Privacy policy

From gym owners (you):

• Email address and a hashed password (we never see your password in plaintext).
• Gym name, URL slug, time zone, default capacity — the data you enter at onboarding.
• Records you create: classes, plans, packs, coaches, member accounts.

From your members, on your behalf:

• Email address and hashed password.
• Booking history, late-cancel and no-show events, plan / pack consumption.
• Strike records when our late-cancel or penalty rules trigger.
• If you choose to pay your gym by SEPA direct debit and it collects through its own bank: the account holder's name and postal address, the IBAN and BIC, the place of signing, and the evidence of the mandate — its reference, when it was signed, the IP address and app identifier (user agent) it was signed from, the email address the one-time signing code was sent to and when it was confirmed, the version of the mandate wording you accepted, and a copy of the signed mandate as it was presented, with a fingerprint (SHA-256) of that copy and of the IBAN (or, for a paper mandate you signed at the desk, what your gym enters from it). We email you that copy as a PDF when you sign. The IBAN is encrypted in our database; only its last four characters are ever displayed.
• If your gym collects direct debits through its Stripe account: you enter your IBAN on Stripe's secure page, opened from the app in your browser, and Stripe collects and keeps it, acting for your gym. We never receive the IBAN. We keep only references: Stripe's identifiers for your customer record, payment method and mandate on your gym's Stripe account, the mandate reference, when you accepted it and the IP address and browser identifier Stripe recorded, the IBAN's last four characters, the bank's country and code, and the account holder's name. The evidence of your signature is Stripe's record of the mandate.

What we don't collect:

• Payment card numbers — cards are entered on Stripe's hosted pages and handled by Stripe (PCI DSS Level 1). What lands in our database per online payment: Stripe transaction references, the amount, payment state, and the card's brand and last four digits, so your gym can recognise the payment.
• Health data, biometric data, or anything outside the booking workflow.
• Third-party tracking — no Facebook Pixel, no Google Analytics, no marketing cookies.

We do run our own first-party usage analytics, stored on our own servers and shared with nobody: which pages are visited and which actions are taken, with IP address and browser identifier, tied to a session and, when signed in, to your account. It exists to operate and improve the service; form contents are filtered and passwords are never recorded.

• Contract — accounts, bookings, plans and payments: processing needed to provide the service you or your gym signed up for.
• Contract — bank details and mandate for SEPA direct debit: needed to collect your gym's membership payments by direct debit, the payment method you chose. They are used for nothing else.
• Legal obligation — invoices and accounting records (French commercial code).
• Legitimate interest — security, error diagnosis, first-party usage analytics.

Six processors, each doing one job:

• Stripe (payments, including SEPA direct debits for gyms that collect them through Stripe) — Stripe Payments Europe, Limited (Ireland), with processing in the USA. For a payment to your gym, Stripe acts on behalf of the gym, which holds the Stripe account; Stripe is also an independent controller for its own purposes, such as fraud prevention, anti-money-laundering checks and its other legal obligations. Transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
• OVH (hosting) — OVH SAS, France. Data stays in the EU.
• Scaleway (file storage — your gym's logo, and the export we keep before deleting a lapsed gym's data) — Scaleway SAS, France. Data stays in the EU, and is only ever read back through our own servers.
• SMTP2GO (transactional email) — Sand Dune Mail Ltd, New Zealand. New Zealand benefits from an EU adequacy decision.
• Google (Firebase Cloud Messaging — notifications on Android) — Google Ireland Limited (Ireland), with processing by Google LLC in the USA. Receives the device's push token and each notification's title and text. Transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Apple (Apple Push Notification service — notifications on iOS) — Apple Inc., USA. Receives the device's push token and each notification's title and text. Transfers rely on the EU-US Data Privacy Framework.

That's the full list. Error tracking is self-hosted on our own infrastructure — no third-party service sees crash data.

When your gym collects direct debits through its own bank, bank details go to none of these processors. Your gym sees the holder's name and address and the account's last four characters in its back-office, and the full details only in the direct-debit file it downloads and submits to its own bank, which collects the payment. When it collects through Stripe, you give your bank details to Stripe directly, on its page, and your gym sees in wodloop only the holder's name, the bank's country and the account's last four characters. Emails and notifications about a debit show only the last four characters.

Strictly to operate the service:

• Authenticate you and your members.
• Render schedules, manage bookings, run the late-cancel and no-show rules you configure.
• Send transactional email — confirmations, password resets, booking notifications.
• Bill your gym for the wodloop subscription (when this is wired).
• Prepare your gym's SEPA direct-debit collections for members who choose that payment method — the mandate, the notice before each debit, and either the collection file your gym submits to its bank or the debits sent through its Stripe account.
• Diagnose bugs from server-side error logs.

We do not sell, rent, or share your data with advertisers. We do not train AI models on your data.

PostgreSQL hosted with OVH in France — your data stays in the EU except where a processor above says otherwise. Encrypted in transit. Error tracking is self-hosted: its reports leave out form contents and identifying fields, but a server-side error report may include the technical error message, which can quote the data being processed at the time. Reports stay on our servers and are deleted 90 days after the error last occurred.

Members' IBANs are also encrypted inside the database (AES-256-GCM), each bound to its mandate, with a key kept outside it: a copy of the database alone reveals no member's bank account number. The gym's own IBAN, the account its members' debits are paid into, is printed in every bank file the gym sends and is stored in clear.

Two cookies, both essential — neither is for tracking:

• _wodloop_session — your sign-in session. Cleared on log out.
• cldr_locale — remembers whether you picked English or French.

Wodloop is not directed at children. Gyms may not enroll members under 16 without lawful guardian consent — that responsibility sits with the gym as data controller, and we delete a minor's account at a guardian's request.

If you're in the EU/EEA you have the right to:

• Access — get a copy of your data.
• Rectify — fix anything inaccurate.
• Erase — close your account, in the app or at wodloop.com/account-deletion. Your name, email, phone and birth date are erased straight away; what the law or your gym's records require us to keep (invoices: 10 years) stays attached to an anonymous identifier only. Closing your account also cancels your direct-debit mandates and ends your memberships straight away, so nothing more is debited or renewed; a mandate's bank details and signature evidence are then kept for the period set out under Retention.
• Port — get your data in a machine-readable format.
• Object / restrict — limit specific uses.

To exercise any of these, email privacy@wodloop.com. We respond within 30 days.

For the data your gym's members give us, your gym is the data controller and wodloop is the data processor — the same way Salesforce processes data on behalf of its customers. You decide what to collect, why, and for how long. We process it on your instructions and per this policy.

If you'd like a Data Processing Agreement (DPA), email legal@wodloop.com.

• Active accounts: held while the account is active.
• Closed member accounts: anonymised immediately — name, email, phone and birth date erased, every session and notification registration revoked. Bookings, memberships, payments and invoices are kept against an anonymous identifier for the legal retention period (invoices and accounting records: 10 years, French commercial code). Workout results are kept anonymised, with their free-text notes erased.
• Gyms that stop subscribing: the gym's data is kept 90 days after the subscription ends, then deleted, except invoices and legal records (10 years) and direct-debit mandates, which follow their own rule below. A copy exported at deletion is kept 30 days, then deleted.
• SEPA direct-debit mandates: the bank details and signature evidence are kept while the mandate is in force, then deleted 16 months after it ends or after the due date of its last debit, whichever is later — the time during which a debit can still be disputed and your gym's bank can ask it to prove the mandate. A mandate ends when you or your gym cancel it (in the app: Membership → Direct debit), when you sign a new one, when your bank refuses a debit because the account cannot be debited, when you close your account, when your gym leaves Wodloop, or after 36 months without a debit. Before leaving Wodloop, your gym can download its mandates, to keep them itself for the same period.
• SEPA direct-debit mandates through Stripe: the references we keep follow the same rule; each debit is also recorded as a payment, kept like your other payments. Stripe keeps your bank details under its own privacy policy.
• Error reports: 90 days after the error last occurred.
• Server logs: 30 days.

If we change this policy materially, signed-in owners get an email and a notice on the dashboard at next sign-in. The "last updated" date at the top of this page always reflects the current version.

Privacy questions: privacy@wodloop.com. General support: support@wodloop.com.