Privacy Policy

Who is responsible

Edgar, trading as Pheltryn is the controller of account and billing data for Pheltryn. For member, trainer and client records that a gym stores inside its tenant, the gym owner is the controller and Pheltryn processes that data on the gym’s instructions. Contact: privacy@pheltryn.com.

What we collect

• Account: Google account identifiers, name, email, and (for native Gmail accounts) a password hash — never the password itself.
• Gym profile: name, slug, logo, mission, vision, objectives, history, currency, and the plan you requested.
• Operations data the gym creates: members, trainers, invites, schedules, workouts, meals, products, memberships, flags and reviews.
• Files: logos, product photos, trainer reels and exercise videos you upload to storage.
• Domain: the hostname you claim and the verification status. The DNS verification token is not readable from the browser.
• Technical: IP address, device/browser, and security logs needed to run and protect the service.

We do not buy marketing lists. We do not sell personal data. We do not use your gym’s member list to advertise unrelated products.

Why we use it

• To create and authenticate your account (including Google Identity).
• To provision the dashboard, enforce plan limits, and build your club website.
• To send transactional mail: invites, password recovery, payment reminders the gym configured, and service notices.
• To verify domain ownership and issue certificates.
• To secure the platform (abuse, fraud, intrusion).
• To meet legal, tax and accounting duties once paid billing is active.

Processors we use

We use specialised providers. They only get what they need to perform their role:

• Supabase — database, authentication and file storage.
• Google — Identity / OAuth when you choose “Continue with Google”.
• Let’s Encrypt — TLS certificates for custom domains.
• The VPS and reverse-proxy host that serve pheltryn.com and tenant sites.
• A payment provider, when checkout is enabled — they process card data; we receive payment status, not full card numbers.

Sharing and international transfers

We share data with the processors above, with professional advisors under confidentiality, or when the law requires it. Because Pheltryn is offered worldwide, data may be processed in countries other than yours. We use providers that publish security and transfer terms appropriate to a hosted SaaS.

How long we keep it

Account and gym data stay while the gym is active. After you close the account we delete or irreversibly anonymise tenant data within a reasonable period, unless the law requires a longer hold (for example invoices). Backups expire on a rolling cycle. Security logs are kept only as long as needed to investigate abuse.

Your rights

You may ask to access, correct, export or delete personal data we hold about you by writing to privacy@pheltryn.com from the email on the account. Gym owners may also request deletion of their tenant. If you are in the EEA, UK or a similar regime you may lodge a complaint with your local authority. We will answer within the time those laws require, or otherwise within 30 days.

Trainers and members should first ask their gym to correct or delete records the gym controls. We will help the gym honour that request.

Children

Pheltryn is for adult gym operators. We do not knowingly create owner accounts for anyone under 18. A gym that enrolls minor members is solely responsible for parental consent and local youth-sport rules.

Changes

The date at the top of this page is the effective date. We will post updates here and, for material changes, email the gym owner.