Privacy policy

1. Our role

When a gym uses Flxlete to manage its members, the gym decides what member data it collects and why. For that data the gym is responsible (the controller) and Flxlete processes it on the gym's instructions.

For the accounts of gym owners and staff, for visitors to our website and for people who contact us, Flxlete is responsible for the data.

2. The data we process

• Identity and contact details: name, mobile number, email address, preferred language, gender and date of birth where the gym records them.
• Membership and activity: subscriptions, packages, bookings, attendance and check-in records, freezes, and notes the gym records.
• Payments and invoices: amounts, payment method, receipts and tax invoices. Card details entered on a payment terminal stay with the payment provider.
• Health and body measurements, only where the gym chooses to record them. Only staff the gym permits can see them.
• Door access: a member's credential (a card, a code, or a fingerprint or face template captured with the member's consent at the gym). Templates are kept in a separate store for each gym on our access-control connector, apart from our main database, and are used only to open that gym's doors.
• Messages: the WhatsApp messages and emails we send on a gym's behalf (receipts, booking confirmations, reminders and sign-in codes), their delivery and read status, and replies sent to the gym.
• Technical data: IP address, device and browser type, sign-in sessions, and logs needed to keep the service secure and running.
• AI assistant: questions gym staff type into the Flxlete assistant and its answers.

3. How we use it

• To provide the service the gym signed up for: memberships, bookings, payments, invoices, door access and messages.
• To sign people in and keep accounts safe, including one-time sign-in codes.
• To send service messages: receipts, confirmations, reminders and account notices.
• To meet legal obligations, such as issuing electronic tax invoices under Saudi law.
• To support gyms, fix problems and keep the platform reliable.

We do not sell personal data, we do not use it for advertising, and we do not build advertising profiles.

4. WhatsApp

We use the WhatsApp Business Platform, provided by Meta, to send service messages on behalf of gyms. Meta receives the recipient's phone number and the message, and handles them under WhatsApp's own terms and privacy policy.

We receive delivery and read statuses, and any reply sent to the gym's WhatsApp number. We use them only to show the gym whether a message arrived and to let the gym answer. We do not use WhatsApp data for advertising, and we do not share it with anyone other than the gym and the providers listed below.

You can ask your gym to stop sending you WhatsApp messages at any time.

5. Who we share data with

We share personal data only with the gym it belongs to, with the service providers that run parts of Flxlete for us, and with authorities where the law requires it. Our providers are:

• Vercel: hosting of the website and apps, and privacy-friendly visit statistics on public pages (no cookies).
• Neon: the main database.
• Upstash: caching and scheduled jobs.
• DigitalOcean: the servers that run the door-access connector.
• Meta Platforms: WhatsApp message delivery.
• Resend: email delivery.
• Anthropic: the AI assistant for gym staff. It receives only the question and the data needed to answer it.
• Honeycomb: performance monitoring. It receives technical data, not message content.
• The Zakat, Tax and Customs Authority (ZATCA): electronic tax invoices, as Saudi law requires.

Each provider may use the data only to provide its service to us.

6. Where data is processed

Some of our providers process data outside the Kingdom of Saudi Arabia. When data leaves the Kingdom, we rely on the safeguards that applicable law, including the Personal Data Protection Law, requires.

7. How long we keep it

• Gym and member data: while the gym uses Flxlete. When a gym closes its account, its data is deleted or anonymised, except what we must keep by law.
• Invoices and tax records: for the period Saudi tax law requires.
• AI assistant conversations: deleted automatically after 90 days.
• Door-access biometric templates: until the gym erases them or the member asks for them to be erased.
• Technical logs: for a limited period, then deleted.

8. How we protect it

Data travels over encrypted connections. Each gym's data is kept separate from every other gym's at the database level. Staff see only what their role permits, sensitive actions are recorded in audit logs, and our own access is limited to what support and operations need.

9. Your rights

Subject to applicable law, you can ask to see the personal data held about you, correct it, delete it, receive a copy, or withdraw a consent you gave.

If you are a gym member, your gym can act on most requests directly. You can also write to us and we will work with your gym to answer you. The data deletion page explains how to ask for deletion.

10. Children

Flxlete is not aimed at children. A gym may register a minor as a member with the consent of a parent or guardian, who can exercise the minor's rights.

11. Cookies

We use only the cookies needed for the service to work: to keep you signed in and to remember your language. We do not use advertising or cross-site tracking cookies.

12. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change is significant, we tell gyms before it takes effect.