Privacy Notice

Our role

We are the data controller for information about our own account holders — the trainers and gyms who subscribe to GymBeans. For information a business enters about its own clients, that business is the controller and we act as its processor, handling the data only on its instructions.

What we collect and why

• Account details (name, email, phone, business name, login credentials) — to create and secure your account. Legal basis: performance of our contract.
• Content you enter (clients, bookings, programs, notes, invoices, agreements) — to provide the service. Legal basis: performance of our contract.
• Usage and device data (log records, IP address, browser and device identifiers, error reports) — for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Marketing preferences — to send product updates where you have opted in. Legal basis: consent, withdrawable at any time.

We do not collect or store full card or bank numbers. Payment credentials are captured by our payment providers.

Who we share it with

• Service providers / subprocessors — cloud hosting, database, email delivery, error monitoring and analytics tooling.
• Paddle, our Merchant of Record, for the sale of subscriptions, payments, subscription management, invoicing and tax compliance.
• Professional advisers — legal, accounting and audit, where needed.
• Authorities — where required by law or to protect rights and safety.

We never sell personal information.

International transfers

Our providers may process data outside your country. Where that happens, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

Retention

We keep account and content data for as long as your account is active, and for up to 12 months after closure to allow reactivation and to meet legal obligations. Financial records are kept for the period tax law requires. After that, data is deleted or anonymised.

Your rights

You may request access to, correction of, or deletion of your personal information, ask us to restrict or stop certain processing, request a portable copy, or withdraw consent. Email support@gymbeans.app and we will respond within one month. You may also complain to your privacy regulator — in Australia, the Office of the Australian Information Commissioner.

Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level database access controls, multi-factor authentication for staff accounts and least-privilege access for our team.

Cookies

We use essential cookies and local storage to keep you signed in and to remember preferences. We use limited analytics to understand product usage. You can clear or block cookies in your browser, though the app will not work correctly without the essential ones.

Facebook and Instagram advertising measurement

On our business free-trial signup pages, we use the Meta Pixel to report trial-page visits and successfully completed new free-trial registrations to Meta Platforms. This helps measure our Facebook and Instagram ads and evaluate and improve advertising. It does not mean our campaigns automatically optimise for registrations.

Meta receives IP address, browser/device information, the trial-page URL, advertising cookie identifiers (such as _fbp and, when present, _fbc) and an anonymous event identifier. We do not add names, email addresses, business details, client records, health information, workout or nutrition activity to these reports. No customer matching or server-side advertising uploads are enabled.

Where advertising consent is required, we ask before loading the Pixel. Elsewhere ordinary measurement may run without a banner, subject to your saved refusal and applicable browser privacy opt-outs. If location cannot be established, advertising measurement stays off until you explicitly accept. Essential storage does not depend on advertising acceptance.

You can accept, reject or withdraw through Cookie settings on this page or the trial page. Rejection is as easy as acceptance. Withdrawal stops future advertising reports; it does not recall reports already received by Meta. Signups blocked at the time are never replayed after later acceptance.

Your browser stores a visitor reference, your advertising choices, timestamps, region and the version and text of the notice shown. Earlier acceptance evidence is retained when you withdraw. A completed trial stores its event-time permission reference locally to prevent duplicate reporting. Clearing browser storage removes these local records.

Meta may process this data internationally under its own policies. See Meta’s Privacy Policy. Contact support@gymbeans.app about your privacy choices.