Privacy Policy — Gympillar

If you are a parent, start here

Gympillar is the software your club uses. Your child's registration, medical notes and payments were given to the club, and the club decides what it collects and how long it keeps it. We hold that information on their behalf and act on their instructions.

So if you want to see, correct or delete what is held about your family, ask your club first — they can act on it immediately, and we would have to refer the request back to them anyway. If they do not respond, tell us through our contact form and we will help you reach them.

The two roles we play

This matters because it decides who you ask for what.

For a club's own account — the staff who sign in, the club's billing, and anyone who contacts us through this website — we decide what is collected and why. That part of this policy is ours.
For families and athletes registered with a club — we are a service provider. The club decides; we process on its instructions in order to run the service for it.

What we collect

From club staff

Name, email address, the role you hold, and your two-factor secret and recovery codes, which are stored encrypted. Passwords are stored as one-way hashes and cannot be read by us or recovered for you.

From families, on behalf of the club

Guardian names, email addresses and phone numbers; athlete names, dates of birth and emergency contacts; and — where the club asks for it — medical and allergy information about a child, which is sensitive and is treated accordingly. Also registrations, attendance, invoices, payments and any waivers agreed to, including the exact version agreed and when.

We do not collect any of this from children directly. It comes from a parent or guardian registering, or from club staff entering it.

Payments

We never see or store card numbers. Card details go straight to Stripe. We keep what Stripe tells us about a payment: an amount, a status, the last four digits and an identifier. Where a club uses Interac e-Transfer reconciliation, we store the deposit notification emails it forwards to us — including the raw message — so a failed match can be investigated and corrected later.

Automatically

Server logs containing IP address, browser and the pages requested, kept for security and troubleshooting. Records of messages we send on a club's behalf — recipient, subject, the address it left as, and whether it was sent, skipped or failed.

One analytics tag, on this website only. The marketing pages at gympillar.com carry Google Analytics, which tells us which pages are read and where visitors came from. It is not loaded in the application: not in the admin, not on any club's site, and not on the pages where a family signs in, pays or signs a document. No advertising trackers anywhere. The only cookies the service itself sets are the ones that keep you signed in and protect forms from cross-site request forgery. There is no cookie banner; if you would rather not be counted, a content blocker stops the tag and nothing on the site depends on it.

Why we use it

To run the service a club is paying for — its classes, registers, invoices and website
To send the messages a club asks us to send its families, under that club's name
To take payment for a club's own subscription
To keep accounts secure, investigate abuse and meet legal obligations
To support you when you write to us

We do not sell personal information, we do not share it for advertising, and we do not use it to train machine-learning models.

Who else processes it

These are the providers who handle personal information for us in order to make the service work. Each is bound to use it only for that purpose.

Hetzner Online GmbH — hosting for the application and its database (United States)
Stripe — card payments and club subscriptions (United States, Ireland)
Resend — sending email (United States)
Twilio — sending text messages, where a club has switched them on (United States)
JagCall — telephony for clubs provisioned with their own number (Canada)
Google — address lookup while an address is being typed, and Google Analytics on the marketing pages at gympillar.com (United States)
Cloudflare — DNS and certificate issuance for custom domains (United States)
FolioSign — electronic signature, where a club uploads documents to be signed (Canada)

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Where it is stored, and what that means

Gympillar is built and run in Canada, and the servers it runs on are in the United States. Your club's data and your families' data are stored and processed there, and some of the providers above are located there too.

We are telling you plainly because it has a consequence: while information is in another country, it is subject to that country's laws, and may be accessible to its courts and law enforcement under their legal processes, regardless of the protections that apply in Canada. Canadian privacy law permits this and requires that you be told about it, which is what this section is for.

How long we keep it

For as long as the club's account is open, because that is what the club is using it for. After an account ends, we keep the club's records for 90 days so they can be exported, then delete them.

Two things outlive that. Financial records are retained for as long as tax law requires. Records showing that somebody asked us to stop texting them are kept indefinitely, because the only way to honour an opt-out permanently is to remember it.

How it is protected

Everything travels over HTTPS, and the database is on a private network
Two-factor authentication is mandatory for every club owner and administrator
Access tokens, integration secrets and two-factor secrets are encrypted at rest
Every query is scoped to a single club, so one club cannot read another's families
A staff member sees only what their role allows — a coach sees only the classes they teach, not the whole club's children

No system is perfect. If a breach affects you and creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.

Your rights

You may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. Ask through our contact form. We will respond within 30 days.

If your request is about a family registered with a club, see the first section — the club holds that decision, and we will pass you to them.

If you are not satisfied with how we have handled a privacy question, you may complain to the Office of the Privacy Commissioner of Canada, or to your province's commissioner.

Changes

If we change this policy materially, we will email the address on each club's account and update the date at the top of this page.

Reaching us

Clickwebstudio Technologies Inc. Privacy questions go through our contact form.