Privacy notice

The data controller is the studio that runs the room, shown below. For any question about your data, or to exercise your rights, write to the email address shown.

The app is developed and hosted by a technical provider that processes the data on the studio's behalf, as a processor (art. 28 GDPR).

This notice covers:

• the professionals (personal trainers, nutritionists, osteopaths and others) who sign up, send a request and book the room;
• visitors of the public pages of the site.

FITROOM does not collect data about the professionals' clients: bookings hold no client names and no free notes about them. Please do not enter your clients' data in the app, for example in a cancellation reason.

• Contact and profile data: name, email address, phone, type of profession, VAT number (optional) and billing name, if any.
• Sign-in and security data: the one-time sign-in codes sent by email (stored hashed, valid for 10 minutes), sign-in sessions with IP address and browser type, the preferred language.
• Booking data: room, dates and times, status, reschedules, cancellations with their reason if given, and the history of changes.
• Payment data: amounts, status, refunds and Stripe transaction references. You enter card details on Stripe's payment page: they never reach the app's servers.
• Communications: the service emails we send you (sign-in codes, outcome of your sign-up request, confirmations, reschedules, cancellations, refunds, reminders).
• Push notifications, only if you turn them on: the technical address your browser gives us to reach it, the two keys we encrypt the message with, and the browser's name so we can tell your devices apart. They are used only to deliver reminders, and you delete them by turning notifications off.

We do not process health data or other special categories of data. The public pages use no analytics or profiling tools.

If you use the assistant, in the app or on Telegram, we process the messages you write, the replies and the data the assistant reads to answer you: your bookings, the room's availability, amounts and statements.

• The assistant is an artificial intelligence system, and we always say so: in the app next to the chat, on Telegram when you connect it and at every new conversation.
• It decides nothing on its own: every change (booking, cancelling, moving, queueing, paying) happens only after you confirm it.
• The replies are generated by a language model by Anthropic (Claude), through Vercel AI Gateway, with processing in the European Union, without the model provider keeping the data or using it to train its models.
• Notes the studio writes freely (for example the reason for blocking the room) are first checked by a safety service, TypeSafe AI, in the United States: it receives only that text, never names or contact details.
• On Telegram the messages also go through Telegram's servers, under Telegram's privacy policy.

Conversations remain available to be resumed. The retention period will be given in the final version of this notice.

If you connect your Google Calendar from “My profile”, the app creates a separate calendar in your Google account, “FITROOM”, and copies into it the room's hours that concern you:

• if you are a professional, your bookings: time, room, the studio's address and the link to the app;
• if you are the host, every hour of the room: yours, the professionals' (as “Busy” or with their name, if you choose so), blocks and closures with their reason.

The permission we ask Google for lets the app create that calendar and manage its events only: the app does not read the rest of your calendar and does not know your Google account's address. We keep, encrypted, the code Google gives us to update the calendar. No payment data and no data about the professionals' clients reaches Google.

Connecting is your choice and you remove it whenever you like with “Disconnect”: the app deletes the “FITROOM” calendar from your account, gives the permission back to Google and deletes the code. The events in your Google account are handled by Google under its own privacy policy.

• Creating and running your account, reviewing your sign-up request and letting you book, pay, reschedule and cancel: performance of a contract and pre-contractual steps (art. 6(1)(b) GDPR).
• Sending you the service emails about your account and bookings: performance of a contract (art. 6(1)(b) GDPR).
• Keeping the accounts, producing the monthly statement and meeting tax obligations: legal obligation (art. 6(1)(c) GDPR).
• Protecting the account and the service (sign-in sessions, history of booking changes, abuse prevention): the controller's legitimate interest in security (art. 6(1)(f) GDPR).

We do not use your data for marketing and we do not sell it.

Name, email and phone are needed to sign up and to book: without them we cannot handle your request. The VAT number is optional.

• Account and profile data: for as long as you work with the studio. After the account is closed they are deleted or anonymised, except those in the next point.
• Payments, refunds, packages, paid bookings and statements: at least ten years, as civil and tax law require for accounting records (art. 2220 of the Italian Civil Code).
• Sign-in codes: valid for 10 minutes.
• Sign-in sessions: they expire 7 days after the last renewal.
• Push notification subscriptions: for as long as you keep them on. We delete them when you turn them off, and at the first send the push service refuses because the subscription no longer exists.

How long assistant conversations are kept, and account data after the account is closed, will be stated in the final version of this notice.

• The host and the authorised staff of the studio, to handle sign-up requests, bookings and payments.
• The technical provider that develops and runs the app, as a processor.
• The service providers the app uses, as sub-processors: Vercel (app hosting, with functions in the Frankfurt region), Neon (database, Frankfurt), Stripe (payments and refunds), Resend (email delivery, from the EU region in Ireland).
• If you turn on push notifications: your browser's push service (for example Google for Chrome, Apple for Safari, Mozilla for Firefox), which delivers the message to your device. It receives the notification's content encrypted.
• Authorities and the studio's advisers, for example its accountant, when the law requires it.
• For the assistant: Vercel (AI Gateway) and the model provider, Anthropic, through Google Vertex AI or Amazon Bedrock in the European Union; for checking free-text notes, TypeSafe AI. For whoever connects Telegram: Telegram. For whoever connects Google Calendar: Google, in the “FITROOM” calendar of their own account.

The data are not disclosed to the public.

The database and the app are hosted in the European Union. Some providers are US companies or process part of the data in the United States: Stripe (payment processing), Resend (account data and delivery logs) and Vercel (platform operations). These transfers rely on the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses adopted by the European Commission. For the assistant, free-text notes are checked in the United States (TypeSafe AI); if you connect Telegram, messages go through Telegram's servers, also outside the European Union. If you turn on push notifications, your browser's push service may be outside the European Union; it receives the notifications' content encrypted. If you connect Google Calendar, the “FITROOM” calendar is kept by Google (Google LLC, certified under the EU-US Data Privacy Framework) in your account, also outside the European Union.

At any time you can ask to:

• access your data and receive a copy;
• correct or update them (you can also change your name, type of profession, phone and VAT number yourself on the Profile page);
• erase them, within the limits of the retention obligations;
• restrict their processing or object to processing based on legitimate interest;
• receive them in a structured, machine-readable format (portability).

To do so, write to the controller's email address shown in section 1. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

We make no decisions based solely on automated processing and we do no profiling. Sign-up requests are approved by the studio host.

If this notice changes, we publish the new version on this page: the date at the top shows the last update.