Privacy Policy

1. Overview

Rizzrv (“we”, “us”) operates Rizzrv Fitness, software for gyms, boxes and studios. This policy explains what personal data we process, why, where it is stored and what rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR). You can reach us about anything in this policy at fitness@rizzrv.com.

We process personal data in two distinct roles:

• As a controller — for visitors to this website, people who ask us for a demonstration, and the clubs that hold a Rizzrv Fitness account and their staff users (sections 2–3).
• As a processor — for the data of a club’s members. There, the club is the controller and we act on its behalf (section 4).

2. Demo requests and enquiries

When you book a demonstration on our contact page we collect your name, your email address and/or phone number, the way you would like the demonstration (Google Meet, Zoom, WhatsApp or in person) and the date and time you chose. The request is sent by email to our team at fitness@rizzrv.com; it is not stored in our application database.

We use these details only to confirm and hold the demonstration and to follow up on it — a step taken at your request before a possible contract (Art. 6(1)(b) GDPR). We do not add you to any newsletter. If you do not become a customer, we delete the request and our correspondence about it within 12 months. Emails and calls you send us directly are handled the same way.

If you choose a demonstration by Google Meet, Zoom or WhatsApp, the call itself takes place on that provider’s service under its own privacy policy.

3. Club accounts and website visitors

Club accounts

• Account data: the name, email address and password (stored only as a cryptographic hash) of the people who manage a club, and their role.
• Club profile: club name, description, logo and photos, brand colours, address, contact email and phone, rooms, classes, instructors and membership plans.
• Billing data: the club’s subscription status and Stripe customer reference. Card details are entered directly with Stripe and never touch our servers.
• Security data: when someone signs in we record session data including IP address and browser user-agent, used to secure the account.

Website visitors

The public pages of this website set no cookies and run no third-party analytics or advertising trackers. Our infrastructure providers process technical request data (such as IP addresses) in server logs for security and delivery; see section 7.

4. Member data — when your club uses Rizzrv Fitness

When a club adds you as a member, the club is the data controller for your data and Rizzrv stores and processes it on the club’s behalf. This data includes:

• your name, member number, email address and, if the club records them, phone number, date of birth, emergency contact and notes;
• your membership plan and status as recorded by the club;
• your class bookings and attendance;
• your account password (stored only as a cryptographic hash) once you activate it.

We use this data solely to run the club’s services: to send your invitation, let you sign in and see the timetable and your bookings, and to send you messages about your bookings. We never use member data for advertising and never sell it. Rizzrv does not collect membership fees; payments between you and your club stay with your club.

To exercise your data protection rights over member data, contact your club. If you contact us instead, we will forward your request to the club and assist it in responding.

5. Purposes and legal bases

• Providing the Service (accounts, club pages, member area, notifications, billing) — performance of a contract, Art. 6(1)(b) GDPR.
• Demo requests — steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR.
• Security (session logs, abuse prevention) — our legitimate interest in keeping the platform safe, Art. 6(1)(f) GDPR.
• Legal obligations (invoicing, tax and accounting records) — Art. 6(1)(c) GDPR.

6. Cookies and tracking

• fitness.rizzrv.com public pages, the marketplace and the contact form: no cookies, no analytics scripts.
• Member area (fitness.rizzrv.com/‹club›/app) and app.rizzrv.com: strictly necessary session cookies to keep you signed in. No advertising or analytics cookies.

7. Where your data lives

Our application — the APIs and the database holding all account and member data — runs on servers operated by Hetzner in Nuremberg and Falkenstein, Germany. Your data is stored in the EU and handled in line with the GDPR. We use a small number of carefully chosen providers:

8. International transfers

Application data is stored in Germany. Where a provider processes data outside the European Economic Area — for example Cloudflare’s edge network or Resend’s email infrastructure in the United States — the transfer is protected by the EU Standard Contractual Clauses or an EU adequacy decision such as the EU–US Data Privacy Framework.

9. How long we keep data

• Demo requests: up to 12 months if you do not become a customer (section 2).
• Club account data: for the life of the account, then deleted within 90 days of closure.
• Member data: kept while the club’s account is active, or until the club deletes it or instructs us to; deleted within 90 days of the club’s account closure.
• Invoices and billing records: retained as long as tax and accounting law requires.
• Server and security logs: kept for a short period, then rotated.

10. Your rights

Under the GDPR you can ask us (or, for member data, your club) for:

• access to the personal data held about you, and a copy in a portable format;
• correction of inaccurate data;
• deletion, or restriction of processing;
• objection to processing based on legitimate interests;
• withdrawal of any consent you gave, without affecting prior processing.

Write to fitness@rizzrv.com and we will respond within one month. You also have the right to complain to your local data protection supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).

11. Security

All traffic to and from the platform is encrypted with TLS. Passwords are stored only as cryptographic hashes. Each club’s data is isolated per account, access is limited to what is needed to run the Service, and we keep regular backups within the EU.

12. Children

Rizzrv Fitness is aimed at clubs and their adult members; members must be at least 18 years old, and we do not knowingly collect data from children. Contact us if you believe a child has provided us personal data.

13. Changes to this policy

We will update this policy as the Service evolves and change the date at the top when we do. For material changes we will notify account holders by email or in the back office.