Last Updated: January 18, 2026
This Privacy Policy explains how GymFlow Labs (Pty) Ltd (“we,” “us,” or “our”) collects, accesses, stores, uses, and shares (“processes”) your personal information when you use our services (collectively, the “Services”).
This includes, but is not limited to, situations when you:
- Visit our website at https://gymflowlabs.com or any other website that links to this Privacy Policy.
- Use the GymFlow Labs platform. GymFlow Labs is a fitness-focused marketing and automation system designed to help gym owners attract, convert, and retain members. Our Services include lead generation tools, automated follow-ups, member reactivation campaigns, reputation management, performance tracking, and workflow automation to reduce administrative effort and grow gym revenue.
- Engage with us in any other related manner, including marketing communications, events, or promotions.
We are responsible for decisions about how your personal information is processed. If you do not agree with our privacy practices, please do not use the Services. For any questions or concerns, contact us at [email protected].
Summary of Key Points
This summary highlights the main aspects of our Privacy Policy. For full details, please refer to the corresponding sections below.
1. Personal Information We Process
Depending on how you interact with the Services, the choices you make, and the products or features you use, we may collect and process personal information. This includes information you provide directly to us or information generated through your use of the Services.
2. Sensitive Personal Information
We do not collect or process sensitive personal information (e.g., racial or ethnic origin, sexual orientation, religious beliefs).
3. Third-Party Information
We do not obtain personal information from third-party sources without your consent.
4. Purpose of Processing
We process your personal information to:
- Provide, operate, and improve the Services;
- Communicate with you, including marketing communications (with consent where required);
- Ensure security, prevent fraud, and protect our legal rights;
- Comply with applicable laws and regulations.
We only process personal information when there is a valid legal basis to do so.
5. Sharing Personal Information
We may share your personal information in limited circumstances, such as with service providers who support our business operations or as required by law. Details of these situations are described further in this Privacy Policy.
6. Data Security
We implement reasonable organizational and technical measures to protect your personal information. However, no system or electronic transmission is completely secure. We cannot guarantee that unauthorized parties will never bypass our security measures.
7. Your Rights
Depending on your location, privacy laws may grant you rights regarding your personal information, including the right to access, correct, or delete your data.
8. Exercising Your Rights
You can exercise your privacy rights by submitting a data subject access request or contacting us directly. We will respond in accordance with applicable law.
For a complete understanding of how we collect, use, and protect your information, please review the full Privacy Policy below.
Table of Contents
1. What Information Do We Collect?
2. How Do We Process Your Information?
3. Legal Bases for Processing Your Personal Information
4. When and With Whom Do We Share Your Personal Information?
5. Use of Cookies and Other Tracking Technologies
6. How Long Do We Keep Your Information?
7. How Do We Keep Your Information Safe?
8. Do We Collect Information from Minors?
9. Your Privacy Rights
10. Controls for Do-Not-Track Features
11. Privacy Rights for United States Residents
12. Privacy Rights for Other Regions
13. Use of Free Resources and Automated Workflows
14. Updates to This Privacy Notice
15. How to Contact Us About This Privacy Notice
16. How to Review, Update, or Delete Your Data
1. What Information Do We Collect?
Personal Information You Provide to Us
In Short: We collect personal information that you voluntarily provide when interacting with our Services.
We collect personal information that you provide to us when you:
- Register for or use the Services;
- Express interest in our products, Services, or resources;
- Participate in activities on the Services (such as webinars, events, or surveys);
- Contact us directly via email, WhatsApp, or other channels;
- Use free resources, templates, or automated workflows.
Types of Personal Information We May Collect Include:
- Identity and Contact Information: Name, email address, phone number, username, password, and contact preferences;
- Authentication and Account Data: Login credentials, billing address, and payment information;
- Professional or Business Information: Company or gym details where relevant;
- Other Information You Provide: Any additional information submitted voluntarily via forms, surveys, or communications.
Accuracy Requirement: All personal information you provide must be complete, accurate, and up-to-date. You must notify us promptly if your information changes.
Sensitive Information: We do not intentionally collect or process sensitive information, such as racial or ethnic origin, religious beliefs, sexual orientation, or health data.
Information Automatically Collected
In Short: Some information is collected automatically when you use our Services.
We automatically collect technical and usage information to maintain security, operate the Services efficiently, and analyze performance. This information does not directly reveal your identity but may include:
Types of Automatically Collected Information:
- Log and Usage Data: Includes IP address, device type, browser type, operating system, pages visited, searches, interactions with features, date/time stamps, error reports, and other activity logs;
- Device Information: Includes hardware model, device and application identifiers, operating system version, system configuration, mobile carrier, and Internet service provider;
- Location Data: Includes approximate or precise geolocation based on IP address, GPS, or other technologies. You can opt out by disabling location access in your device settings, but this may limit certain Services functionality.
Cookies and Similar Technologies:
We may use cookies, web beacons, and similar technologies to enhance your experience, analyze traffic, and provide targeted content. For more details, see our Cookie Policy.
Third-Party APIs:
We may use information obtained through third-party APIs, such as Google APIs. All such use will comply with the applicable third-party service policies, including Google API Services User Data Policy and its Limited Use requirements.
2. How Do We Process Your Information?
In Short: We process your personal information to provide, operate, and improve our Services, communicate with you, ensure security and prevent fraud, comply with legal obligations, and, with your consent, for other purposes.
The purposes for which we process your personal information depend on how you interact with our Services, the choices you make, and the features or products you use.
Purposes of Processing
1. Account Management and Authentication
We process your information to create and maintain your account, verify your identity, enable secure login, and manage your account settings and preferences.
2. Provision of Services
We process your information to deliver the Services you request, including free resources, automated workflows, marketing and lead generation tools, and performance tracking features.
3. Customer Support and Inquiry Resolution
We process your information to respond to your questions, troubleshoot issues, and provide technical or administrative support related to our Services.
4. Administrative and Informational Communications
We may use your information to send you updates about GymFlow Labs, including changes to our terms, policies, product offerings, and important announcements.
5. Order Fulfillment and Payment Processing
For paid services or products, we process your information to manage orders, payments, invoicing, billing, returns, or refunds.
6. User-to-User Interactions
If you use features that allow communication with other users, we may process your information to facilitate these interactions securely.
7. Safety, Security, and Fraud Prevention
We process information to protect you, our users, and GymFlow Labs from unauthorized access, security threats, or fraudulent activity.
8. Legal Compliance
We may process your information to comply with applicable laws, regulations, or legal obligations.
9. Protection of Vital Interests
We may process your information when necessary to protect someone’s life, health, or safety.
10. Marketing and Consent-Based Activities
With your consent, we may process your information to send marketing communications, promotional offers, or other materials that enhance your experience with GymFlow Labs. You can withdraw consent at any time.
3. Legal Bases for Processing Your Information
In Short: We process personal information only when we have a valid legal reason under applicable law. This may include your consent, fulfilling contractual obligations, complying with laws, protecting vital interests, or pursuing legitimate business interests.
For EU/UK Residents (GDPR & UK GDPR)
We rely on the following legal bases:
1. Consent – You have given permission for us to use your personal information for a specific purpose. You may withdraw consent at any time.
2. Performance of a Contract – Processing is necessary to fulfill our contractual obligations to you, including providing the Services or taking steps at your request prior to entering a contract.
3. Legal Obligations – Processing is necessary for compliance with applicable laws, regulations, or legal processes, including cooperation with law enforcement or regulatory bodies.
4. Vital Interests – Processing is necessary to protect the life, health, or safety of you or a third party.
5. Legitimate Interests – Processing is necessary for our legitimate business interests, provided that such interests do not override your rights and freedoms (e.g., improving Services, detecting fraud, and maintaining security).
For Canadian Residents
We may rely on:
Express or Implied Consent – You have provided consent for a specific purpose. Consent may be withdrawn at any time.
Situations Where Consent is Not Required, including:
- Collection in the individual’s interest where consent cannot be obtained promptly
- Investigations, fraud detection, or prevention
- Certain business transactions
- Insurance claims or employment/business-related information
- Identifying or communicating with injured, ill, or deceased persons
- Compliance with subpoenas, court orders, or legal obligations
De-identified Information – We may disclose anonymized data for approved research or statistical purposes, subject to confidentiality and ethical oversight.
4. When and With Whom Do We Share Your Personal Information?
In Short: We only share your personal information in specific situations and with certain trusted third parties as described below.
Business Transfers
We may share or transfer your personal information in connection with, or during negotiations of, any merger, acquisition, sale of company assets, financing, or other business transactions. This ensures that any successor entity can continue to provide the Services and fulfill legal and contractual obligations.
Service Providers and Third Parties
We may share your information with trusted service providers that help us operate, improve, or administer the Services. Examples include:
- Payment processors for handling orders and payments
- Marketing, email, and customer support providers
- Analytics and performance tracking tools
- IT and security services
These third parties are contractually required to protect your personal information and only use it to provide services on our behalf.
Legal and Safety Obligations
We may disclose your information if we believe it is necessary to:
- Comply with applicable laws, regulations, legal processes, or governmental requests
- Detect, prevent, or address fraud, security, or technical issues
- Protect the rights, property, safety, or security of GymFlow Labs, our users, or others
5. Do We Use Cookies and Other Tracking Technologies?
In Short: Yes. We use cookies and similar technologies to collect and store information about your interactions with our Services.
We and our trusted partners use cookies, web beacons, pixels, and other tracking technologies to:
- Maintain the security and functionality of the Services
- Save preferences and settings
- Analyze usage and performance
- Detect and fix technical issues
- Deliver targeted marketing and advertising (where permitted)
Third-party service providers may also use these technologies for analytics or advertising purposes, such as remarketing, personalized ads, or sending abandoned cart reminders.
Opt-Out Options:
- If you are a U.S. resident, you may opt out of targeted advertising as described in Section “Do United States Residents Have Specific Privacy Rights?”
- For cookie management, please see our Cookie Notice: https://gymflowlabs.com/cookie-policy
Google Analytics
We may use Google Analytics to monitor and analyze usage of the Services. This may include:
- Remarketing with Google Analytics
- Google Analytics Demographics & Interests Reporting
- Google Display Network Impressions Reporting
To opt out of Google Analytics tracking:
- Desktop: https://tools.google.com/dlpage/gaoptout
- Mobile Ads Settings: via Google Ads Settings for apps
- Network opt-outs: http://optout.networkadvertising.org/ and http://www.networkadvertising.org/mobile-choice
For more information about Google’s privacy practices, visit Google Privacy & Terms.
6. How Long Do We Keep Your Information?
In Short: We retain your personal information only as long as necessary to fulfill the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law.
- Personal information is retained for the duration of your account with us, and while it is needed to provide the Services, maintain security, comply with legal obligations, or resolve disputes.
- Once we no longer have a legitimate business need to process your personal information, we will either delete or anonymize it.
- If immediate deletion is not possible (for example, due to backup storage), we will securely store and isolate your personal information from further processing until it can be deleted.
7. How Do We Keep Your Information Safe?
In Short: We implement reasonable technical and organizational measures to protect your personal information, but no system is completely secure.
We use appropriate security measures, including encryption, firewalls, and access controls, to safeguard the personal information we process. Despite these measures, no electronic transmission over the Internet or information storage system can be guaranteed to be 100% secure. Therefore, we cannot promise or guarantee that unauthorized parties will never gain access to your information, or that your data will always remain completely secure.
By using our Services, you acknowledge that the transmission of personal information is at your own risk and that you should access the Services only from a secure environment.
8. Do We Collect Information From Minors?
In Short: We do not knowingly collect or market to children under 18 years of age (or the equivalent age in your jurisdiction).
We do not intentionally collect personal information from children under 18 or market our Services to them. By using our Services, you represent that you are at least 18 years old (or the equivalent legal age in your jurisdiction) or that you are a parent or guardian who consents to a minor’s use of the Services.
If we become aware that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable steps to delete such data promptly. If you believe we may have collected information from a child under 18, please contact us at [email protected].
9. What Are Your Privacy Rights?
In Short: Depending on your location, you may have rights that give you more control over your personal information. These rights vary by country or region, such as the EEA, UK, Switzerland, Canada, and certain U.S. states.
Your Rights Include:
- Access and Portability: Request a copy of the personal information we hold about you and, where applicable, receive it in a portable format.
- Correction or Erasure: Request that inaccurate or incomplete information be corrected or deleted.
- Restriction of Processing: Ask us to limit the processing of your information in certain circumstances.
- Automated Decision-Making: Where applicable, object to decisions made solely by automated means that have legal or similarly significant effects, and request human review.
- Objection to Processing: In certain circumstances, object to the processing of your personal information.
If you believe your personal information is being processed unlawfully, you may also lodge a complaint with the relevant data protection authority in your jurisdiction:
- EEA/UK: Your Member State or UK data protection authority
- Switzerland: Federal Data Protection and Information Commissioner
Withdrawing Consent
Where we rely on your consent to process personal information, you can withdraw it at any time by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal or processing based on other lawful grounds.
Opting Out of Marketing Communications
You can opt out of marketing communications at any time by:
- Clicking “unsubscribe” in emails
- Replying “STOP” or “UNSUBSCRIBE” to SMS messages
- Contacting us at [email protected]
Note: Even if you opt out of marketing, we may still send service-related messages necessary for account administration, service updates, or responding to inquiries.
Account Management
You may review, update, or terminate your account at any time by contacting us. Upon request, we will deactivate or delete your account from our active systems. Certain information may be retained in backups or archives to prevent fraud, troubleshoot issues, enforce our terms, or comply with legal obligations.
Cookies and Tracking
Most web browsers accept cookies by default. You can adjust your browser settings to remove or reject cookies, but this may affect the functionality of the Services. For more details, see our Cookie Notice.
Contact Us About Your Privacy Rights
If you have questions or wish to exercise your privacy rights, please contact us at:
[email protected]
10. Controls for Do-Not-Track Features
Many web browsers, mobile operating systems, and applications include a Do-Not-Track (DNT) feature or setting, which allows you to indicate a preference not to have your online browsing activities tracked.
At this time, there is no universal technology standard for recognizing or implementing DNT signals. As a result, we do not currently respond to DNT browser signals or similar mechanisms that automatically communicate your preference not to be tracked online.
If a standardized approach to online tracking is adopted in the future that we are required to follow, we will update this Privacy Notice to reflect our practices.
California Residents: California law requires us to disclose how we respond to DNT signals. Since no industry or legal standard currently exists for honoring DNT signals, we do not respond to DNT requests at this time.
11. Do United States Residents Have Specific Privacy Rights?
In Short: If you are a resident of certain U.S. states—including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia—you may have specific rights under state data protection laws. These rights allow you to access information about the personal data we collect, correct inaccuracies, request deletion, or withdraw consent for certain processing activities. Your rights may be limited in some circumstances by applicable law.
Categories of Personal Information We Collect
Below is a summary of personal information we may collect or process. This table provides examples of each category but may not reflect all personal information collected. For a complete inventory, see “What Information Do We Collect?”
A. Identifiers
Name, alias, postal address, phone number, unique personal ID, email address, account name
No
B. Personal information (Cal. Customer Records statute)
Name, contact info, education, employment, financial info
Yes
C. Protected classification characteristics
Gender, age, DOB, race/ethnicity, marital status
No
D. Commercial information
Transaction info, purchase history, payment info
No
E. Biometric info
Fingerprints, voiceprints
No
F. Internet or other network activity
Browsing history, search history, online behavior
No
G. Geolocation data
Device location
No
H. Audio, electronic, sensory info
Images, audio/video/call recordings in business context
No
I. Professional/employment info
Job title, work history, business contact info
No
J. Education info
Student records, directory info
No
K. Inferences
Profiles or summaries about preferences or characteristics
No
L. Sensitive personal info
No
We may also collect personal information in connection with:
- Customer support interactions
- Participation in surveys, contests, or events
- Delivery of services and responses to inquiries
Retention: Category B information is retained for as long as your account is active, unless a longer period is required by law.
How We Use and Share Personal Information
We may use your personal information to provide and improve our Services, communicate with you, and comply with applicable laws. Certain disclosures to service providers may occur under written contracts to facilitate these purposes.
For details, see:
- How Do We Process Your Information?
- When and With Whom Do We Share Your Personal Information?
We do not sell personal information and have not sold or shared personal information for commercial purposes in the past 12 months.
Your Rights as a U.S. Resident
Depending on your state, you may have the following rights:
- Right to Know: Request information about whether and how we process your personal data.
- Right of Access: Obtain a copy of personal information we hold about you.
- Right to Correct: Correct inaccuracies in your personal information.
- Right to Delete: Request deletion of personal information.
- Right to Receive Copies: Obtain a copy of personal data you previously provided.
- Right to Non-Discrimination: Exercise your rights without facing discrimination.
- Right to Opt-Out: Refuse processing for targeted advertising, sales of personal data, or profiling that produces legal/similar significant effects.
Additional rights may apply in certain states, including:
- Access to categories of data being processed (MN, CA, DE, MD)
- Access to lists of third parties data is disclosed to (CA, DE, MD, MN, OR)
- Opting out of collection of sensitive data or biometric information (FL, CA)
Exercising Your Rights
You may exercise your rights by:
- Submitting a data subject access request
- Emailing [email protected]
- Visiting https://www.gymflowlabs.com/contact-us
Authorized agents may submit requests on your behalf, provided valid proof of authorization is given.
Verification of Requests
To protect your data, we may require information to verify your identity before fulfilling your request. If requested via an agent, additional verification may be required.
Appeals
If we decline a request, you may appeal by contacting [email protected]. We will respond with the reason for our decision. If still unsatisfied, you may submit a complaint to your state attorney general.
California “Shine The Light” Law
California Civil Code Section 1798.83 permits residents to request, once per year and free of charge, the categories of personal information disclosed to third parties for direct marketing and the names/addresses of those third parties. To submit a request, contact us using the details in “How Can You Contact Us About This Notice?”
12. Do Other Regions Have Specific Privacy Rights?
In Short: Depending on your country of residence, you may have additional rights regarding your personal information.
Republic of South Africa:
You have the right to request access to, or correction of, your personal information at any time. To do so, contact us using the details in “How Can You Review, Update, or Delete the Data We Collect From You?”
If you are unsatisfied with how we handle a complaint related to the processing of your personal information, you may contact the regulatory authority:
The Information Regulator (South Africa)
General enquiries: [email protected]
Complaints (POPIA/PAIA Form 5): [email protected] & [email protected]
13. Use of Free Resources and Workflows
By downloading or using any free resources (e.g., the 7-Day Member Re-Activation Checklist) or interacting with GymFlow Labs’ automated workflows, you consent to the collection of basic personal information, such as your name, email address, and phone number, for the purpose of delivering these resources and communications.
Your information will never be sold or shared with third parties. You may unsubscribe or request deletion of your information at any time by replying to our emails or contacting [email protected].
14. Do We Make Updates to This Notice?
In Short: Yes, we update this Privacy Notice as needed to remain compliant with applicable laws.
We may revise this Privacy Notice from time to time. Any updates will be reflected by a revised date at the top of this document. If material changes are made, we may notify you by:
- Prominently posting a notice on our website, or
- Directly sending a notification to you.
We encourage you to review this Privacy Notice regularly to stay informed about how we protect your personal information.
15. How Can You Contact Us About This Notice?
If you have questions or concerns about this Privacy Notice, you may contact us:
Email: [email protected]
16. How Can You Review, Update, or Delete the Data We Collect From You?
Depending on the laws of your country or state of residence, you may have the right to:
- Request access to the personal information we hold about you
- Obtain details about how your information has been processed
- Correct inaccuracies in your personal information
- Request deletion of your personal information
- Withdraw your consent for certain processing activities
These rights may be limited in certain circumstances by applicable law.
To exercise these rights, please submit a data subject access request via the contact methods provided in Section 15. We will respond in accordance with applicable privacy laws.