Basics
1. Who we are
Gymbly and Gymbly Play are provided by TECHBUILDERS HUB ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (TECHBUILDERS HUB SINGLE MEMBER P.C.), trading as TECHBUILDERS HUB («TBHUB», «we»).
- Registered office: Kolokotroni 61, 166 73 Voula, Greece
- Company registration number (GEMI): [COMPANY REG. NO. (GEMI)] · VAT number: [VAT NO.] · Tax office: [TAX OFFICE (DOY)]
- Email for data matters: support@gymbly.app [TEMPORARY EMAIL — NOT WORKING YET]
- Data Protection Officer: [DATA PROTECTION OFFICER]
2. Who is responsible for your data
- Players of Gymbly Play: the controller is TBHUB.
- Businesses (owners and staff who use the front desk, billing details): the controller is TBHUB.
- Members and customers of a gym or venue (memberships, attendance, payments at the till, workouts, nutrition): the controller is the gym/venue itself, and TBHUB processes the data only on its behalf, as a processor (see Terms of Use — Processing of data). For this data, contact your gym first; if you write to us, we will forward your request.
- When you book a court through Play, the venue receives the booking details (name, mobile, time) and processes them as a controller in its own right in order to serve you and issue its receipt.
What data and why
3. What data we collect
- Account: full name, email, mobile, password (stored only as a hash), language. If you sign in with Google or Apple, an identifier of your account there and the email they give us.
- Player profile: photo (if you upload one), sports, level, reliability, statistics, trophies, friends, teams, personal invitation code.
- Activity: bookings, open matches, results, messages in a match's chat, comments, tournament entries, booking requests to venues, notifications.
- Payments: amount, date, status of payment and refund, Stripe identifiers. We do not see or store your card details — you give them directly to Stripe.
- Receipts: your name and email on the Receipt for Services Rendered for the service fee.
- Businesses: details of the owner and staff (name, mobile, email), billing details (company name, VAT number, tax office, address), address and location of the venue.
- Gym app (on behalf of the gym): membership, payments and instalments, QR entries (and a check that you are at the gym at the moment of check-in, if the gym requires it), class bookings, workouts, and whatever you give for the AI Coach or nutrition (see Artificial intelligence). If you connect WHOOP or Strava, the activities of the last 7 days (calories, heart rate, intensity).
- Technical: session cookies (see Cookies) and the server's error logs.
- Contacts you invite: when you invite someone who does not have Gymbly to a team or tournament, the name and mobile number you give, so that we can send them the invitation SMS.
4. Why we use it and on what legal basis
- To run your account and the service (bookings, matches, teams, tournaments, friends, ranking, notifications): performance of the contract with you (Article 6(1)(b) GDPR).
- For payments and refunds through Stripe: performance of the contract (Article 6(1)(b)).
- For tax documents (receipts, invoices, myDATA) and their retention: legal obligation (Article 6(1)(c)).
- For security (mobile verification by SMS, prevention of fraud and abuse, backups, fixing errors): legitimate interest (Article 6(1)(f)).
- To sort venues by distance: only if you give location permission on your device (see Location).
- For invitation SMS to friends who do not have Gymbly: legitimate interest, yours (to invite them) and ours; one SMS per invitation, without advertising.
- For promotional updates from TBHUB: only with your consent, which you can withdraw whenever you want.
We do not sell your data, we do not use it for third-party advertising and we do not take automated decisions with legal or similarly significant effects for you. Level and ranking are calculated automatically from the results, only so that matches are well matched.
5. Location
Your location is used only if you give permission on your device or browser, and only to sort venues and matches by distance from you. The coordinates are sent with each search to our server so that the distances can be calculated; they are not stored in the database and are not linked to your account. Without permission, the app works normally with a default area.
Where your gym requires a location check for the entry QR, your location is checked at the moment you request the QR, to confirm that you are inside the gym. Here too the location is not stored; if you are outside, only the distance is logged, for troubleshooting.
6. Artificial intelligence (only in the gym app)
Gymbly Play does not use artificial intelligence on your data. In the app of a gym, and only if the gym has enabled these features and you use them:
- AI Coach (training programme): the answers you give (goals, level, sex, age, height, weight, injuries, days and duration, notes) and the gym's equipment are sent to Anthropic; not your name or contact details.
- Nutrition: your nutrition profile (goals, sex, age, weight, height, type of diet, allergies, preferences) is sent without your name, and — for the estimate of a meal — the photo or description you give.
Anthropic processes this information as a sub-processor in order to return the programme or the estimate; under its commercial terms it does not use it to train its models [TO BE CONFIRMED]. Injuries and allergies are health data: you give them only if you want to, and the gym (as the controller) asks for your explicit consent.
Who sees the data
7. What other users see
- Other players see your name, photo, level, trophies and your place in the ranking, and — in the matches, teams and tournaments you take part in — your participation and results.
- The venue where you book sees the booking, your name and mobile number, and whether you have paid.
- The organiser of a tournament or the captain of a team sees the participants and, to tell people with the same name apart, only the last 3 digits of their mobile number.
- Your mobile number and email are not shown in full to other players.
8. Providers who help us (processors)
- Hetzner Online GmbH — hosting of the application and the database in data centres in the EU.
- Stripe — payments by card, Apple Pay, Google Pay, refunds, the businesses' subscriptions (Stripe privacy policy).
- [SMS PROVIDER] — sign-in codes, invitations and notifications by SMS.
- [E-INVOICING PROVIDER] — issuing receipts and invoices and transmitting them to AADE's myDATA.
- [EMAIL PROVIDER] — sending email from the service.
- [MAP PROVIDER] — the tiles of the venues map; it receives your device's IP address and the area of the map you are viewing, not your account.
- Google and Apple — only if you choose to sign in with your account there. Google Maps — only at the front desk, when a business looks up its address.
- Anthropic — only in the gym app and only as described in the section Artificial intelligence. WHOOP / Strava — only if you connect them yourself.
In addition, data is given to AADE (the Independent Authority for Public Revenue, myDATA) for tax documents, and to public authorities only when the law requires it.
9. Transfers outside the European Union
The application and the database are hosted in the EU. Some providers (e.g. Stripe, Anthropic, Google, Apple) may also process data in the USA. In those cases the transfer is made with the safeguards of the GDPR: the provider's certification under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards at our email.
How long, how, and your rights
11. How long we keep data
- Account and profile: for as long as you have an account. On deletion, they are erased or anonymised.
- Bookings already played and results: they remain anonymised after deletion (without name, mobile, email), because they are part of the history of the venue and of the other players.
- Receipts, invoices and payment records: for as long as tax law requires, as a rule 5 years from the end of the financial year to which they relate, including after the account is deleted.
- SMS codes: a few minutes, until they are used or expire.
- Error logs: [LOG RETENTION PERIOD].
- Backups: [BACKUP RETENTION PERIOD]; then they are replaced.
- Data of gym members: as set by the gym and for as long as its Gymbly subscription lasts.
For the lawyer: The retention period for tax records (5 years, or longer in certain cases) should be checked by a lawyer/accountant.
12. Deleting your account
You can delete your account whenever you want, inside the app or from the Account deletion page.
- First the bookings are settled: your future bookings are cancelled as if you cancelled them yourself (the court price is refunded, not the service fee) and you leave the matches you take part in. If there is a booking or share that can no longer be cancelled (after the free cancellation limit), the deletion takes place after it has passed.
- Then your details are anonymised (name, email, mobile, photo, profile, Google/Apple sign-ins), friends, messages, comments and notifications are deleted, and you are signed out of all devices. In teams and tournaments you appear as «Deleted user» («Διαγραμμένος χρήστης»).
- Bookings already played, results and trophies remain without your name. Receipts remain as they were issued, for as long as tax law requires.
- Your record at a gym is the gym's record: the deletion removes its link to your account and your sign-in details. To have the record itself deleted, contact the gym.
13. Security
The connection to the service is encrypted (https), passwords are stored only as a hash, sign-in cookies cannot be read by the page's scripts, only those who need it have access to the database, and we keep backups. If a breach occurs that affects you with a high risk, we will inform you, as the GDPR requires.
14. Minors
To have an account of your own you must be at least 16 years old. For younger people, the account is opened and managed by their parent or guardian. If we learn that someone younger has opened an account without a guardian, we will delete it.
15. Your rights
You have the right of:
- access — to find out what data of yours we hold and to get a copy;
- rectification — you can correct much of it yourself in your profile;
- erasure — see Deleting your account;
- portability — to receive the data you gave us in a machine-readable format;
- restriction of and objection to processing based on legitimate interest;
- withdrawal of consent whenever you want (e.g. location permission from your device's settings), without affecting what was done before.
Write to us at support@gymbly.app [TEMPORARY EMAIL — NOT WORKING YET] from the email of your account; we reply within one month. For data concerning your gym, contact the gym (see Who is responsible).
If you believe your rights are being infringed, you can lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, www.dpa.gr).
16. Changes to this policy
If we change this policy, the date at the top will change too. For material changes (e.g. a new purpose or a new type of provider) we will inform you inside the app or by email before they take effect.