Praxella Privacy Policy

Effective date: [TO CONFIRM: item 16]

This policy explains how personal information is handled in Praxella:

• the website praxella.com;
• the Praxella web app, including app.praxella.com and gym websites built on Praxella;
• the Praxella Android app (com.praxella.app).

1. Who we are

Praxella is software that gyms, academies and sports clubs use to run their business. It covers members and families, classes, attendance, belts and progress, billing records, a member portal and the gym's public website.

Praxella is provided by AL Jesr LLC, a company registered in the Qatar Financial Centre (QFC). QFC registration number and registered address: [TO CONFIRM: item 1]. In this policy, "we", "us" and "our" mean AL Jesr LLC.

The QFC Data Protection Regulations apply to AL Jesr LLC. Gyms that use Praxella also have their own duties under the laws that apply to them. For example, Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data may apply to gyms in Lebanon, where applicable.

2. Who is responsible for your information

Your gym. When a gym, academy or club ("your gym") uses Praxella, the gym decides what information it records about its members, parents, guardians and staff, and how it uses that information. The gym is the controller of that information.

We act for your gym. We store and process that information only to provide Praxella to the gym, on the gym's instructions and under our agreement with the gym [TO CONFIRM: item 3]. For this information, we are the gym's processor.

We are the controller only for:

• visitors to praxella.com;
• people who request a demo or contact us (leads);
• gym owners' accounts and our business relationship with each gym.

Gym websites. A gym can publish its own website with Praxella, on a praxella.com address or on its own domain. What you send through that website's forms, such as a trial class request, goes to the gym. The gym is responsible for it, and we process it for the gym.

If you are a member, parent or guardian, please contact your gym first about your information.

3. What information is collected

3.1 Gym owners and staff

This covers owners, managers, coaches, receptionists and visiting coaches.

• Account details: name, phone number, email address, role, branch, language and an optional photo.
• Sign-in: your password is stored only in protected (hashed) form by our sign-in provider. The time you last signed in is recorded.
• Coach profile: biography, specialty, belt rank, availability and photo. Your gym may publish these on its website.
• Coach pay records, if your gym uses this feature: pay terms, rates and payouts (amount, date, method and reference).
• Visiting coaches who rent space: name, phone number, email, insurance and waiver status, and bookings.
• Gym business details, from the owner: gym name, branches and addresses, contact phone, email and WhatsApp number, website and social media accounts, logo and colours, the gym's location on a map, tax registration number, and the gym's Praxella plan and subscription status.

3.2 Members, parents and guardians

Your gym enters most of this. You can also enter or update some of it in the member portal.

• Identity and contact: name, phone number, email (optional), date of birth, gender, language and an optional photo.
• Family: which parent or guardian is linked to which child, the relationship, the main contact, and who may pick the child up.
• Emergency contact: name and phone number.
• Health information: medical notes that you or the gym choose to record, such as an allergy or a condition a coach should know about. For camps, the gym may also record dietary needs and the people allowed to collect a child [TO CONFIRM: item 10].
• Training: memberships, classes and class registrations, attendance (date, time and who recorded it), belts and promotions, personal training sessions, trial classes, camps, and competition entries and results. Competition results can include athletes' names, clubs, weights and photos, and the gym may publish them.
• Athlete licence applications, if your gym uses this feature for a sports federation: full name, mother's name, date of birth, gender, nationality, blood group, phone numbers, email, emergency phone, photo, and grade or ranking.
• Billing records: invoices, amounts in US dollars and Lebanese pounds, exchange rates, credits, shop purchases, and the payments staff record: date, amount, method (such as cash, OMT, Whish, BOB Finance or bank transfer) and a reference number.
• Waivers, if your gym uses them: the waiver version, a drawn signature, the typed name of the person signing, the time, and the type of browser used.
• Requests and notes: requests you make in the portal (such as a profile change, a renewal or a freeze), and notes staff write, such as notes from a follow-up call, trial feedback, session notes and belt promotion notes.
• Messages: notifications shown in the app, and a record of WhatsApp messages staff prepared for you (your phone number, the text and the time).

No card data. Praxella does not process card payments. It does not collect or store card numbers. You pay your gym directly, and staff record the payment in Praxella.

3.3 Website visitors, demo requests and leads

• Demo requests on praxella.com: name, business name, type of activity, phone number, email (optional), city and your message.
• Forms on gym websites (trial class, request to join, or "notify me" about a competition): your name and phone number, your interests, an optional note, the branch, and a campaign code if your link had one. These go to the gym.
• We do not use advertising cookies, analytics cookies or tracking pixels.

3.4 Technical and activity information (everyone)

• Connection data: your IP address and basic browser and device information. Our hosting and sign-in providers use it to deliver the service, keep security logs and stop abuse, such as too many sign-in attempts.
• Activity log: important changes, such as changes to member records, memberships, invoices, payments, sales and staff roles, are logged with who made them and when.
• Error and performance reports: when something breaks or a page is slow, the app sends a report with technical details. These include the page address, browser and device type, app version, error details, the gym's short name and the user's role. Before a report is sent, we remove email addresses, phone numbers, passwords, access tokens, cookies and your user identity. Only a small sample of normal page loads is measured. We do not record your screen.
• Push notifications, if you turn them on: a push address for your browser or device, your browser type, and your notification choices.
• Camera: when staff open the QR scanner to record attendance, the camera image is read on the device to find the code. Images are not saved or sent.

We do not collect your device's location, your contacts or audio from your microphone.

4. How we use information

We use information to:

• run Praxella for your gym: memberships, classes, attendance, progress, billing records, receipts, the member portal and the gym's website;
• let you sign in and keep accounts safe, including password resets, invitations and limits on repeated attempts;
• show notifications in the app and, if you allow them, send push notifications. A push notification carries only a general message, such as "A billing update, open to view". You see the details only after you open the app and sign in;
• help staff contact you on WhatsApp. The app prepares the message and the staff member sends it from their own WhatsApp;
• let the front desk keep working without internet, and sync when the connection returns;
• give each gym statistics about its own business, such as revenue and attendance totals;
• support gyms when they ask for help, and find and fix problems;
• keep Praxella secure and prevent misuse;
• reply to demo requests and manage our relationship with gyms;
• meet our legal duties.

We do not sell personal information. We do not use it for advertising.

5. Legal bases

Where the law requires a legal basis, we rely on the bases below. The exact terms depend on the law that applies.

• Information we process for your gym: the gym decides the legal basis. For example, it may rely on its contract with you, its legitimate interests, a legal duty, or your consent (for example for health information, where the law requires consent).
• Gym owner accounts: to perform our contract with the gym, or to take steps the gym asked for before signing up.
• Demo requests: to answer your request. This is in our legitimate interest and yours.
• Security, error monitoring and service logs: our legitimate interest in running a safe service that works.
• Push notifications: your choice. You can turn them off at any time.
• Legal duties: where the law requires us to keep or disclose information.

6. Sharing and sub-processors

Inside your gym. Gym staff see only what their role allows. A parent or guardian sees only their own children's information.

Our service providers (sub-processors). We use these providers to run Praxella. They may use the information only to provide their service to us [TO CONFIRM: item 15].

Other services you may see.

• Maps: a gym's website may show a map from OpenStreetMap. When the map loads, your browser connects to OpenStreetMap, which receives your IP address and browser details. A Google Maps button is a plain link.
• WhatsApp: when gym staff message you on WhatsApp, they send it from the gym's own WhatsApp, under WhatsApp's terms. Praxella does not send WhatsApp messages automatically [TO CONFIRM: item 5].
• Social media: links to Instagram, Facebook, TikTok and YouTube are plain links. Those services receive information only if you click.

Our team. Our team looks at a gym's information only when needed to provide, support or secure Praxella, or when the gym asks. Our "view as gym" support tool is read-only, off by default, and ends automatically after a short time. Every use is recorded in the gym's activity log.

When the law requires it. We may disclose information if the law requires it, or to protect the safety and security of people, gyms or Praxella.

7. International transfers

Praxella's main database is in the European Union, in Frankfurt, Germany [TO CONFIRM: item 4]. Gyms, members and our team may be in Lebanon, Qatar or other countries, so information moves across borders. Some providers, such as Cloudflare and push services, work worldwide. Where the law requires it, we protect these transfers with suitable safeguards, such as contract terms with our providers [TO CONFIRM: item 15].

8. How long information is kept

• Gym records: your gym decides how long to keep its records. They stay in Praxella until the gym archives or deletes them. Archived records are hidden but kept, so the gym's history, such as invoices, stays complete.
• When a gym leaves Praxella: we delete or return the gym's information within [TO CONFIRM: item 13] days, unless the law requires us to keep it longer.
• Athlete licence photos: deleted within 24 hours if the application is rejected. Otherwise deleted 12 months after approval, or 12 months after the form was sent if it was never decided.
• Temporary passwords: stop working after 7 days.
• Push subscriptions: removed when you turn notifications off, or when your browser reports that they no longer work.
• "View as gym" support sessions: end automatically.
• Error reports: kept by Sentry for [TO CONFIRM: item 13] days.
• Demo requests: kept for [TO CONFIRM: item 13] after our last contact with you.
• Server and security logs: kept by our providers for [TO CONFIRM: item 13].
• Public images: after a public photo is changed or removed, copies may stay in internet caches for up to about a week.
• Copies on devices: see section 12.

9. Security

• All connections to Praxella are encrypted (HTTPS).
• Our database provider encrypts stored data [TO CONFIRM: item 14].
• Database rules keep each gym's information separate. Staff see only what their role allows. Parents and guardians see only their own children.
• Passwords are stored only in hashed form. Temporary passwords expire after 7 days. Repeated sign-in attempts are limited.
• Athlete licence photos are kept in private storage. They can be viewed only through links that expire after one hour.
• Profile photos, and photos a gym publishes on its website, are stored at hard-to-guess web addresses so they load quickly. Anyone who has a photo's address can open it. These photos are not listed publicly [TO CONFIRM: item 9].
• Error reports are cleaned of contact details and identity before they leave the app.
• Front-desk devices keep an offline copy of some records (see section 12). Gyms should use Praxella only on devices they control, protected by a screen lock.

No system is completely secure. If a security incident affects personal information, we will inform the affected gym and, where the law requires, the authorities and the people affected.

10. Your rights

Depending on the law that applies to you, you may have the right to:

• see the information held about you and get a copy;
• correct it;
• have it deleted;
• limit or object to some uses;
• receive it in a format you can reuse;
• withdraw consent you gave, such as for push notifications;
• complain to a data protection authority.

How to use your rights:

• Members, parents and guardians: ask your gym. You can also update some details in the member portal; your gym may need to approve the change. If you contact us instead, we will pass your request to your gym and help it respond.
• Website visitors, people who requested a demo, and gym owners: email privacy@praxella.com.

We may need to confirm your identity before we act. We will reply within [TO CONFIRM: item 13] days. If you are not happy with our answer, you can complain to the data protection authority in the QFC, or in the country where you live.

11. Children

Many gym members are children. Their records are created and managed by the gym and by the child's parent or guardian.

• Children do not create accounts. Nobody can sign up alone: accounts are created only by invitation from a gym (or, for gym owners, by us).
• Children do not sign in to the app. A parent or guardian signs in and sees the child's information [TO CONFIRM: item 6].
• The app does not let a child sign a waiver for themselves. A waiver for a child is signed by a parent or guardian, or recorded by gym staff.
• If your gym sends a link to an athlete licence form, a parent or guardian should fill it in for a child [TO CONFIRM: item 7].
• A gym may add a child's photo to the child's record, and may publish photos or competition results on its website. The gym is responsible for getting any permission needed from the parent or guardian.

If you think a child's information was added without permission, contact the gym or email privacy@praxella.com.

12. Cookies and offline storage

We use only the cookies and storage that Praxella needs to work. We do not use advertising or analytics cookies.

Cookies

• Sign-in cookies (names start with "sb-"): keep you signed in securely.
• Language cookie ("NEXT_LOCALE"): remembers your language (Arabic, English or French) for up to one year.
• Branch view cookie ("loc_scope"): staff only. It remembers which branch they are viewing.
• Security cookie: our network provider may set a cookie to tell people from bots [TO CONFIRM: item 14].

Storage on your device

• Offline copy (staff devices): on devices used by gym staff, Praxella keeps a copy of some gym records so the front desk can work without internet. This copy can include members' names, contact details, dates of birth, emergency contacts and medical notes, as well as classes, attendance, invoices, payments and new leads. Changes made offline are sent when the connection returns. The copy stays on the device after sign-out, until it is refreshed or the browser's site data is cleared [TO CONFIRM: item 8].
• App cache: a service worker stores the app's files and recently viewed pages, so Praxella opens quickly and works offline.
• Small settings: the gym's name and your language for the offline page, your display theme, whether you closed the install or notification prompts, and, for staff, the last numbers shown on the "Today" screen (numbers only, no names).

You can delete cookies and site data in your browser settings. If you do, you will be signed out and the offline copy on that device will be removed.

13. The Android app

The Praxella Android app (com.praxella.app) shows the same Praxella web app inside an app, so everything in this policy applies. It also adds the following [TO CONFIRM: item 12].

• Push notifications: if you allow them, the app registers your phone with Google Firebase Cloud Messaging. We store a device token linked to your account so we can send you notifications. Notifications show general text only. You can turn them off in your phone settings at any time.
• Camera: used only when you choose to scan a QR code to record attendance. The code is read on your phone. Praxella receives only what the code contains (a member reference), never photos or video.
• Biometric app lock: you can choose to lock the app with your fingerprint, face or phone PIN. Your phone checks it. Praxella never receives or stores fingerprint or face data.
• The app does not use your location, contacts or microphone.
• Uninstalling the app removes its data from your phone. To delete your account and information, ask your gym or email privacy@praxella.com.

14. Changes to this policy

We may update this policy. We will post the new version on this page with a new date. If a change is significant, we will tell gyms before it takes effect and show a notice in the app [TO CONFIRM: item 16].

15. Contact us

AL Jesr LLC (Praxella), Qatar Financial Centre, Doha, Qatar. Address: [TO CONFIRM: item 1]
Email: privacy@praxella.com [TO CONFIRM: item 2]

Members, parents and guardians: please contact your gym first.