Privacy policy

Who we are

This policy explains how [Company legal name] (“Fitly”) handles personal data. Contact us about privacy at [contact email].

Two kinds of data

Data about shops and their teams: Fitly decides how this is used, to run your account and subscription.

Data about a shop’s customers (names, phone numbers, emails, measurements, orders, hires and invoices): the shop decides how this is used. Fitly stores and processes it on the shop’s behalf, only to provide the service.

What we collect

• Shop owners and staff: name, email, password (stored only as a secure hash), role and branch.
• Shop details: business name, address, phone, branches, plan and subscription history.
• Customers of shops: whatever the shop records, and the details customers enter when they create an account or order online.
• Demo requests: name, shop name, email, phone, town and your message.
• Technical data: sign-in sessions and server error reports (the page address and error, not the contents of your forms).

Cookies

We use only the cookies needed to keep you signed in (separate cookies for staff, customers and the Fitly team). Your light or dark mode choice is kept in your browser’s local storage. We do not use advertising or tracking cookies.

Emails

We send emails needed to run the service: welcome and invite emails, password resets, sign-in links you ask for, and replies to demo requests. We keep a record of each email sent (recipient, subject and time).

Who can see data

Each shop’s data is visible only to that shop’s team, and to its customers for their own records.

The Fitly team can see shop data to provide support, billing and security. Support sessions in a shop’s portal are logged.

We use service providers to host the service and send email: [hosting provider], [email provider].

How long we keep data

[Retention periods to be confirmed.] Sign-in sessions expire automatically. Password reset links expire after 2 hours and invite links after 7 days.

Your rights

You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it, by contacting [contact email]. Customers of a shop should contact the shop first, as the shop controls their data.

Security

Passwords are stored as salted hashes, sessions and one-time links are stored only as hashes, and access between shops is separated. No system is perfectly secure; tell us at [contact email] if you find a problem.

Changes

We will post changes to this policy here and tell shop owners by email about significant changes.