Privacy Policy

This privacy policy describes the processing of personal data carried out by the operator of the Plenimo platform (the "Platform" or "Service").

The controller is: [PLENIMO OPERATOR NÉV / NAME], [székhely / registered seat], [adószám / tax no.], email: privacy@flownerve.com.

You may contact us with any privacy question or request at any time at privacy@flownerve.com. We are not required by law to appoint a Data Protection Officer (DPO); nevertheless, all enquiries are received and handled at the address above.

Plenimo is a multi-tenant system: individual Pilates studios subscribe to the Platform, each receives its own public website (storefront), and studios manage their clients, classes and passes through the Platform.

This policy covers only the processing for which Plenimo is the controller: studio owner and instructor account data, subscription (billing) data relating to the studios, and data arising from visits to the Platform website.

IMPORTANT: The booking, pass and attendance data of a studio's own clients is controlled by that studio as an independent controller, for its own purposes. In respect of such data, Plenimo acts solely as a processor, following the studio's documented written instructions. The processing of that data is governed by the relevant studio's own privacy notice — please look for it at the studio where you booked or registered. The detailed terms of the processor relationship between Plenimo and studios are set out in the Data Processing Addendum (DPA) to our Terms of Service.

Account management and providing the Service. Data processed: name, email address, password (stored only as a hash), role (administrator / instructor), the account's studio association, sign-in and usage metadata. Purpose: creating and maintaining the user account and providing the Platform's functionality. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Subscription and billing. Data processed: the studio's billing name, address, tax number, subscription plan (Starter / Pro / Growth), payment metadata returned by Stripe (e.g. transaction identifier, the last four digits of the card — we never store or see full card details), and issued invoice data. Purpose: collecting the subscription fee and complying with statutory accounting obligations. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); and, for retention of billing records, compliance with a legal obligation (GDPR Art. 6(1)(c)) under Section 169 of Act C of 2000 on Accounting.

Customer support. Data processed: the content of your enquiry, the relevant account identifier, contact details, and the correspondence. Purpose: answering and resolving questions and bug reports and maintaining the quality of the Service. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — our legitimate interest is the effective support of our users; we have balanced this interest against your interests and the processing does not disproportionately affect your fundamental rights.

Transactional email. Data processed: email address, user name, and data relevant to the notification (e.g. a password-reset link, an invitation, a system message). Our email delivery provider is Resend Inc. Purpose: delivering non-marketing system messages that are essential to the operation of the Service. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Marketing (newsletter, promotions). Where you have expressly consented, we may send you marketing messages. Legal basis: your consent (GDPR Art. 6(1)(a)) and Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Business Advertising Activity. Marketing consent is off by default (opt-in) and may be withdrawn at any time, without giving reasons and free of charge, in your account settings or at privacy@flownerve.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The Platform uses only strictly necessary cookies and local storage. These are:

Supabase session cookies on the .plenimo.com domain: they maintain your signed-in state and handle authentication; without them the Platform cannot operate securely.

Platform-support ("impersonation") session cookies: short-lived cookies that enable secure session handling during platform-administrator support (e.g. troubleshooting performed on behalf of a studio).

localStorage user-interface cache: temporary storage of interface preferences and certain already-loaded data to make the experience faster and smoother.

Under the ePrivacy rules these cookies fall within the strictly-necessary category, so their use does not require your consent and, consequently, the Platform does not display a cookie-consent banner. We do not use any analytics, statistics, social-media or marketing cookies or tracking code.

We treat your data confidentially and do not sell it to third parties for commercial purposes. To provide the Service we engage processors (sub-processors) acting on our behalf — for example for hosting, database, email delivery and payment processing. The current, up-to-date list of processors we use is published at /subprocessors.

Some of our processors carry out processing outside the European Economic Area (EEA), typically in the United States. In those cases transfers take place subject to appropriate safeguards: certification under the EU–US Data Privacy Framework (DPF) or, where applicable, the Standard Contractual Clauses (SCC) adopted by the European Commission. The specific safeguard for each processor is indicated at /subprocessors.

Account data: for the lifetime of the account, or for up to 30 days from your request to delete the account, except where a law requires longer retention.

Billing and accounting data: for 8 years from issuance, under Section 169 of Act C of 2000 on Accounting. Because this processing rests on a legal obligation, such data is exempt — until the retention period expires — from the right to erasure under GDPR Art. 17(3)(b).

Customer-support correspondence: for a reasonable period after the enquiry is closed, typically no more than 24 months.

Record of marketing consent: until the consent is withdrawn, and for a reasonable period thereafter to evidence the withdrawal.

Under applicable data-protection law you may exercise the following rights in respect of your personal data: the right of access; the right to rectification; the right to erasure ("right to be forgotten"); the right to restriction of processing; the right to data portability; and the right to object. Where processing is based on consent, you may withdraw your consent at any time.

You may exercise your rights directly through the self-service features available in your account (e.g. data export, account deletion) or by a request sent to privacy@flownerve.com. We will comply without undue delay and in any event within 30 days of receipt; this period may be extended as permitted by law given the complexity of the request, in which case we will inform you.

Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive, in particular because of its repetitive character.

If you consider that the processing of your personal data infringes the law, you may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa u. 9-11., email: ugyfelszolgalat@naih.hu, website: naih.hu.

You also have the right to an effective judicial remedy. Court proceedings fall within the competence of the tribunal (törvényszék) and may, at your choice, be brought before the tribunal of your place of residence or stay.

To use the Platform and create an account you must be at least 16 years old (in accordance with GDPR Art. 8 and its Hungarian implementation). If we become aware that we hold consent-based data of a person under 16 without appropriate parental authorisation, we will delete the data concerned without undue delay.

We reserve the right to amend this policy. The version in force at any time is available on the Platform, bearing the "Last updated" date shown above. In the event of a material change we will inform users in an appropriate manner and in advance.