Privacy Policy

1. Data Controller

The data controller is Ignacio Vigna, developer and operator of EzGYM. You can reach us at [email protected].

2. Data We Collect

When you create an account we collect: business name, chosen subdomain, email address, password (hashed), phone number (optional), and country. During use we also process the data you enter yourself (clients, invoices, products, etc.) as well as technical data such as IP address and access logs.

3. Purpose of Processing

• Create and manage your account and workspace.
• Provide the contracted service.
• Send service notifications (due dates, payments, updates).
• Detect and prevent fraudulent use.
• Improve and develop the service.

4. Integrations, payments and third parties

EzGYM can integrate with external providers such as Mercado Pago, PayPal, email services, WhatsApp, and electronic invoicing or tax reporting providers. Each integration is used only to provide the features you enable in your account. We do not sell or transfer your data to third parties for commercial purposes.

• When you connect Mercado Pago or PayPal to charge your own clients, you use your own merchant account, credentials or tokens. EzGYM is not the merchant of record and does not receive those funds.
• Sensitive card, bank account or payment method data is processed by the relevant payment provider. EzGYM only receives and stores the information needed to record the payment, such as status, amount, currency, reference, reported fee and basic payer details when returned by the provider.
• We may store the credentials of the integrations you connect, such as API keys, only to run them. Keep them valid and revoke them if you stop using the service.
• Payments for your EzGYM subscription are separate from the payments you collect from your own clients through the platform.

5. Storage, Security and Infrastructure

Your data is hosted on our own servers in Uruguay, with a secondary node to keep the service running. All communications are encrypted with HTTPS and passwords are stored hashed, never in plain text.

• We run automatic backups twice a day and keep them in more than one place, including encrypted storage on Amazon Web Services, outside the country. Each backup is kept for at least 7 days.
• You can request a restore by writing to [email protected]. We coordinate it with you so no data entered after that backup is lost.
• If you turn on the AI assistant or bot, the messages and the data needed to answer them are processed with Ollama, outside Uruguay. If you do not turn it on, that data does not leave the country this way. We do not use your account data to train artificial intelligence models.
• The integrations you turn on (WhatsApp, email, payments or electronic invoicing) process the data they need on each provider's servers, and web traffic goes through Cloudflare to protect it from attacks.
• If we detect a security incident affecting your data, we will notify you without delay and explain the measures taken.

6. Data Retention

We keep your data while your account is active. If you close your account, we delete or anonymize your personal data within 90 days, unless we are legally required to keep it. It may remain for a limited time in backups, which are rotated and deleted automatically.

7. Your Rights

• Access the data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and data.
• Object to processing in certain circumstances.
• Data portability: you can export your data (clients, products, invoices, plans and more) to Excel at any time directly from the app menu, without contacting us.

To exercise any of these rights write to [email protected]. If you believe we did not handle your request properly, you can file a complaint with Uruguay's personal data protection authority (URCDP).

8. Cookies

We use cookies required for session management, security and language preferences. On public pages we may use measurement tools such as Google Analytics or Google Ads. External providers such as Mercado Pago, PayPal or WhatsApp may also set their own cookies when their integrations are loaded.

9. Minors

EzGYM is designed for businesses and is not directed at people under 18. We do not knowingly collect data from minors as platform users.

10. Changes to this policy

We may update this policy occasionally. We will notify you by email if changes are significant. The "Last updated" date always reflects the current version.