Privacy Policy

Levflex operates a software platform for gyms, studios, and coaches. For information about gym owners and visitors to levflex.com, Levflex is the controller. For information about a gym's clients and staff that the gym stores in Levflex, the gym is the controller and Levflex processes it on the gym's behalf.

If you are a member of a gym that uses Levflex, please contact your gym first about your data; we will help them respond.

• Account information — name, email, password (stored only as a secure hash), gym name, address, category, and size, provided at signup.
• Enquiries — details you send through our contact, demo, or newsletter forms.
• Gym data — client profiles, bookings, purchases, messages, and workouts that gyms store in the Service.
• Billing — subscription and payment records. Card details are handled by Stripe and never stored on our servers.
• Usage and device data — pages viewed, actions taken, approximate referral source and campaign parameters, and technical logs used for security and reliability.

We use a small number of first-party cookies:

• sign-in session cookies, which are strictly necessary;
• an anonymous visitor identifier and a record of how you first found us (for example, a campaign link), used to measure our own marketing;
• preferences needed for features such as push notifications.

We do not use third-party advertising cookies on levflex.com, and we do not sell personal information.

• to provide, secure, and support the Service;
• to process subscriptions and send service messages such as receipts and security notices;
• to respond to enquiries and demo requests;
• to understand and improve how the Service and our website are used;
• to send product news to owners who have opted in, with an unsubscribe link in every message.

Gym members can choose to sign in with Google. We then receive their name, email address, and a Google account identifier, and use them only to create and sign in to their account.

Members can also choose to connect Google Calendar. We request the free/busy permission only: we see the times a member is busy, never event titles, attendees, locations, or descriptions, and we cannot create, change, or delete anything in their calendar. Those busy times are used only to suggest session times and warn about clashes when the member books. They are not shown to the gym, shared, sold, or used for advertising or to train AI models. Members can disconnect at any time from their calendar settings, which deletes the stored times and revokes our access at Google.

Levflex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share information only with service providers that help us run the Service, under contracts that limit their use of it, including:

• cloud hosting and database providers;
• Stripe, for subscription billing and for payments between gyms and their clients;
• email and push notification delivery providers.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition subject to this policy. Each gym's data is logically separated, and one gym can never see another gym's clients.

We keep account and gym data for as long as the account is active and for a limited period afterwards so it can be reactivated or exported, then delete or anonymise it. Enquiries are kept for up to 24 months unless they become a customer relationship. Some records, such as invoices, are kept longer where the law requires.

We use industry-standard measures including encryption in transit, hashed passwords, per-gym data isolation, role-based access for staff, and rate-limiting of sensitive actions. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise them, email [email protected]. You may also complain to your local data protection authority.

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.

We will post any changes to this policy here and update the date above; material changes will be notified to account owners by email. Questions: [email protected].