Privacy policy

Data controller

For its user-account data (subscribing businesses and their teams), the data controller is FV - Fitness Vendor, an EURL with €1,000 share capital, RCS Cherbourg 921 713 418, with registered office at 41 Les Bertrands, 50470 Tollevast, France.

For the data of leads and end customers exchanged in conversations, Fitness Vendor acts as a processor on behalf of the subscribing business, which remains the data controller.

Data we collect

User accounts: name, email, login credentials, billing data. Account security: security phone number (it receives confirmation codes), IP address, country and device of logins. Conversations: lead identity and contact details (name, phone, email depending on the channel), message content, source channel, history and appointment status. Business configuration data: offers, prices, availability, channel and calendar connections. Technical data: connection and operation logs, for security and monitoring purposes. Usage log for the Automations area: to understand usability issues and investigate a configuration incident, the actions taken in the Automations area (screen viewed, button clicked, timestamp) are recorded and linked to the sign-in account. This log never contains typed content (message text, a contact's details); it is kept for 90 days, then deleted automatically. Waitlist: the e-mail left on the website, the page language, the button used, the browser type and, for e-mails we send you, the click on their personal link to the website. This data is only used to let you know when your access opens, at your request. It is kept until then, or until you ask to be removed from the list (contact@fitness-vendor.com), and for three years at most. Presentation website (fitness-vendor.com): where the visit came from (campaign parameters, referring site), attached to a waitlist sign-up; only with your consent, browsing data collected by Microsoft Clarity (audience measurement), Meta and LinkedIn (measuring our ads). Details and withdrawal of consent: cookie policy, “Manage cookies” link at the bottom of each page. In-app help (profile menu › Help): questions asked to the help and its answers are kept, for each login account, so that it remembers the conversation; each person can delete their own at any time. The help can read the business's totals (statistics, goals, dashboard counters), never the details of an individual. The Fitness Vendor team may read these conversations (questions and the help's answers), with the name of the business and of the person, to improve the software and the help, and to be able to reply to the person; a conversation may also be passed on to the team by the help (the person is told), by sending an idea, or when an answer is marked as not helpful. Conversations, requests and ideas are deleted 24 months after their last message, and along with the account. To improve the software and be able to reply to the person, the publisher receives a weekly summary of the most requested topics and of the questions asked, each with the name of the business, the first name of the person who asked it and its date; any e-mail addresses and phone numbers they contain are masked. The business's conversion tracking (if it turns it on): on its public pages (booking, form, questionnaire), and only with the visitor's consent, the business's Meta pixel and Google Analytics measure visits; its bookings, sign-ups and sales are sent to Meta through the Conversions API, with contact details hashed (SHA-256), either directly or through AdCoach AI, an application published by Fitness Vendor EURL that the business has linked itself. Google Analytics receives the event and a technical visitor identifier, without contact details. Fitness Vendor then acts as the business's processor. Partner programme (agencies and freelancers): the request submitted on the website (name, company, email, number of businesses supported, language, origin of the visit); for an accepted partner, their login account, their company (registered name, registration number, address, VAT status), proof of their acceptance of the programme terms (version, date, IP address) and the list of businesses attached to them. When a partner invites a client by email, the business address they enter, the date it was sent and, where applicable, the recipient's objection are kept; that objection is honoured with no time limit.

Purposes and legal basis

Data is processed to deliver the service (qualify leads and book appointments on behalf of the business), bill the subscription, ensure security and improve the service.

The legal basis is the performance of the subscription contract, the publisher's legitimate interest, and, for lead data, the contract or legitimate interest of the business acting as controller. No data is ever resold.

Recipients and processors

Data is accessible to the relevant subscribing business and to Fitness Vendor's technical processors: Supabase (database hosting, EU), Vercel (application hosting), Resend (email), Meta and smsmode (message delivery), Anthropic (Claude API, reply generation), Sentry (monitoring). Each processor is bound by a GDPR-compliant agreement.

Data isolation between businesses is enforced technically (multi-tenant separation). Fitness Vendor stays invisible to leads: only the business's brand is exposed.

On the presentation website only, and with your consent: Microsoft (Clarity), Meta Platforms Ireland (Pixel and Conversions API, e-mail sent hashed) and LinkedIn Ireland (Insight Tag). These tools are never loaded inside the software.

On the public pages of a business that has turned on its conversion tracking, and with the visitor's consent: Meta Platforms Ireland (pixel and Conversions API, hashed contact details), either directly or through AdCoach AI (published by Fitness Vendor EURL, which only relays them to Meta), and Google LLC (Google Analytics, without contact details).

Partner programme: if your business was created through a partner's invitation link, or if you accepted their offer, that partner knows the name of your business, the date it was attached and the status of your subscription. They have no access to your contacts, conversations, figures or team. You are told so before accepting, and you can detach at any time from “My business”.

Transfers outside the European Union

Some processors are located in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

Retention period

Data is kept for the duration of the contractual relationship, then archived or deleted in accordance with applicable legal periods. Lead data is kept according to the instructions of the business acting as controller. The Automations usage log is kept for 90 days. In-app help conversations, requests and ideas are kept for 24 months after their last message. The login log (IP address, country, device) is kept for 12 months; the security phone number, for as long as the account exists. A declined partnership request is erased twelve months after the reply; one left unanswered, twenty-four months after it was submitted. A partner's record is kept while they take part in the programme, then for as long as the accounting and tax obligations attached to commissions require.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. These rights can be exercised from the dashboard or at contact@fitness-vendor.com. A full export of your data (conversations, contacts, configuration) is provided on request at contact@fitness-vendor.com, within 30 days and in a structured, machine-readable format. Leads and end customers exercise their rights with the business they are talking to. You may lodge a complaint with the CNIL.