Privacy Policy

The data controller is KCJ Jakub Chojnacki, Polish tax ID NIP 6751771818, REGON 523375933, a sole proprietorship registered in CEIDG.

For privacy-related matters, contact privacy@fitslot.io. The controller is responsible for lawful, fair, and transparent processing of personal data.

We process data necessary to create a trainer account, schedule sessions, manage clients, and send notifications, including name, email, phone number, and session data.

For trainer clients, the scope depends on the information entered by the trainer and app settings. When a consultation is requested through a club widget, we process the name, email address, optional phone number, selected time, privacy-policy acceptance, and technical data needed to protect the form from abuse. If you belong to a fitness club, we also process your membership and your group-class bookings — see section 4 for details.

Depending on the features you use, we process chat messages and scheduling proposals, training goals, measurements, interviews, recommendations, progress notes, workout plans, and training and attendance history.

This content is entered by a trainer or client and may contain health or fitness information. It is used to provide the selected FitSlot features and is available only to authorized participants in the coaching relationship and authorized personnel operating the service.

If a fitness club adds you as its member, we process your name, email address, optional phone number, the date you joined the club, and your group-class bookings — including your waiting-list position, cancellations and attendance. These data are visible to the club owner who added you, because a class with a capacity limit cannot be run without them. The trainer leading a class sees only the names of the people booked for that class — no email address and no phone number. Other participants see neither your data nor the participant list.

A club sees the data of the people it has granted membership to and no one else; the private clients of trainers working at the club are not visible to the club. The club decides whom it adds as a member and is responsible for the lawfulness of doing so, while FitSlot provides the tool and processes those data in order to deliver the service. The legal bases are necessity for the performance of a contract (booking a spot in a class) and the club's legitimate interest in managing capacity and attendance. When the club removes your membership, your future bookings are cancelled and you are taken off every waiting list; if you have no other relationship in FitSlot, such as a personal trainer, the membership record is marked as deleted.

To deliver mobile notifications, we may process an Expo push token, notification preferences, and basic technical information about the app and device platform.

We use tools including Sentry to detect errors and protect the service. Diagnostic events may include the error message and stack trace, app, operating-system or browser version, visited route, and technical request context needed to reproduce the issue.

Data is processed to provide the service, operate the trial and Stripe subscription, synchronize calendars, maintain security, handle support requests, and fulfill legal obligations.

Legal bases include contract performance, legitimate interest, and user consent where required.

You have the right to access, rectify, delete, restrict processing, transfer data, and object to processing.

You may also withdraw consent at any time and file a complaint with the relevant supervisory authority.

You may request deletion of your account and all associated personal data at any time. Use the account deletion option available in the app settings. If you requested a consultation through a club widget without an account, email privacy@fitslot.io; we will process the request after verifying your identity.

Upon account deletion, personal data is deleted or irreversibly anonymized and the authentication account is permanently removed. A limited set of data may be retained only for a period required by law or necessary for settlement, security, and the defense of legal claims.

In accordance with the right to data portability (Article 20 GDPR), you can download a copy of your data in JSON format at any time using the data export feature in settings.

The export includes your profile, session data, payment history, notes, notifications, and confirmed club consultations associated with your account. A visitor who used a widget without an account can request a copy from privacy@fitslot.io after identity verification.

We retain personal data for the duration of service use and for the period necessary to fulfill legal obligations after termination (e.g., tax documentation - 5 years).

A club-consultation confirmation link expires after 2 hours. Guest data from closed or completed consultations is anonymized no later than 90 days afterwards, unless we receive a verified deletion request sooner. After other retention periods, data is permanently deleted or irreversibly anonymized.

We apply technical and organizational safeguards appropriate to risk, including access control and encryption in transit.

For privacy requests, contact: privacy@fitslot.io.

We rely on trusted providers that process data only on our instructions: Supabase (database, authentication, function hosting), Vercel (web hosting), Resend (transactional e-mail), Sentry (error monitoring), Stripe (payments and subscriptions), inFakt (invoicing and KSeF), Expo (push notification delivery) and Google (optional calendar sync, only after you connect it).

We have a data processing agreement (DPA) with each provider. Data stays in the European Union or is transferred under standard contractual clauses. The current sub-processor list is available on request: privacy@fitslot.io.