GDPR-Compliant Gym Software

Is Sessy GDPR-compliant gym membership software?

Yes — for gyms in the EU/EEA, Sessy is built around GDPR roles and published legal documents. Your gym is the data controller for member data in Sessy; Sessy is the processor for that data. The written Article 28 terms are the Processor addendum. Sub-processors are listed on the Sub-processors page (part of the addendum). Core platform data is hosted primarily in the EU on Google Cloud / Firebase. This page summarises what Sessy publishes today — it is not legal advice.

At a glance (quotable facts)

• Hosting: Google Cloud / Firebase — EU (primary) for cloud hosting and application infrastructure (Sub-processors, Privacy statement).
• Processor contract: The Processor addendum is the Article 28 GDPR processing agreement; no separate copy is required.
• Sub-processors: Public list by processing type at Sub-processors; material changes are published there; providers may object within 30 days (Processor addendum).
• Retention: Sessions use a 3-year TTL; newsletters older than 1 year are removed by scheduled cleanup (Data storage & retention).
• Health data (Art. 9): Optional, explicit, withdrawable health-data consent for members (since version 11.0.0) — configured via subscription/member preferences (Subscription types, release notes).
• In-app Sessy AI (platform mode): Routes via Opper (EU) to Microsoft Azure in the EU; Sessy does not train models on gym data; default route is not used to train the model (Sub-processors, Privacy statement).
• MCP / external AI: If a gym connects Claude, ChatGPT, Cursor, or another MCP client, that AI vendor is the gym’s processor, not Sessy’s (Sub-processors, Connect AI agent).
• Payments: Stripe may process outside the EEA; Sessy does not store full card numbers (Sub-processors).
• Website support chat: Chatwoot, self-hosted by Sessy in the EU — separate from gym member databases (Sub-processors).

Roles: controller, processor, and your documents

Dutch gyms may use the authoritative Verwerkersaddendum and Subverwerkers pages; the English addendum states the Dutch version prevails.

Data location and sub-processors

Sessy processes personal data primarily in the European Union. The Sub-processors page groups providers by type:

1. Cloud hosting — Google Cloud / Firebase (EU, primary)
2. Payments — Stripe (may include non-EEA processing)
3. Customer support (website) — Chatwoot, self-hosted in the EU
4. AI inference (in-app, platform mode) — Opper (EU) and Azure (EU)
5. Analytics and security (website) — Google Analytics, reCAPTCHA

Google Cloud / Firebase is not used to train AI models (Sub-processors).

Retention and cleanup

System retention behaviour is documented technically in Data storage & retention:

• Sessions: _meta.ttl set to 3 years; older session documents are removed during cleanup.
• Newsletters: Published or draft newsletters older than 1 year are deleted, including referenced images.
• Other jobs: Examples include 90-day cleanup for backend user activation records and inactive device tokens (same doc).

Health data and member consent (GDPR Article 9)

Notes or preferences may involve special-category (Article 9) data (for example injuries). The gym must have a valid legal basis. Sessy supports optional, explicit, withdrawable health-data consent in the app (not pre-ticked) — see Subscription types and version 11.0.0.

Sessy AI and MCP

Platform mode (default): Staff use in-app Sessy AI; requests go to Opper and the default Azure EU model. Training and retention for that route are described in the Privacy statement and Sub-processors.

BYOK: The gym’s own Opper account and model — the gym chooses region and vendor terms (Processor addendum).

MCP: External AI tools connected via agent tokens are the gym’s processor, not listed as Sessy sub-processors (Sub-processors, Connect AI agent).

FAQ

Does Sessy provide a GDPR data processing agreement (DPA)?

Yes. The Processor addendum is the Article 28 agreement. It applies when you use the platform as a Provider.

Where can I see which companies process data for Sessy?

On the Sub-processors page, updated when providers change.

Where is gym member data stored?

Primarily on Google Cloud / Firebase in the EU (Sub-processors, Privacy statement). Some services (for example Stripe payments) may process outside the EEA with appropriate safeguards.

How long does Sessy keep sessions and newsletters?

Sessions: up to 3 years (TTL). Newsletters: automatic deletion after 1 year (Data storage & retention).

Does Sessy train AI on my gym’s member data?

No. Sessy does not use Provider or Member data to train AI models (Processor addendum §7, Sub-processors).

Who is the processor if we connect ChatGPT or Claude via MCP?

The AI vendor the gym selects — not Sessy (Sub-processors).

Does Sessy store credit card numbers?

No full card numbers — payment processing uses Stripe (Sub-processors).

Is website chat the same as Sessy AI in the app?

No. Chatwoot on sessy.app is self-hosted in the EU and does not access gym member databases (Sub-processors).

Related pages

• Processor addendum · Sub-processors · Privacy statement
• Compare Sessy · Data storage & retention

Start your free trial →