Privacy Policy

Last updated October 27, 2026

This notice explains how SamuraiDesk handles personal data — for the gym owners who buy the platform, and for the members of the gyms that run on it. Those are two different relationships, and the first section explains which one applies to you.

The two roles in this notice

SamuraiDesk handles personal data in two different capacities, and the difference decides who you should talk to.

As a controller — for the gym owners and staff who sign up. We decide what account data we collect and why.

As a processor — for the members of gyms that use SamuraiDesk. That data belongs to the gym; we hold it on their instructions. If you are a gym member and want your data corrected or deleted, ask your gym first — they control it, and they can action it directly in the platform.

What we collect from account holders

Account details — name, email, phone, gym name, address and the login credentials you set. Passwords are stored hashed; we never see them.

Billing details — your plan, invoices and payment history. Card numbers are handled by Stripe and never touch our servers.

Usage data — which screens you use and when, so we can find faults and see what needs improving.

Technical data — IP address, browser and device, captured in access and security logs.

What you send us — support emails and anything you attach to them.

What gyms store about their members

On a gym's instruction the platform can hold: name and contact details, date of birth, address, emergency contacts, membership and payment history, attendance records, belt or rank progression, signed waivers, photographs where the gym uses them, and any medical notes the gym chooses to record.

We do not decide what a gym collects. We provide the fields; the gym decides which to use and why. Medical information and children's data are sensitive — a gym collecting them needs its own lawful basis and, for a minor, appropriate parental consent.

Why we use it

To provide the platform and keep your account working. To take payment and send invoices. To send service messages you need — a receipt, a failed payment, a security alert. To provide support when you ask. To detect and prevent abuse and fraud. To meet legal and tax obligations. And, where you have not opted out, to send occasional product news; every marketing email has an unsubscribe link and service messages are not marketing.

Who we share it with

We use a small number of processors to run the service: Stripe for payments, an email delivery provider for outgoing mail, an SMS provider where a gym uses text messaging, and our hosting provider. Each handles data only to perform that job.

We may disclose data where the law requires it, or to protect our rights or someone's safety. If the business is ever sold or merged, data may transfer with it — you will be told.

We do not sell personal data, and we do not share one gym's data with another.

Cookies and tracking

We set the cookies the platform needs to work: a session cookie to keep you signed in and a CSRF token to protect forms. Those cannot be switched off without breaking sign-in.

A gym can add its own analytics — such as a Google Analytics ID — to its public website. Those are that gym's cookies under that gym's privacy policy, not ours, and they load only on that gym's site.

How long we keep it

Account data lasts as long as the account. After cancellation we keep it for 30 days and then delete it, so a reopened account loses nothing.

Invoices and payment records are kept longer where tax law requires. Security and access logs are kept for a limited period for investigation. Backups roll off on their own schedule.

Keeping it safe

Traffic is encrypted in transit. Passwords are hashed, never stored in readable form, and card data never reaches our servers — Stripe holds it. Every gym's records are isolated from every other gym's at the query level, and staff permissions are enforced server-side rather than by hiding buttons. Administrative access and impersonation are logged.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant regulator as the law requires.

Your rights

Depending on where you live you may have the right to access the personal data we hold about you, to correct it, to delete it, to object to or restrict how it is used, to receive it in a portable format, and to withdraw consent you previously gave.

Account holders can exercise these by contacting us. Gym members should contact their gym — the gym controls that data, and can action most of these requests immediately in the platform. If you approach us directly about member data, we will pass the request to the gym.

You also have the right to complain to your local data protection authority.

International transfers

Our providers may process data in countries other than yours. Where data leaves its home jurisdiction we rely on the safeguards those providers offer, such as standard contractual clauses.

Children

The platform is sold to businesses, not to children, and we do not knowingly collect data directly from children for our own purposes.

Gyms frequently teach children, and may record a young member's details with parental consent. That data is the gym's responsibility as controller; we process it on their instruction.

Changes and contact

We will update this notice as the product changes, and will say when it was last revised at the top. Material changes will be notified by email or in the dashboard.

Questions, or a request about your data: contact us.