Privacy Policy

Who we are

Pullso is a service of Extremely Balanced, Lda., Portuguese company number (NIPC) 519534425 ("Pullso", "we"). For any privacy question, contact us at hello@pullso.app.

Who is responsible for your data

Gyms, boxes and studios use the Pullso app to manage their members, and it appears under your gym's name and colours. Your gym is the controller of your data: it decides what data it collects and what it is used for. Pullso processes that data on the gym's behalf, as a processor, to provide the app and the service.

You can send questions or requests to your gym or directly to us at hello@pullso.app. We forward to the gym anything that is the gym's to decide.

What data we process

Depending on the modules your gym uses, the app processes:

• Account: name, email, password (stored only in hashed form) and language.
• Member profile: phone, date of birth, training goal, assigned trainer, and other fields your gym defines, such as an emergency contact.
• Gym activity: check-ins, class bookings, personal training sessions and their notes, and session packs.
• Body assessments: weight, body measurements, fat and muscle percentage, and notes, recorded by you or your trainer.
• Payments: plan, membership fees, amounts, payment method and Multibanco references. We do not store card details. Your MB WAY number is sent to EuPago to process the payment and is not stored by us.
• Community: the training partners you add and your position on leaderboards. You can hide yourself from leaderboards and the attendance list in the app's privacy settings.
• Signed documents: name, signature, the signed document, IP address and device information at the time of signing, and when you opened each document.
• Notifications and devices: your push notification token, your notification preferences, and the device name or model for each signed-in session.
• Technical logs: server request logs and app error reports, used to keep the service secure and working.

If your gym uses profile fields to collect health information, such as injuries or medical notes, that processing is the gym's responsibility, and the gym must have an appropriate legal basis, such as your explicit consent.

Device permissions

• Camera: only to scan a training partner's QR code. We do not take or store photos.
• Notifications: for class reminders, payments and messages from your gym. They are optional and you can turn them off at any time.

The app does not access your location, contacts, photos or microphone.

What we use your data for

We use the data to provide the app on your gym's behalf (managing your account and membership, bookings and check-ins, payments, documents, progress and notifications), to keep the service secure and fix errors, and to meet legal obligations such as tax rules.

The legal bases are performing your contract with the gym (GDPR Art. 6(1)(b)), complying with legal obligations (Art. 6(1)(c)), the legitimate interest in keeping the service secure and working (Art. 6(1)(f)) and, for push notifications, your consent (Art. 6(1)(a)).

We do not use your data for advertising, we do not sell it, and we do not track you across other apps or websites. The app has no ads and no third-party analytics.

Who we share your data with

We share data only with your gym and with the providers we need to run the service, who process it on our instructions:

• Supabase: database, hosted in Ireland (EU).
• Hetzner Online: servers and file storage, such as signed documents, in Germany (EU).
• EuPago: MB WAY, Multibanco, Apple Pay and Google Pay payments, in Portugal.
• Resend: email delivery, in the United States.
• Expo: push notification and app update delivery, in the United States, through Apple's and Google's notification services.
• Grafana Labs: technical logs and error reports, in the United Kingdom.

Transfers to the United States rely on Standard Contractual Clauses or the EU-US Data Privacy Framework. The United Kingdom is covered by a European Commission adequacy decision.

How long we keep your data

We keep your data while you have an account. If you delete your account, we erase your data within 30 days, with these exceptions:

• Payment and billing records: kept for the period tax law requires (10 years in Portugal).
• Signed documents: kept only when the gym is legally required to keep them, and only for as long as needed.
• Technical logs: deleted automatically after 14 days.

Children

The app is intended for people aged 18 and over. Profiles for minors are created by the gym and managed by a parent or guardian from their own account. Minors do not sign in to the app, and messages about their profile go to the parent or guardian.

Deleting your account

You can ask us to delete your account and its data at any time, even without the app installed.

What data we collect

We only collect the data you voluntarily provide in the demo request form: name, email, mobile phone, gym name and, optionally, your approximate number of members. We use Cloudflare Turnstile to protect the forms from spam, which may set cookies. The site also stores a single entry in your browser's local storage (localStorage), the pullso.locale-hint key, which only records whether you dismissed the language banner. It is not used to identify or track you.

What we use your data for

We use your data solely to respond to your demo request and, where you consent, to contact you about Pullso. The legal basis is your consent when submitting the form (GDPR Art. 6(1)(a)) or, where applicable, pre-contractual steps (Art. 6(1)(b)).

Who we share your data with

We use Resend, Inc. to send emails and Cloudflare, Inc. to protect the forms from spam (Turnstile). Your data may be processed in the United States under Standard Contractual Clauses. We do not sell or share your data with third parties for marketing purposes.

How long we keep your data

We retain demo request data for 24 months after the last contact, after which it is deleted, unless a longer period is required by law.

Your rights

You have the right to access, rectify, erase, restrict processing of, object to, and request portability of your data. To exercise these rights, email hello@pullso.app. For app data, you can also contact your gym. You also have the right to lodge a complaint with the CNPD (Portugal's data protection authority).

Changes to this policy

We may update this policy. If the changes are significant, we will let you know in the app or by email. The date at the top shows when it was last updated.