Privacy Policy
This policy explains how the platform processes gym-owner, staff and member data.
Roles
GymSys operates the platform as a technical processor. Each gym remains responsible for the lawful collection of member data, access permissions and data-subject requests.
Data processed
Account and gym details; member, membership, payment, attendance, training, measurement and message data; and technical security and audit records.
Purposes
Service delivery, gym and training operations, account security, support, abuse prevention and reliability improvement.
Sharing
We do not sell data. Data is shared only with infrastructure providers required to operate the service or where legally required. WhatsApp and Google Maps links lead to independent services.
Security
The service uses tenant isolation, role permissions, activity logging, login protection and backups. Gyms remain responsible for their team accounts, devices and passwords.
Rights
Under Moroccan Law No. 09-08, data subjects may request access and correction, object to processing on legitimate grounds, and request deletion or restriction where applicable. Members should contact their gym; gym owners may contact info@gymsys.net for platform matters.
Changes
We may process data where the contracted hosting provider operates. Material changes will be reflected here with a new effective date.
Payments and storage
Creem processes gym platform subscriptions. The platform retains references, amounts and statuses, not full card details. When Cloudflare R2 is enabled, public images and private attachments use separate buckets with appropriate access controls.
Email and campaigns
Account and recovery messages use noreply@gymsys.net, with replies to info@gymsys.net. Campaigns include an unsubscribe link and may record open and click indicators. These do not prove human reading or inbox delivery.
Device notifications
Web Push is optional for each device. We retain the browser subscription endpoint, encryption keys, category choices and technical delivery outcomes. The browser’s push service receives random references; the site verifies the device before displaying generic text without personal or financial details. Devices can be revoked in Notifications and are disabled on explicit logout.