Privacy Policy

Two distinct roles

There are two separate processing situations in this document, and our role differs between them.

• Website: for the details a studio representative submits through the demo request form, we are the controller.
• Application: for client data a studio enters into the system, the studio is the controller and we act as processor on its instructions. Informing clients and obtaining any necessary consent is the studio's responsibility.

Data collected through the website

When you complete the demo request form we process the name, studio name, email address, phone number, client-count range and message you provide. This is used solely to respond to your request and to configure your studio account.

• Cloudflare Turnstile is used for bot protection on form submission
• There is no cookie-based tracking; visit statistics use a cookieless measurement
• No data is shared with advertising networks and no third-party tracking pixel is placed

Data processed in the application

Client details entered by the studio (name, date of birth, gender, height), measurement records, progress photographs, goals, instructor assessments and generated reports. This data is processed solely to provide the service to that studio.

• A client's contact details are not a required field and are not requested
• No medical history, diagnosis or treatment information is held
• Client data is never used for any secondary purpose, including model training

Storage and hosting

Data is hosted on Cloudflare infrastructure: structured data in Cloudflare D1, photograph and report files in Cloudflare R2. Traffic is encrypted with HTTPS. File access requires authorisation and file addresses are not guessable.

Retention

Demo request data is kept for a reasonable period after the request is resolved and then deleted. Application data is retained for as long as the studio's subscription continues. Progress photographs are not deleted automatically to reduce storage cost, because before-and-after comparison is a core function of the service.

Transfers and sub-processors

Data is transferred to our infrastructure provider Cloudflare so that the service can be delivered, and to our email provider for notification of a demo request. Beyond these, data is not transferred to third parties. Transfers to competent public authorities may occur where legally required.

Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. For client data held inside the application these requests should first be directed to the studio you train with. Our GDPR page sets out the detail.

Changes

When this policy changes the update date at the top of the page is revised. Subscribing studios are notified separately of material changes.

Contact

For questions about this text you can contact TrackPil.