PRIVACY POLICY

1. Who we are

HuscleOS is gym software built for independent gym operators. This Privacy Policy describes how we collect, use, and protect personal information when you use huscleos.com or sign up for a HuscleOS subscription.

2. What we collect

• Account info: name, email, phone, gym name, billing address, payment metadata (processed by Stripe).
• Customer data you upload: lead records, member data, campaigns, and content you create inside HuscleOS.
• Usage data: pages visited, actions taken in the product, device + IP for security and analytics.
• Cookies: authentication tokens, analytics (Google Analytics, PostHog), conversion tracking.

3. How we use it

• To deliver the HuscleOS service you subscribed to.
• To send you transactional emails and SMS (account notifications, onboarding, drip campaigns you initiate).
• To improve our product through aggregated, anonymized analytics.
• To detect fraud, abuse, and policy violations.

We do not sell your data to third parties, and we do not use your customer data (your leads, members, campaigns) to train AI models or cross-sell.

4. Third-party processors

We use the following vendors to operate HuscleOS. Each has its own privacy policy and data handling standards:

• Stripe — payment processing
• Resend — transactional email delivery
• Twilio — SMS delivery
• MailerSend — SMS fallback
• MongoDB Atlas — hosted database
• Google Analytics & PostHog — product analytics

5. Your rights

You can, at any time:

• Request a copy of your data (GDPR/CCPA: right to access).
• Correct information we hold about you.
• Delete your account and data (subject to a 60-day retention window).
• Opt out of marketing emails via the unsubscribe link on every message.
• Residents of California (CCPA/CPRA) and the EU/UK (GDPR) have additional rights — contact us to exercise them.

6. Data retention

We keep account data while your subscription is active and for 60 days after cancellation (to allow reactivation and data export). Billing records are retained for 7 years to meet tax and accounting requirements.

7. Security

HuscleOS uses TLS for all traffic, bcrypt-hashed passwords, JWT-based authentication, and role-based access control. We follow industry best practices — but no system is 100% secure. If we detect a breach affecting your data, we will notify you within 72 hours.

8. SMS & email compliance

When you send SMS or email campaigns from HuscleOS, you are the sender of record. You must obtain consent from your recipients and honor unsubscribe/STOP requests. HuscleOS automatically honors opt-outs at the platform level.

9. Children

HuscleOS is not intended for users under 16. We do not knowingly collect data from children.

10. Updates to this policy

We may update this Privacy Policy. Material changes will be emailed to account owners with at least 14 days' notice.

11. Contact

Questions? Email hustle@huscleos.com.