Privacy Policy

1. Who we are

Amble is run by [Company Name] Ltd, a company registered in England and Wales with company number [Company number], whose registered office is [Registered office address]. We are registered with the Information Commissioner’s Office under number [ICO registration number].

Write to privacy@ambleclub.com about anything in this policy, and to hello@ambleclub.com about anything else.

2. Our two roles

Amble is software that gyms and Pilates, HYROX, circuit and fitness studios use to run their timetables, bookings, payments, members and staff, and to give their members a booking app in the studio’s own name. So we handle personal data in two different ways, and which one applies to you decides who you should talk to first.

We are the controller for the accounts of studio owners and staff, for people who visit this website, for people who apply to our pilot or write to us, and for our own marketing. We decide why and how that data is used.

We are a processor for the personal data of each studio’s members. The studio decides what to record about its members and why, and we handle that data for the studio and on its instructions, under our Data Processing Agreement. We do not use members’ data for our own purposes, we never sell it and we never use it for advertising.

If you are a member of a studio, please contact your studio first. They hold the controls and can usually act straight away. If you would rather come to us, or your studio does not reply, write to privacy@ambleclub.com and we will help, working with your studio.

3. What we collect

• Studio owners and staff: your name, email address, role, which branches you work at, and a password that is only ever stored as a secure hash. If you set up a studio, its name, locations, timetable, prices and settings, and its billing with us: the plan, Stripe’s reference for your account and your billing dates.
• Members’ details, as recorded by the studio or by the member: name, email address, and phone number and date of birth where the studio records them, home branch, membership plan and its status.
• Bookings and attendance: bookings, waiting list places, cancellations, attendance, check ins at the door (the date, time and branch), credits bought and used, and any fee for a late cancellation or a missed class.
• Payment information. Card payments are taken by Stripe on its own pages. We never see or store full card numbers. We keep the record of each payment (what was bought, when, how much and whether it succeeded) and Stripe’s references. Where a member saves a card so a studio can charge its fees, we keep Stripe’s reference for that card and the wording the member agreed to.
• Health information, only where a studio uses it: a health questionnaire a member fills in and signs, and notes staff make about an injury or condition. Amble refuses to save a health note unless the member’s consent is recorded, and that rule is enforced by the database rather than by the screen.
• Connected watches, only if a member links one: the workouts it sends us. See section 9.
• Device and push tokens. If you allow notifications, your browser gives us an address and keys for your device so we can send booking reminders to it. They are removed when you turn notifications off, or when your browser tells us they no longer work.
• Messages we send: a record of each email and notification (its type, when it went and whether it was delivered), so a studio can answer “I never got my confirmation”. Each win-back message is kept with the facts it was written from.
• Instagram replies, only where a studio connects its Instagram account: when someone comments a chosen word on the studio’s post, we send one private reply from the studio’s account. We keep the comment’s reference, the word and Instagram’s reference for the person, so the same comment is never answered twice.
• Pilot applications and enquiries: your answers, your name, your studio and the email address or mobile number you give us.
• Technical data. Our hosting provider keeps standard server logs (such as IP address, browser type and the page asked for) to run and protect the service.
• Visits to this website. We count visits to ambleclub.com with Vercel Web Analytics, from Vercel, which already hosts this website. For each page viewed it records the page, the site you came from, the country, region and city your connection comes from, and your type of device, operating system and browser. It sets no cookies and saves nothing in your browser. Vercel says it recognises a returning visitor only by a code worked out from the request, which it discards after 24 hours, and does not tie a visit to a person or an IP address. We see totals, never who visited. The Amble app, where studios and members sign in, is not counted this way.
• Cookies and similar storage: only what keeps you signed in and remembers choices you make. Our Cookie Policy lists every one.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 12).

5. Win-back messages

A studio can switch on win-back, which writes a short message to a member who has gone quiet, inviting them back to a class. It is off unless the studio turns it on.

A win-back message only ever goes to a member who has given marketing consent: a separate box, never ticked in advance, asked in the app when joining, on the member’s profile, or recorded by the studio at the desk, and never by email. Members without that consent are not even looked at.

Win-back messages go by email. Every one has a one-click unsubscribe link that works without signing in and takes effect straight away, and a member hears this way at most once a month, between 9am and 7pm UK time. Amble sends no text messages today; if a studio can send texts in future, only members who agreed to texts will get them, and replying STOP to any of them will stop them.

Where AI drafting is switched on, Anthropic’s AI helps write the message from the member’s class pattern: which classes, which day and time, and when they last came. It is never given the member’s name, email address, phone number or anything else that identifies them on its own. The studio sees every message, and the facts it was written from, before or after it is sent.

6. Who helps us (sub-processors)

Only the companies that run parts of the service, listed here in full. We share personal data with nobody else, and there is no advertising network or data broker anywhere in Amble. The only analytics is Vercel’s count of visits to this website, described in section 3.

Connected watch companies (Whoop, Oura, Polar and Fitbit) are not our sub-processors: a member authorises them directly, under their own privacy policies, and we only receive data from them. A studio’s page can show a map of its branches, with tiles from OpenStreetMap and CARTO, but only after you press the button to show it.

We will update this list before a new provider starts handling personal data, and give studios notice as our Data Processing Agreement describes. We may also disclose data where the law requires it, and will tell the studio concerned unless we are not allowed to.

7. International transfers

Our main stores, Supabase and Vercel, keep and process data in Ireland, which the UK recognises as giving an adequate level of protection.

Some providers handle data in the United States: Resend for email, Stripe for some payment processing, the push services, Vercel for counting visits to this website, and Anthropic where a studio uses AI drafting. Where personal data goes to a country without UK adequacy, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

Resend’s agreement with us includes the UK Addendum, and Resend is certified under the UK Extension to the EU-US Data Privacy Framework. For Anthropic: [Transfer safeguard for Anthropic, to be confirmed from its data processing terms].

If a member links a watch, that company is wherever it operates: Whoop, Oura and Fitbit are in the United States and Polar is in Finland. We only ever receive data from them.

Ask privacy@ambleclub.com for a copy of the safeguards that apply.

8. How long we keep it

Some of this is our decision and some is the studio’s, because studios have their own legal duties to keep business records. Our defaults are:

• Health notes: cleared 12 months after the member’s last visit, or straight away if they withdraw consent or ask.
• Health questionnaires: kept while the member’s record is live, and deleted when it is anonymised or erased.
• Members’ contact details: 24 months after their last activity. After that the record is anonymised.
• Workouts from a watch: deleted the moment it is disconnected, and in any case when the record is anonymised.
• Email and notification records: 12 months.
• Bookings, attendance, door visits, payments and the credit ledger: 6 years, because they are the studio’s financial and safety records. They no longer identify anyone once the record is anonymised.
• Studio and staff accounts: while the studio uses Amble. When a studio leaves, it has 90 days to export its data, and then we delete it, apart from what the law makes us keep, such as invoices.
• Pilot applications and enquiries: until we no longer need them to talk to you about Amble. Ask and we will delete them sooner.

When a member’s record reaches the end of its life we anonymise it rather than delete it: the name, email address, phone number, date of birth and notes go, and what is left is a history of attendance and payments that no longer identifies anybody. The studio’s books still add up, and the person is no longer in them. This runs automatically every night.

9. Connected watches

A member can link a Whoop, Oura, Polar or Fitbit so the training they do outside the studio appears alongside their classes. It is optional and nothing about a membership depends on it.

The studio cannot see any of it: not the workouts, not the heart rate, not even whether a watch is connected. That is enforced by the database, not by the screen.

We ask the provider for workouts only (when, for how long, what kind, calories, and average and maximum heart rate where the device records them) and enough of the profile to know which account it is. We never ask for sleep, recovery, readiness or continuous heart rate.

The basis is the member’s explicit consent, given in Amble and again on the provider’s own screen. Disconnecting from the profile withdraws it and deletes the workouts we pulled, not just the link. The key that lets us fetch new workouts each night can only be read by the part of Amble that does that fetch.

10. Checking in at the door

Staff scan your card. You show a printed card or your phone at the desk, and we record that you arrived: the time and the branch. If you had a class booked around then, you are marked present for it. Your card identifies you to your own studio only. It is not a password and opens nothing else.

A screen at the door. A studio can instead put up a screen so people mark themselves in. It shows the first and last names of everyone booked into that one class, only from fifteen minutes before it to fifteen minutes after, and it is unlocked by a code that changes every thirty seconds. If you would rather not appear on it, ask your studio to check you in at the desk.

11. How we protect it

• Every table in the database enforces its own access rules, so one studio cannot read another’s data even if the app asks it to, and a member can only read their own record.
• All traffic is encrypted in transit, and our database provider encrypts the data it stores.
• Passwords are hashed by our sign-in provider and are never visible to us or to studios.
• Studio staff see only what their role allows.
• Keys that can read across studios are kept on our servers only, never in the app, and automated tests check the access rules whenever the code changes.

No system is perfectly secure. If a breach puts your rights at risk, we will tell the studio concerned and, where the law requires it, the ICO and you.

12. Your rights

Under UK data protection law you can ask:

• For a copy of your data (access). A studio can produce a complete export from your member page: your record, memberships, bookings, door visits, credits, payments, messages, consents and any win-back messages with the facts they were written from.
• For a correction (rectification), if something is wrong or incomplete.
• For it to be erased (erasure). Your identifying details go and your login is deleted. Your bookings and payment history stay in anonymised form, because the studio must keep them.
• For us to restrict what is done with it while a question is settled (restriction).
• For it in a portable form you can take elsewhere (portability).
• To object to what we do on the basis of legitimate interests, and to any marketing at any time (objection).
• To withdraw consent at any time, for marketing, health notes or a connected watch, without affecting what was done before.

Amble makes no decisions about you by automated means alone that have legal or similarly significant effects.

Members: ask your studio first, as they hold the controls. Anyone can write to privacy@ambleclub.com. We will reply within one month, and it is free.

13. Children

Amble is not directed at children under 13, and we do not knowingly collect their data for our own purposes.

Studios may have members under 18. Where they do, the studio is responsible for getting consent from a parent or guardian where it is needed, and for telling them how the data is used.

14. Complaints

If you are unhappy with how we or a studio have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Our registration number is [ICO registration number]. We would be grateful for the chance to put it right first, at privacy@ambleclub.com.

15. Changes to this policy

If we change how we use personal data we will update this page and the date at the top. Where a change matters to members, we will tell the studios that use Amble so they can pass it on.