Privacy Policy

1. Who we are and what this covers

This policy explains how Exersites, 204 West 140th Street, New York, NY 10030, United States ("Exersites", "we", "us", "our") handles personal information. It covers exersites.fit, the administration tools we provide trainers, and the public sites we host for them.

Questions, or a request about your own information: [email protected].

2. The distinction that matters

Exersites holds information about two different groups of people, and we have a different role for each. Almost everything below depends on which one you are.

• Trainers are our customers. They sign up with us, they pay us, and we decide how their information is handled. For their information we are the controller, and this policy is the whole answer.
• A trainer's clients never signed up with us. Their information is in the Service because their trainer put it there, or because they created a login on their trainer's site. For that information the trainer decides what happens and we only carry out their instructions. In data protection terms the trainer is the controller and we are their processor.

That is not a technicality. It decides who you ask when you want your information changed or deleted, which is the subject of section 3.

3. If you are a trainer's client, read this

You have an account on a personal trainer's website. That site is hosted by Exersites, but it is the trainer's business, not ours, and we are not allowed to make decisions about your information on our own.

So: ask your trainer first. They can see, correct, and delete your information directly from their admin pages, and they are the right person to ask about why they hold it or how they use it. They may also have their own privacy notice, separate from this one.

If you cannot reach your trainer, or you believe they are not handling a request properly, write to us at [email protected]. We will tell your trainer you asked, and we will help where we are permitted to. We will not delete a trainer's business records at the request of somebody else without a legal reason to, but we will not ignore you either.

What is useful to know either way: we do not sell your information, we do not advertise to you, we have no tracking or analytics scripts, and the only cookie your trainer's site sets for you is the one that keeps you signed in.

4. What we collect

From a trainer, directly

• Name and email address, and a password, which we store only as a bcrypt hash and never in a form we or anyone else can read.
• Business details you enter: business name, the subdomain you choose, your tagline and description, your page sections, your services and prices, and any photographs you upload.
• Billing information. Your card is entered on Stripe's own pages and Stripe stores it. We never see or store a full card number. We keep the customer and subscription identifiers Stripe gives us, along with your plan, trial and renewal dates, and the billing address Stripe passes back.
• Registrant contact details, if you take a custom domain on the Pro plan: your name, email address, telephone number, and postal address. The rules governing domain registration require these, and we cannot register a domain without them. See section 5.
• Anything you write to us, including messages sent through the suggestion box.

About a trainer's clients, on that trainer's behalf

• Name and email address, and a password stored as a bcrypt hash.
• Bookings, session history, and remaining session balances.
• Purchase records for packages and payment links, with the amounts and dates. Card details are not among them; Stripe holds those.
• Training programs and videos their trainer assigned them, and notes their trainer wrote.

We collect this because the trainer asked us to hold it. We do not decide what goes in it.

Automatically, from anybody who visits

• Server request logs: the IP address a request came from, the time, the page or endpoint requested, the response, the browser's user agent string, and the referring page. These exist to keep the Service running and secure, to make rate limiting work, and to let us debug a failure.
• Your IP address is also used to enforce rate limits on sign in attempts, so that somebody cannot guess at passwords indefinitely.

5. What we do not collect

Listing this explicitly because earlier versions of this policy claimed several of these, and it was not true.

• No location data. We do not use GPS and we do not track anybody's location. Your IP address appears in a server log and is not used to work out where you are.
• No analytics and no advertising. There is no Google Analytics, no advertising pixel, no conversion tag, and no third party script of any kind on any page we serve. We run no advertising and we have no advertising partners.
• No tracking across sites. Nothing we set follows you anywhere. There are no third party cookies.
• No social logins. You cannot sign in with Facebook, Google, or anything else, so we receive nothing from them.
• No sensitive categories. We do not collect race or ethnicity, religion, political opinion, sexual orientation, biometrics, or genetic data.
• No health records. The Service is not built to hold them and trainers are told not to put them in it.
• Nothing bought from anybody. We do not buy or receive personal information from data brokers or any other third party source.

6. Why we use it

• To create and run accounts, and to keep people signed in securely.
• To provide the Service: serve a trainer's public site, take bookings, deduct sessions, deliver programs and videos.
• To take subscription payments, and to let a trainer take their own client payments through their own Stripe account.
• To send transactional email: password resets, session reminders, receipts, and notices about an account or a payment.
• To register and renew a custom domain, where a trainer has asked for one.
• To keep the Service secure: rate limiting, spotting abuse, and investigating an incident.
• To answer support requests.
• To comply with the law, and to establish or defend a legal claim.

We do not use anybody's information to train machine learning models, and we do not use it for marketing to a trainer's clients.

7. Our legal bases, if you are in the EEA, the UK, or Switzerland

• Performance of a contract, for everything needed to give a trainer the Service they are paying for.
• Legitimate interests, for keeping the Service secure, preventing abuse, and keeping server logs. We have weighed this against your interests and we keep the logs minimal and short lived.
• Legal obligation, for tax and accounting records and for responding to a lawful request.
• Consent, in the rare case we ask for it. You can withdraw it at any time, and withdrawing it does not undo processing that already happened lawfully.

For a trainer's clients, the legal basis is the trainer's to determine, not ours.

8. Who receives it

Four companies, because the Service cannot run without them. Each gets only what its job requires, each is bound by a contract, and none of them may use it for their own purposes.

Who	What for	What they receive
Stripe	Subscription payments, and trainers' own client payments	Card details entered on Stripe's pages, name, email address, billing address, amounts. See Stripe's privacy policy.
Cloudflare	Hosting, DNS, network protection, and domain registration	Every request to the Service passes through it, including IP addresses. Registrant contact details, for a custom domain only.
Resend	Transactional email	The recipient's email address and the content of the message.
Our backup provider	Offsite encrypted backups	Database snapshots, which contain everything in the Service. Stored in object storage, never read except to restore.

Beyond those, we share personal information only:

• with a domain registry, where registration rules require registrant details to be passed on;
• when the law requires it, or to respond to a valid legal request, and we will tell you unless we are forbidden to;
• to establish or defend a legal claim, or to protect somebody's safety;
• to a buyer or successor, if Exersites is merged, acquired, or sold, in which case we will tell you before your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for behavioural advertising. We have not done so in the preceding twelve months, in the sense those words carry under United States state privacy law.

9. Cookies and browser storage

We set four cookies and all four are strictly necessary: three that keep a signed in session, and one that protects against cross site request forgery. We use no advertising or analytics cookies and no third party cookies. The Cookie Policy names each one and says what it does.

10. Where it is stored

Our servers are in the United States, and that is where your information is processed. If you are outside the United States, using the Service means your information is transferred there. United States law may protect it less comprehensively than the law where you live.

For transfers out of the EEA, the UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses, and the equivalent UK addendum, with our providers. We will send you a copy of the relevant clauses on request.

11. How long we keep it

Concretely, rather than "as long as necessary":

• Account and business data, for as long as the account is open.
• After an account closes, the Trainer Site stops serving and we retain the data, so that a cancellation made in error or a payment problem that gets fixed can be undone without you losing your business records. We do not delete it on a fixed schedule today. Ask us and we will delete it, at [email protected], and we will confirm when it is done. We would rather tell you that than publish a deletion timetable we do not yet keep to.
• Nightly database snapshots, for 14 days on our own server, then deleted automatically. Copies in offsite object storage are removed on the retention rule configured on that storage. So deleted information can persist in a backup for a short period after it is gone from the Service, which is normal and which we cannot selectively reach into.
• Server request logs, for a short operational period, then rotated away.
• Billing and tax records, for as long as tax law requires us to keep them, which is longer than the rest and is not something we can shorten.
• A trainer's clients' information, for as long as the trainer keeps it, or until the trainer's account closes, whichever comes first. The trainer controls this, not us.

12. How we protect it

Specifically, so you can judge it:

• Passwords are stored as bcrypt hashes. Nobody at Exersites can read a password, including us.
• Sessions are signed cookies, marked HttpOnly and SameSite, and served over HTTPS in production.
• Every state changing request carries a cross site request forgery token.
• Sign in attempts and other sensitive endpoints are rate limited.
• A Content Security Policy restricts what a page may load, which is why no third party script can run on our pages even by accident.
• Each trainer's business data lives in its own separate database file, not in a shared table keyed by a tenant column. One trainer cannot read another's data through a query.
• Backups are taken nightly and copied offsite.

No system is perfectly secure, and we cannot promise that no attacker will ever succeed. If a breach affects your personal information we will tell you and the relevant regulator as the law requires.

13. Children

An Exersites account is for adults. You must be 18 or older to hold one, and we do not knowingly collect information from a child in order to give them a trainer account.

A trainer may coach someone under 18. If so, it is the trainer's responsibility to get a parent or guardian's consent before creating a client login or storing that person's information, and to comply with the law where they work. If you believe a child's information is in the Service without proper consent, write to [email protected] and we will act on it.

14. Your rights, and how to use them

Depending on where you live you may have the right to know what we hold, to get a copy of it, to correct it, to delete it, to restrict or object to how we use it, to data portability, to withdraw consent, and not to be discriminated against for asking. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have these rights under their own state law, as do residents of the EEA, the UK, Switzerland, and Canada.

How to make a request. Two ways, and the first is usually faster:

• Do it yourself. A trainer can see and change their own details on the account page, edit their business information from the admin pages, and close the account from the account page, which starts the deletion described in section 11. A client can edit their own details on their trainer's site.
• Email us at [email protected] with what you want and the email address on the account. We will respond within the time the applicable law allows, which is 30 days in most places, and we will tell you if we need longer.

We will verify that a request comes from the person it concerns, using the account email address, before we act on it. That is a protection for you. If we cannot verify it we will say so rather than act on a guess. An authorised agent may make a request on your behalf with written proof that you authorised them.

If you are a trainer's client, see section 3 first: your trainer can act faster than we can, and for most requests they are the party that has to decide.

If we say no. We will tell you why. Under several United States state laws you can appeal, by replying to our decision at the same address; we will answer the appeal in writing. If you are still unhappy you can complain to your state attorney general, or, in the EEA or the UK, to your data protection authority, or, in Switzerland, to the Federal Data Protection and Information Commissioner.

Marketing. We send trainers transactional email because it is necessary to run their account, and you cannot turn that off while the account is open. If we ever send marketing email it will carry an unsubscribe link and honouring it will be immediate.

15. Do Not Track

There is no agreed standard for how a website should respond to a browser's Do Not Track signal, so we do not act on one. It makes no practical difference here: we do not track anybody across sites whether the signal is set or not.

16. United States state law disclosures

The categories of personal information we have collected in the preceding twelve months, using the category names California law uses. This table has been corrected; an earlier version of it claimed several categories we have never collected.

Category	Collected	Detail
A. Identifiers	Yes	Name, email address, IP address, account identifier. Postal address and telephone number only for a custom domain registrant.
B. California Customer Records information	Yes	Name, contact details, and billing address. No education or employment history.
C. Protected classification characteristics	No	We do not collect age, date of birth, gender, race, ethnicity, national origin, or marital status.
D. Commercial information	Yes	Subscription and purchase records, amounts, and dates. No card numbers.
E. Biometric information	No
F. Internet or network activity	Yes	Server request logs only. No browsing history, no behavioural profile, no interest data.
G. Geolocation data	No	We do not collect location. An IP address in a log is not used to locate anyone.
H. Audio, electronic, or visual information	Yes	Photographs and videos a trainer uploads to their own site. We create none of it and we do not record calls.
I. Professional or employment information	Yes	A trainer's business name and description, which they write themselves.
J. Education information	No
K. Inferences	No	We build no profiles and draw no inferences about anybody.
L. Sensitive personal information	No

We retain each collected category for as long as the account is open, and then as set out in section 11. We do not sell personal information, we do not share it for cross context behavioural advertising, and we do not use or disclose sensitive personal information for any purpose that would require us to offer you a right to limit it. We have no financial incentive programme.

California Shine The Light. California residents may ask once a year which categories of personal information we disclosed to third parties for their direct marketing purposes. The answer is none, because we do not do that.

17. Changes to this policy

We may update this policy. The date at the top changes when we do. If a change is material we will tell trainers by email or in the Service before it takes effect. Please read it again from time to time.

18. Contact us

To ask a question, exercise a right, or request a data processing agreement or a copy of our Standard Contractual Clauses:

Exersites
204 West 140th Street
New York, NY 10030
United States
[email protected]