Skip to main content

Legal

Privacy Policy

Last updated: 11 June 2026

Grostack Ltd ("Grostack", "we", "our", "us") is committed to protecting your privacy and handling your personal data transparently, lawfully, and securely.

This Policy applies to the Grostack website, platform, mobile apps, and related services. It is intended to align with UK GDPR and, where applicable, EU GDPR.

Please read this alongside our Terms of Service and Cookie Policy.

1. Who We Are

Grostack is a software platform for fitness professionals and their clients. For privacy questions, contact info@grostack.com.

If you are a client of a coach using Grostack, your coach is generally the controller for coaching data entered in your coach-client relationship, and Grostack acts as processor for that data.

2. Data We Collect

  • Account and profile data (name, email, account role)
  • Coaching data (programmes, logs, metrics, nutrition, progress photos, notes)
  • Booking and scheduling data
  • Communications and content (messages, support submissions, attachments)
  • Billing metadata from payment providers (not full card numbers/CVC)
  • Platform usage and activity logs
  • Technical and device data, diagnostics, and security logs
  • Mobile app and notification data (push tokens, delivery metadata)
  • Cookie and similar technology data

3. Why We Use Data

  • Provide and secure the Grostack service
  • Authenticate users and manage access
  • Deliver features such as messaging, bookings, coaching, and billing
  • Enable mobile features such as push notifications and photo capture/upload
  • Respond to enquiries and support requests
  • Prevent abuse and maintain platform reliability
  • Meet legal and regulatory obligations

4. Legal Bases (UK GDPR)

We process data under one or more lawful bases: performance of contract, legitimate interests, legal obligation, and consent where required.

5. Payments

Payments are processed by Stripe. We do not store full card details on Grostack systems.

6. Service Providers

We use trusted processors such as Cloudflare, Supabase, Stripe, Google, and Resend to operate the service.

We do not sell personal data. Processors act only on our documented instructions under contractual confidentiality and data protection obligations.

Where Grostack accesses data through Google APIs, Grostack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Google API Data Use (OAuth Integrations)

When you connect Google integrations, Grostack accesses Google user data only to provide requested features.

  • https://www.googleapis.com/auth/calendar.events to create, update, and delete calendar events for bookings created or managed in Grostack.
  • https://www.googleapis.com/auth/documents to create and update Google Docs requested by the user.
  • https://www.googleapis.com/auth/spreadsheets to create and update Google Sheets requested by the user.
  • https://www.googleapis.com/auth/drive.file to access files created or opened by Grostack for document workflows.
  • https://www.googleapis.com/auth/drive.metadata.readonly to read file metadata (for example file ID, name, type, and modified time) required to link and manage files.
  • https://www.googleapis.com/auth/userinfo.email to identify the connected Google account.

Google user data is used only after explicit consent, only for user-initiated features, and is not used for advertising or sold to third parties. OAuth tokens are encrypted at rest and users can disconnect Google integrations at any time from account settings.

8. Retention

We retain personal data only as long as needed for service delivery, security, legal compliance, and legitimate operational purposes.

9. International Transfers

Where data is transferred outside the UK, we apply appropriate safeguards such as contractual protections.

10. Security

We use access controls, encryption where appropriate, and monitoring to protect personal data.

11. Your Rights

You may have rights to access, correct, delete, restrict, object, and request portability of your data. To exercise these rights, email info@grostack.com.

You can also request account and personal data deletion by contacting info@grostack.com. Where Grostack acts as processor for coach-controlled coaching data, we coordinate deletion and rights requests with that coach.

12. Mobile App Permissions

  • Camera (for taking progress photos)
  • Photos/Media library (for selecting and uploading images)
  • Notifications (for reminders, updates, and service alerts)

These permissions are optional for most features and can be managed in your device settings.

13. Contact

If you have concerns about how we handle data, contact us at info@grostack.com. UK users can also complain to the Information Commissioner's Office (ICO).