Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Scala Intellis Limited (“we”, “us”), operator of Gym Stack 360 (the “Service”), handles personal data. If you are a member of a gym that uses Gym Stack 360, that gym is the controller of your data — please see “If you are a gym member” below.

1. Who we are and our roles

Gym Stack 360 is a management platform for gyms and fitness businesses. We handle personal data in two capacities:

As a controller — for the account data of the gym operators who subscribe to the Service (our direct customers).
As a processor — for the data that gym operators store about their own members, which we process on their instructions to provide the Service.

2. Information we collect

From gym operators (our customers)

Account details: name, business/gym name, email, phone, country, and login credentials (managed via our authentication provider).
Billing details: subscription tier and status. Card payments are processed by Stripe; we do not store full card numbers.
Usage, device, and log data, and cookies (see “Cookies”).

Gym member data (processed on behalf of gyms)

Member profile and contact details, check-in and access records, membership and plan details, class bookings, and payment records — entered or generated by the gym.
Member payments are processed by Stripe on the gym's connected Stripe account; we do not store full card numbers.

Enquiries through a gym's Gym Stack 360 link (processed on behalf of gyms)

When someone fills in a gym's enquiry form on a Gym Stack 360 page (for example a link from the gym's Instagram or Facebook), we collect the name, email and/or phone number, message and consent they give, plus which post or link they came from. This goes to that gym's lead list; the gym is the controller.
We count visits to these links using a short-lived cookie, so a visit isn't counted twice in one day. We don't use it to track you elsewhere.

Facebook and Instagram data (only when a gym connects its accounts)

See section 6 below.

3. How we use personal data

To provide, operate, secure, and improve the Service.
To process subscriptions and payments and send service-related communications.
To provide support and respond to requests.
To detect, prevent, and address fraud, abuse, and security issues.
To comply with legal obligations.

4. Legal bases (EEA/UK)

Where the UK/EU GDPR applies, we rely on: performance of a contract; our legitimate interests in operating and securing the Service; your consent (where required, e.g. certain cookies or marketing); and compliance with legal obligations.

5. How we share data

We share personal data with service providers (“sub-processors”) that help us run the Service, under appropriate contractual protections, including:

Stripe — payment processing (operator subscriptions and member payments).
Twilio — SMS/WhatsApp notifications.
Resend — transactional email.
Auth0 — authentication and login.
Google Cloud — hosting and infrastructure, including Google's Gemini AI models, which draft marketing text and images from the information a gym provides. We don't use gym or member data to train AI models.
Meta Platforms Ireland Limited — Facebook and Instagram, only for gyms that connect their accounts (see section 6).
Error-monitoring and analytics providers used to keep the Service reliable.

We may also disclose data to comply with law or protect rights and safety, and in connection with a merger, acquisition, or sale of assets. We do not sell personal data.

6. Facebook and Instagram

Gyms can connect their Facebook Page and Instagram professional account to Gym Stack 360 so they can publish posts and see how they perform. This is optional and done by the gym through Facebook's own login screen. When a gym connects:

What we receive and store: an access token from Meta (stored encrypted), the IDs, names, usernames, profile pictures and follower counts of the Page and Instagram account the gym chooses, the Facebook user ID of the person who connected them, the posts we publish for the gym and their performance figures (such as reach, likes, comments, saves and shares).
Discover: if the gym chooses other public Instagram business or creator accounts to learn from, we read those accounts' public profile details and recent public posts (captions, media links, like and comment counts, dates) through Meta's Business Discovery feature, using the gym's own connection. This information is kept separately for each gym, is only shown to that gym, and is refreshed or removed regularly. We never repost other accounts' photos, videos or text.
Why: to publish only the posts the gym has approved, to show the gym its results, and to show the gym what peer gyms post publicly. We do not read private messages, ad accounts or payment details, and we don't post anything the gym hasn't approved.
How long: while the connection is active. When a gym disconnects, we delete the access token immediately; published-post records and their figures are kept with the gym's account until the gym deletes them or closes its account. Discover data is deleted when the gym stops watching an account.
How to disconnect: in Gym Stack 360 under Marketing → Connected accounts, or in Facebook under Settings & privacy → Settings → Business integrations (or Apps and websites).
Deletion requests: if you remove Gym Stack 360 from your Facebook account or ask Facebook to delete your data, Meta notifies us and we delete the connection data linked to your Facebook user automatically; you'll get a confirmation code and a status page. You can also email support@gymstack360.com to ask us to delete it.

Our use of information received from Meta's platform follows Meta's Platform Terms and Developer Policies.

7. International transfers

We operate in the United States, Canada, the United Kingdom, Australia, and New Zealand, and use providers that may process data in other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

8. Data retention

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes. Gym operators can export or delete their data from within the Service; on account termination we delete or anonymize data after a reasonable wind-down period, except where retention is legally required.

9. Security

We use technical and organizational measures — including encryption in transit, access controls, and reputable infrastructure providers — to protect personal data. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

Depending on your location, you may have the right to access, correct, delete, or port your personal data, to object to or restrict processing, and to withdraw consent. To exercise these rights, contact us at support@gymstack360.com. You also have the right to lodge a complaint with your local data protection authority.

11. If you are a gym member

If a gym uses Gym Stack 360, that gym is the controller of your personal data and decides how it is used. Please direct access or deletion requests to your gym. We will assist the gym in responding to such requests as their processor.

12. Cookies

We use cookies and similar technologies that are strictly necessary to run the Service (e.g. authentication and session management) and, where permitted, to understand usage and improve the Service. You can control non-essential cookies through your browser or any cookie controls we provide.

13. Children

The Service is intended for gym businesses and is not directed to children. Where a gym enrolls members who are minors, the gym is responsible for obtaining any required parental consent and for its lawful basis to process that data.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date; material changes may be communicated to account holders directly.

15. Contact

Scala Intellis Limited
Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland
Email: support@gymstack360.com