris, France ("ElShore", "we", "us").

Privacy contact for all questions and requests: contact@ingym.net. Postal address: 138 avenue Victor Hugo, 75116 Paris, France. ElShore has not appointed a data protection officer.

This notice explains how we use personal data when we provide InGym. It applies to visitors of the InGym website, to the people who sign up for and manage InGym on behalf of a business, and to staff users of InGym.

2. Our two roles

ElShore as controller: we decide how and why personal data is used for our own customer relationship. This covers signup, account administration, billing, support, security of the Service, legal records and our communications with customers. This notice describes that processing.

ElShore as processor for gyms: gyms use InGym to manage their own members and staff. For the member and staff records a gym enters or imports, the gym is the controller and ElShore processes the data only on the gym's instructions, under the InGym Data Processing Addendum. If you are a member of a gym that uses InGym, the gym's own privacy notice applies to your data, and the gym is the right contact for your requests. If you contact us about a gym's records, we will forward your request to that gym and tell you that we have done so.

3. Personal data we use as controller

Signup and account data: your name, work email address, password (stored only as a protected hash by our authentication provider), optional phone number, business name, business country, chosen plan preference, interface language, and records of your email verification.

Legal acceptance records: which versions of the Terms, Privacy Notice, Data Processing Addendum and Representative Authority affirmation were accepted or acknowledged, by which account, and when.

Billing data: the business's billing name and address, tax information, subscription, invoices and payment status. Payment card details are collected and held by Stripe; we see only limited information such as the card brand, last four digits and expiry date.

Support and correspondence: the content of emails and requests you send us and our replies.

Launch waitlist: if you join the InGym launch waitlist, your email address and, if you choose to give them, your gym's name and country.

Account activity events: records of milestones in a business's setup and use of InGym, such as completing an onboarding step, adding its first member or recording its first check-in. Each record holds only the business account it belongs to, a fixed milestone code, the business country recorded on the account, and the time. It contains no data about the gym's members, no user's name or email address, and no IP address or browser information.

Security and technical data: sign-in and session records, multi-factor authentication settings, IP address, browser and device information, request logs, rate-limiting counters, anti-bot verification results, and error reports from the Service.

Required and optional information: your name, work email address, password, business name and business country are required to create an account, and the confirmations at signup are required to enter into the contract. If you do not provide them, we cannot create the account. Your phone number and plan preference are optional. Billing information is required only to buy a paid subscription. Completing the anti-bot check is required to use the signup and sign-in forms. To join the launch waitlist, your email address is required; the gym name and country are optional.

Where the data comes from: most of this data comes from you. If you are a staff user, the gym that invited you gave us your name, email address and role. Stripe gives us payment status and limited card details, Cloudflare gives us the result of the anti-bot check, our hosting and authentication providers generate technical and security records, and the Service itself records account activity events. This notice is published on the InGym website, and staff invitation emails link to it. We provide this information to people whose data we obtain indirectly within a reasonable period and at the latest one month after we obtain the data, or at our first communication with them or first disclosure of the data to another recipient if that is earlier.

The person who signs up for a business must be an adult. We do not ask for special categories of data, biometric data, identity-document data or payment card numbers for our own purposes.

4. Why we use it and our legal bases

• To create and run your business's account and provide the Service: performance of the contract with the business (GDPR article 6(1)(b)) where you are personally the contracting party; otherwise our legitimate interest in providing the Service to the business you represent (article 6(1)(f)).
• To bill, issue invoices and keep accounting records: compliance with our legal obligations under French commercial and tax law (article 6(1)(c)) and performance of the contract.
• To keep evidence of the documents accepted at signup and later: our legitimate interest in proving the contract and defending legal claims (article 6(1)(f)).
• To secure the Service, prevent fraud, abuse and repeat trials, and detect and fix errors: our legitimate interest in protecting the Service and its users (article 6(1)(f)).
• To answer support requests, complaints and data requests: performance of the contract, our legitimate interest, and our legal obligations where you exercise your data-protection rights.
• To send service messages (for example email verification, security notices, trial and billing notices, and notices of changes to our terms): performance of the contract and our legitimate interest in informing customers.
• To tell you when InGym opens, if you joined the launch waitlist: your consent (article 6(1)(a)). You can withdraw it at any time by writing to contact@ingym.net, and we will then delete your waitlist entry, without affecting earlier lawful processing.
• To understand how businesses set up and use InGym, so that we can improve onboarding and the Service: our legitimate interest in improving the Service (article 6(1)(f)). We use account activity events for this.
• Marketing: apart from the launch message to people who joined the waitlist, ElShore does not send marketing email. If we ever offer it, we will ask for your consent first (article 6(1)(a)); it will be off by default and you will be able to withdraw it at any time, without affecting earlier lawful processing.
• To comply with law and respond to lawful requests from authorities: legal obligation (article 6(1)(c)).

Acknowledging this Privacy Notice at signup confirms that you have read it. It is not consent and is not the legal basis for any processing. Where we rely on legitimate interests, you can object as described in section 8.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

5. Who receives the data

We use the following service providers. They process personal data on our behalf or, for some of their own operations, as separate controllers under their own terms. For each provider we give the contracting entity, its function, where the data is processed and the transfer safeguard:

• Supabase (Supabase, Inc., United States): database, authentication and file storage. Primary location: European Union (Paris, France). Support and some subprocessors may access data from other countries. Safeguard: Supabase's data processing addendum and the standard contractual clauses it includes.
• Resend (Plus Five Five, Inc., United States): delivery of transactional emails, including the verification and password-reset emails sent by Supabase authentication. Sending region: European Union; message content, delivery logs and account records are stored in the United States. Safeguard: Resend's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.
• Vercel (Vercel Inc., United States): website and application hosting and content delivery. Application functions run in the European Union (Paris); content is delivered through Vercel's global network, and Vercel's primary processing facilities are in the United States. Safeguard: Vercel's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.
• Sentry (Functional Software, Inc., United States): error monitoring. Location: Sentry's European Union data region (Germany). Safeguard: Sentry's data processing addendum and the standard contractual clauses it includes for any access from outside the EEA.
• Inngest (Inngest, Inc., United States): scheduling and running background jobs. Location: as stated in Inngest's data processing addendum, which may include the United States. Safeguard: Inngest's data processing addendum and the standard contractual clauses it includes.
• Upstash (Upstash, Inc., United States): rate limiting, abuse prevention and caching. Location: as stated in Upstash's data processing addendum and the database region selected for InGym. Safeguard: Upstash's data processing addendum and the standard contractual clauses it includes.
• Cloudflare (Cloudflare, Inc., United States): Turnstile anti-bot verification on signup and sign-in forms. Location: Cloudflare's global network. Safeguard: Cloudflare's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.
• Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates): subscription payments, invoicing and tax calculation for ElShore's own billing. Stripe processes data in the EEA and in the United States. Safeguard: Stripe's data processing terms and the standard contractual clauses they include, or the EU-US Data Privacy Framework where the Stripe entity concerned is certified.

Within ElShore, access is limited to the people who need it to run the Service. We may also disclose data to our professional advisers, to a successor of our business, or where required by law or a competent authority. Launch waitlist entries and account activity events are handled only by ElShore and the providers listed above. We do not sell personal data.

6. International transfers

Some of our providers, or their own subprocessors, process data outside the European Economic Area, in particular in the United States, as described in section 5. For the data we handle as controller, each transfer relies on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses included in the provider's data processing terms, with additional safeguards where needed.

You can obtain a copy of these safeguards (such as the relevant standard contractual clauses) by writing to contact@ingym.net.

7. How long we keep data

• Account, signup and support data: for as long as the business's account is open, then deleted 30 days after account closure. A closed account cannot be reopened; until day 30 the business can obtain an export of its workspace data on request through contact@ingym.net.
• Invoices and billing records (the business's invoice identity, its InGym subscriptions, invoices and credits): 10 years from the end of the financial year concerned, as required by article L. 123-22 of the French Commercial Code.
• Platform audit records (records of administrative and security actions on the platform, such as account creation, closure and deletion, and who performed them): 5 years after account closure, for security and to establish, exercise or defend legal claims within the general limitation period (article 2224 of the French Civil Code).
• Records of accepted legal documents: for as long as the account is open and then for 5 years, the general limitation period for contractual claims under French law.
• Launch waitlist entries: until we tell you that InGym is open and then for up to 3 months, or until you withdraw your consent or ask us to delete the entry, if earlier.
• Account activity events: for as long as the business's account is open, then deleted with the workspace data 30 days after account closure.
• Security logs and error reports: only as long as needed for security and troubleshooting, according to the retention settings of the providers concerned.
• Backups: deleted data may remain in backups for up to 30 days, until those backups expire. Backups are used only to restore the Service after an incident; if a backup is restored, completed deletions are applied again before normal processing resumes.

When a free trial ends, the account is not closed and its data is not deleted; restricted mode applies as described in the Terms. Gym workspace data that we process for a gym is deleted as described in the Terms and the Data Processing Addendum.

8. Your rights

Depending on the law that applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interests, to receive your data in a portable format, to withdraw any consent at any time (without affecting the lawfulness of processing before the withdrawal), and, under French law, to give instructions about what happens to your data after your death.

To exercise these rights, write to contact@ingym.net. We may ask for information to confirm your identity. We answer within one month, which may be extended by two further months for complex requests; we will tell you if that happens.

Requests about a gym's member or staff records are handled by that gym as controller. We pass them to the gym and help it respond.

You may also lodge a complaint with a data-protection authority, in particular the authority where you live or work. In France, this is the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

9. Cookies and similar technologies

InGym uses only cookies and similar storage that are strictly necessary to provide the Service you request: to keep you signed in, to protect sign-in and signup (including anti-bot verification), to resume an interrupted signup securely, and to remember your language. These do not require consent.

We do not use advertising cookies, tracking pixels, or optional analytics or session-recording tools. The account activity events described in section 3 are recorded by the Service itself when a business reaches a milestone; they use no cookies or trackers and are not sent to any analytics or advertising provider. If we decide to use any optional cookie or tracker in the future, we will ask for your consent first where the law requires it.

10. Security

We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest provided by our hosting provider, separation of each gym's data through database access controls, role-based access for users, multi-factor authentication for staff accounts where enabled, and restricted internal access. No system is completely secure; if a personal data breach affects you, we will act as required by law.

11. Changes to this notice

We may update this notice. Each version has its own version identifier and effective date. If a change materially affects how we use your personal data, we will tell account owners by email or in the app before it takes effect.