Privacy Policy

BULUO is operated by Buluo Limited (company number 826942), a company registered in Ireland and based in Cork, Ireland. In this policy "we", "us" and "our" mean that company.

This policy covers the BULUO mobile app, the gym-branded mobile apps built on BULUO, the web dashboard that gyms, studios and coaches use to run their business, the public booking pages and this website. We call these together the Service.

For any privacy question or request, email support@buluo.ie.

Most personal data in the Service belongs to the relationship between a member and their gym, studio or coach (the Business). For that data the Business decides why and how it is used and is the data controller. We process it on the Business's instructions as its data processor. This includes membership and booking records, attendance, payments to the Business, forms and waivers, messages between you and the Business, and notes the Business keeps about you.

We are the data controller for the data we need to run the Service itself: your login account, the BULUO marketplace and discovery features, security and fraud prevention, product analytics, support requests, and our own billing of Businesses.

If your request is about how a particular Business uses your data, you can contact that Business directly. You can also contact us and we will pass the request on and help them respond.

Depending on how you use the Service, we collect:

• Account details: your name, email address, password (stored as a one-way hash), phone number if you add one, profile photo, date of birth and gender where you choose to give them, and how you heard about a Business.
• Membership and booking records: memberships, class packs and credits, bookings, waitlist places, attendance and check-ins, cancellations, late-cancel and no-show fees, appointments and space rentals.
• Payment information: what you bought, the amount, the date and the status. Card details are entered directly with Stripe and never reach our servers. We hold only a payment reference, the card brand and its last four digits.
• Training and progress data you choose to record: workouts and lifts, personal bests, goals, body measurements, nutrition logs, achievements, challenge entries and programme notes from a coach.
• Health information you choose to share: injuries, medical conditions or other considerations entered in your Fitness Passport or on a health questionnaire or waiver.
• Messages and community content: chats with a Business or coach, posts, comments, reactions, photos and videos, reviews and ratings.
• Messages on connected channels: if a Business connects its WhatsApp, Instagram or Messenger account, the messages you exchange with that Business there, including photos, voice notes and files you send, and delivery and read receipts.
• Device and usage data: device type, operating system, app version, push notification token, IP address, crash reports, and which screens and features are used.
• Location: your approximate location if you allow it, to show nearby gyms. Businesses provide their own addresses.
• Business and staff data: for owners and staff, your role and permissions, availability, time off, classes taught, pay and payroll records, and the bank and identity details Stripe requires to pay out to a Business.
• Enquiries: if you enquire with a Business through a form, a social message or in person, the contact details and notes that Business records about your enquiry.

Most of this comes from you. Some comes from a Business (for example when staff add you as a member, book you into a class or import their existing member list) and some from our payment provider (for example whether a payment succeeded).

We use personal data for the purposes below. Under the GDPR and UK GDPR each use needs a legal basis, shown alongside.

• To provide the Service: creating your account, taking bookings, running memberships, processing payments, checking you in, and showing your schedule and history. Basis: performing our contract with you, or with the Business on whose behalf we act.
• To send service messages: booking confirmations, class reminders, waitlist and cancellation notices, payment receipts and failed-payment notices, by push notification, email, SMS or WhatsApp depending on the settings you choose. Basis: contract and legitimate interests. SMS and WhatsApp are only used if you switch them on.
• To send news and offers from a Business: only where you have opted in, and you can opt out at any time. Basis: consent.
• To process health information: only so that the coaches and Businesses you choose can train you safely. Basis: your explicit consent, which you can withdraw at any time in the app.
• To keep the Service secure: preventing fraud and abuse, enforcing our terms, and investigating incidents. Basis: legitimate interests and legal obligation.
• To improve the Service: understanding which features are used, and finding and fixing crashes. Basis: legitimate interests.
• To meet legal duties: tax and accounting records, responding to lawful requests, and handling data protection requests. Basis: legal obligation.

We do not sell personal data, and we do not use it for third-party advertising.

Health information is a special category of personal data and we treat it with extra care. You are never required to enter it to use the Service.

Health information in your Fitness Passport is private by default. It is shared with a Business or coach only when you choose to share it with them, and you can stop sharing at any time. A Business may separately ask you to complete its own health questionnaire or waiver, which goes to that Business.

A Business can connect its own WhatsApp Business number, Instagram account or Facebook Page to the Service. When it does, messages are sent from and received on that Business's own account, never from a shared BULUO number.

• WhatsApp messages from a Business are sent to you only if you switch WhatsApp messages on in the app, or if you message the Business first. News and offers on WhatsApp need a separate opt-in.
• To send a message we pass your phone number and the message content to Meta, which provides the WhatsApp Business Platform, Instagram and Messenger. Meta processes it under its own terms and privacy policy.
• You can stop WhatsApp messages at any time by replying STOP, or by switching them off in the app.
• The Business's staff can read and reply to these conversations in their BULUO inbox. Attachments you send are fetched from Meta when staff open them and are not copied into our database.

Some Businesses switch on AI features. These can draft or send replies to messages you send the Business, help a coach draft a training plan, or answer a Business owner's questions about their own figures. Where an AI assistant replies to you directly, its first reply says so. You can ask for a person at any time and the conversation is handed to the Business's staff.

These features send the relevant text to our AI provider, Anthropic, to generate a response. We do not use your personal data to train AI models, and no decision with legal or similarly significant effects on you is made solely by automated means.

We share personal data only as follows:

• With the Businesses and coaches you join, book with, message or choose to share your profile with. A Business you have no relationship with cannot see your data.
• With other members, for the things you choose to make visible: community posts and comments, leaderboard entries, shared achievements and your public profile if you opt in to being discoverable.
• With service providers that process data for us under contract: Stripe (payments and payouts), Vercel (application hosting), Neon (database hosting), Cloudflare (media storage), Resend (email delivery), Expo, Apple and Google (push notification delivery), Meta (WhatsApp, Instagram and Messenger messaging, where a Business has connected them), Twilio (SMS, where a Business uses it) and Anthropic (AI features, where a Business has switched them on).
• With authorities or advisers where the law requires it, or where needed to establish, exercise or defend legal claims.
• With a successor, if our business is merged, acquired or reorganised. Your data would stay protected by this policy and we would tell you beforehand.

Some of our service providers process data outside the European Economic Area and the United Kingdom, including in the United States. Where that happens we rely on a legally recognised safeguard, such as an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's standard contractual clauses with the UK addendum where relevant.

You can ask us for more detail about the safeguards for a particular provider at support@buluo.ie.

• Account and profile data: for as long as your account is open.
• Membership, booking and attendance records: for as long as the Business you belong to keeps its account with us, and as that Business instructs.
• Payment and invoicing records: for the period tax and accounting law requires, typically six to seven years, even after an account is closed.
• Messages and community content: until you or the Business delete them, or the account is closed.
• Crash reports and usage data: for as long as they are useful for fixing and improving the Service, after which they are deleted or reduced to statistics that identify no one.

When you delete your account we remove or irreversibly anonymise your personal data, apart from records we are legally required to keep. Anonymised booking and payment records may remain so that a Business's own accounts and reports stay accurate.

Under the GDPR and UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our use of your data, including any use based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent. This does not affect what was done before you withdrew it.

You can download a copy of your data and delete your account from the account settings in the app. For anything else, email support@buluo.ie. We reply within one month. We may need to confirm your identity first.

If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to the Data Protection Commission (https://www.dataprotection.ie), or to the data protection authority where you live. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk).

You control each channel separately in the app: push notifications by category, email, SMS reminders, WhatsApp messages, and news and offers. You can also turn push notifications off in your phone's settings, use the unsubscribe link in a Business's news email, or reply STOP to an SMS or WhatsApp message.

We will still send essential messages about your account and purchases, such as password resets and payment receipts.

We protect personal data with encryption in transit, hashed passwords, encrypted storage of the credentials Businesses connect to us, role-based staff permissions, audit logs of sensitive actions, and strict separation between each Business's data. No system is perfectly secure. If a breach is likely to put your rights at risk we will tell you and the regulator as the law requires.

You must be at least 16 to create your own account. A parent or guardian can add a younger person to their own account as a family member, and remains responsible for that profile and for the bookings made with it. If you believe a child has created an account without that permission, contact us and we will remove it.

This website and the web dashboard use only the cookies and browser storage needed to work: keeping you signed in, protecting against forged requests, and remembering preferences such as light or dark mode. We do not use advertising or cross-site tracking cookies. If that changes we will ask for your consent first.

We may update this policy as the Service changes. The date at the top shows when it was last revised. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

Buluo Limited, Cork, Ireland. Email: support@buluo.ie.