Privacy policy

Data controller

For its user-account data (subscribing businesses and their teams), the data controller is FV - Fitness Vendor, a SAS with €1,000 share capital, RCS Cherbourg 921 713 418, with registered office at 41 Les Bertrands, 50470 Tollevast, France.

For the data of leads and end customers exchanged in conversations, Fitness Vendor acts as a processor on behalf of the subscribing business, which remains the data controller.

Data we collect

User accounts: name, email, login credentials, billing data.
Conversations: lead identity and contact details (name, phone, email depending on the channel), message content, source channel, history and appointment status.
Business configuration data: offers, prices, availability, channel and calendar connections.
Technical data: connection and operation logs, for security and monitoring purposes.
Usage log for the Automations area: to understand usability issues and investigate a configuration incident, the actions taken in the Automations area (screen viewed, button clicked, timestamp) are recorded and linked to the sign-in account. This log never contains typed content (message text, a contact's details); it is kept for 90 days, then deleted automatically.

Purposes and legal basis

Data is processed to deliver the service (qualify leads and book appointments on behalf of the business), bill the subscription, ensure security and improve the service.

The legal basis is the performance of the subscription contract, the publisher's legitimate interest, and, for lead data, the contract or legitimate interest of the business acting as controller. No data is ever resold.

Recipients and processors

Data is accessible to the relevant subscribing business and to Fitness Vendor's technical processors: Supabase (database hosting, EU), Vercel (application hosting), Resend (email), Meta and OVHcloud (message delivery), Anthropic (Claude API, reply generation), Sentry (monitoring). Each processor is bound by a GDPR-compliant agreement.

Data isolation between businesses is enforced technically (multi-tenant separation). Fitness Vendor stays invisible to leads: only the business's brand is exposed.

Transfers outside the European Union

Some processors are located in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

Retention period

Data is kept for the duration of the contractual relationship, then archived or deleted in accordance with applicable legal periods. Lead data is kept according to the instructions of the business acting as controller. The Automations usage log is kept for 90 days.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. These rights can be exercised from the dashboard or at contact@fitness-vendor.com. A full export of your data (conversations, contacts, configuration) is provided on request at contact@fitness-vendor.com, within 30 days and in a structured, machine-readable format. Leads and end customers exercise their rights with the business they are talking to. You may lodge a complaint with the CNIL.