DRAFT. Pending solicitor review. Do not treat this as legal advice or as a finished policy.
Privacy notice
GreetRep is a private beta of an AI front desk for gyms and clubs, built by a gym owner in Ireland. The legal entity name will be added after solicitor review. Until then, do not rely on this notice as a finished GDPR document.
Roles
For visitor and lead data, the gym is the controller and GreetRep is the processor. A data processing agreement is required before a gym uses GreetRep with real member or lead data. For the gym owner's account (name, email, gym settings), GreetRep is the controller.
What we store
- Owner account: name, email, session.
- Gym profile: timetable, prices, FAQs, tone, handoff contacts, booking settings.
- Chats: messages, and a name and contact only after the visitor agrees, used to reply and to book.
- Leads, trials, webhook results, feedback, and the weekly email log.
What we do not do
We do not sell personal data. We do not ask for health data. If a visitor mentions an injury, the chat is handed to the gym and we do not give advice. We do not put testimonials on the public site unless the owner ticked the consent box, and not during this beta.
Retention
If a gym cancels, the chat stops immediately and the gym's data is hard-deleted within 30 days. The gym can export a copy first. Cancellation does not delete anything inside Gymdesk, TeamUp, Glofox or any other system the gym uses.
Processors
Hosting is Cloudflare (Workers and D1). Login codes and owner emails, when sending is switched on, go through Resend or Cloudflare Email Sending. Inbound mail for greetrep.com stays on the gym's existing mail host. The model provider is whichever OpenAI-compatible API the operator configures. The default beta mode does not call a model. Webhooks go only to a URL the gym configures. Login codes are stored only as a salted hash and expire after 10 minutes.