This policy explains how ClubOs handles personal information when you use the platform, or when a gym or club uses ClubOs to manage its relationship with you.
Who is responsible for your information?
ClubOs is operated by A1 Thornaby Limited ("we", "us"). Contact us at allgym.mgr@gmail.com with the subject "ClubOs privacy".
We are responsible as controller for platform administration, account security and our own support correspondence. A gym or club using ClubOs normally acts as controller for its members, prospects, staff and social-media contacts. We process those records on that operator's instructions. The operator's own privacy notice explains its purposes and legal grounds. Where A1 Thornaby Limited operates your gym, it may also be the controller in that separate role.
Information we handle and where it comes from
- Accounts and support: names, email addresses, account identifiers, roles, business details, support requests and correspondence supplied by you or your operator.
- Gym and club records: information the operator enters or imports, such as contact details, membership and booking records, attendance, purchases, payment status and references, communication preferences, training information and submitted forms. The information depends on the services your operator enables. Health or fitness-screening information requires the operator to identify an appropriate additional legal condition and explain it in its own notice.
- Connected services: information authorised through Meta, Google or other integrations selected by your operator, as described below.
- Technical records: session and device information, IP addresses, service activity, errors and security logs processed when you access ClubOs and its hosting services.
Facebook, Instagram and advertising connections
An authorised operator chooses which Meta business assets to connect. Depending on the permissions granted and features used, ClubOs receives Facebook Page and Instagram professional-account identifiers, names and usernames; business-portfolio and ad-account identifiers; advertising campaign and performance data; and conversation identifiers, participant names or profile identifiers, message content and timestamps made available by Meta.
ClubOs uses this information to show the operator's connected accounts, report advertising performance, and bring conversations into its customer-service inbox. The current Meta inbox integration imports and displays conversations; it does not send replies or automatically publish social content. ClubOs stores connection credentials to make authorised API requests. It does not ask for your Facebook or Instagram password.
Connections are associated with the relevant operator. Connecting one operator does not authorise access for another. Staff access depends on their assigned roles. We do not sell Meta data or use it for unrelated advertising, data brokerage or training general-purpose AI models.
The operator can disconnect its integration in ClubOs, or revoke ClubOs access through the connected provider's settings. Disconnecting removes the saved connection credentials in ClubOs and stops further access through that connection. It does not automatically erase previously imported records, remove the original messages from Meta, or delete records retained by the operator. See our data-deletion instructions.
Why information is used
We use platform information to provide accounts and requested services, support users, maintain security, investigate faults and misuse, and meet legal obligations. For our own controller activities, our legal grounds are performance of a contract where you are a party, legitimate interests in operating and protecting the service and assisting business users, and compliance with legal obligations. Where an activity requires consent, it must be obtained for that purpose and may be withdrawn.
Operators determine the purposes and legal grounds for their member records and communications. Authorising an integration is not, by itself, consent to every use of the information or to receive marketing. Required account and authentication information is needed to give you access; optional connections can be left disconnected, although the corresponding features will be unavailable.
Who receives information?
Information is available to the relevant operator and its authorised staff, and to authorised support personnel where needed to provide or secure the service. We use Base44 for application hosting, database and authentication services. Connected providers, including Meta and Google, process information necessary to supply their integrations. Payment and communications providers receive information when the operator enables their services. These providers also have their own privacy notices.
Where an operator enables AI-assisted features, the information submitted to those features may be processed by the platform's AI service providers to produce the requested assistance. Do not put passwords, payment-card details or unnecessary sensitive information into an assistant. Your operator can explain which assisted features it uses. This notice does not authorise solely automated decisions with legal or similarly significant effects; an operator introducing such processing must explain it separately.
We may also disclose information to professional advisers or competent authorities when necessary to comply with law, resolve a dispute or protect rights and security. If responsibility for ClubOs changes, we will update this notice and provide any further notice required before information is used for a new purpose.
Storage, security and international processing
ClubOs uses access controls and encrypted storage for Meta connection tokens. No online service can guarantee absolute security. Keep your account secure and contact us if you suspect unauthorised access.
Hosting and connected providers may process information outside the UK. Base44's Data Processing Addendum describes its cross-border transfer arrangements, including adequacy arrangements and contractual safeguards where applicable, and links to its subprocessors. Contact us to request details of the arrangements relevant to your information and how to obtain copies of applicable safeguards.
How long information is kept
Retention depends on the record's purpose, whether the account or service is still active, the operator's documented instructions, unresolved requests or disputes, and applicable record-keeping duties. Account and support records are retained while needed to administer the service and resolve relevant issues. Imported conversations and reporting records remain until removed under the operator's retention or deletion instructions; disconnecting an integration alone does not delete them.
Information that is no longer needed should be deleted or anonymised. Some records may need to be retained to meet a legal obligation or establish, exercise or defend legal claims. Backup copies may remain until the hosting provider's backup cycle expires. Contact us or your operator for the retention criteria and deletion position for a particular record.
Your rights and choices
Depending on the circumstances, you may request access to your personal information, correction, deletion, restriction of use or a portable copy. You may withdraw consent at any time where processing relies on consent; this does not affect lawful processing before withdrawal.
You have the right to object to processing based on legitimate interests, and to object at any time to use of your personal information for direct marketing.
Contact your gym or club first for requests about its membership, booking or customer records. You can also contact us at allgym.mgr@gmail.com; we will help identify the responsible operator. We may need proportionate information to verify your identity. We respond within the applicable legal time limit, normally one month, and explain any permitted extension or reason a request cannot be fulfilled.
You may complain to the UK's Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.
Cookies and browser storage
ClubOs and its service providers use browser storage and session technology for sign-in, security and saved preferences. The hosting platform also processes usage and diagnostic information. Blocking essential storage may prevent sign-in or other features from working. Any optional analytics or advertising tracking requiring consent must be explained and offered separately before being enabled.
Changes to this notice
We will update this page when our practices change and show the revision date. Where a change materially affects how your information is used, we will provide additional notice as required.