Privacy policy

Data controller

For its user-account data (subscribing businesses and their teams), the data controller is FV - Fitness Vendor, a SAS with €1,000 share capital, RCS Cherbourg 921 713 418, with registered office at 41 Les Bertrands, 50470 Tollevast, France.

For the data of leads and end customers exchanged in conversations, Fitness Vendor acts as a processor on behalf of the subscribing business, which remains the data controller.

Data we collect

User accounts: name, email, login credentials, billing data. Conversations: lead identity and contact details (name, phone, email depending on the channel), message content, source channel, history and appointment status. Business configuration data: offers, prices, availability, channel and calendar connections. Technical data: connection and operation logs, for security and monitoring purposes. Usage log for the Automations area: to understand usability issues and investigate a configuration incident, the actions taken in the Automations area (screen viewed, button clicked, timestamp) are recorded and linked to the sign-in account. This log never contains typed content (message text, a contact's details); it is kept for 90 days, then deleted automatically. Waitlist: the e-mail left on the website, the page language, the button used, the browser type and, for e-mails we send you, the click on their personal link to the website. This data is only used to let you know when your access opens, at your request. It is kept until then, or until you ask to be removed from the list (contact@fitness-vendor.com), and for three years at most. Presentation website (fitness-vendor.com): where the visit came from (campaign parameters, referring site), attached to a waitlist sign-up; only with your consent, browsing data collected by Microsoft Clarity (audience measurement), Meta and LinkedIn (measuring our ads). Details and withdrawal of consent: cookie policy, “Manage cookies” link at the bottom of each page.

Purposes and legal basis

Data is processed to deliver the service (qualify leads and book appointments on behalf of the business), bill the subscription, ensure security and improve the service.

The legal basis is the performance of the subscription contract, the publisher's legitimate interest, and, for lead data, the contract or legitimate interest of the business acting as controller. No data is ever resold.

Recipients and processors

Data is accessible to the relevant subscribing business and to Fitness Vendor's technical processors: Supabase (database hosting, EU), Vercel (application hosting), Resend (email), Meta and OVHcloud (message delivery), Anthropic (Claude API, reply generation), Sentry (monitoring). Each processor is bound by a GDPR-compliant agreement.

Data isolation between businesses is enforced technically (multi-tenant separation). Fitness Vendor stays invisible to leads: only the business's brand is exposed.

On the presentation website only, and with your consent: Microsoft (Clarity), Meta Platforms Ireland (Pixel and Conversions API, e-mail sent hashed) and LinkedIn Ireland (Insight Tag). These tools are never loaded inside the software.

Transfers outside the European Union

Some processors are located in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

Retention period

Data is kept for the duration of the contractual relationship, then archived or deleted in accordance with applicable legal periods. Lead data is kept according to the instructions of the business acting as controller. The Automations usage log is kept for 90 days.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. These rights can be exercised from the dashboard or at contact@fitness-vendor.com. A full export of your data (conversations, contacts, configuration) is provided on request at contact@fitness-vendor.com, within 30 days and in a structured, machine-readable format. Leads and end customers exercise their rights with the business they are talking to. You may lodge a complaint with the CNIL.