Privacy Policy

In short: we hold your account so the product works, and we hold your clients' details on your behalf. We do not sell anything to anyone, we run no advertising or analytics trackers, and we do not build a profile of you.

Who we are

Lanistably is operated by Računalniško programiranje Zmago Devetak s.p., a sole trader registered in Slovenia (VAT SI18919880). You can reach us at [email protected], and our registered address is available on request and on any invoice we issue.

The two different roles we have

For your own account we decide what happens to the data. For your clients' data, you decide and we only act on your instructions.

This distinction runs through the whole of this policy, so it is worth being clear about up front.

Your account — we are the controller

The details you give us when you sign up and use Lanistably as a coach. We decide what we collect and why, and this policy explains it.

Your clients' records — you are the controller, we are the processor

Everything you enter about the people you coach. You decide what to record, why, and for how long. We store and process it on your instructions and for no purpose of our own. The terms on which we do that are in our Terms of Service.

If you are a client of a coach who uses Lanistably and you want your records changed or deleted, ask your coach. They control that data. We will help them act on your request, but we cannot act on it ourselves without their instruction.

What we collect about you, as a coach

• Your identity and sign-in: name, email address, a hashed password, and — if you turn it on — a two-factor authentication secret and backup codes.
• Your preferences: time zone, language, light or dark theme, and when you last accepted these policies.
• Your studio: its name, time zone, units, cancellation window and reminder settings.
• Billing, if you subscribe: a billing email, your plan and payment status. Card details go straight to our payment provider and never reach our servers.
• Support correspondence: whatever you write to us, kept so we can answer you.

We do not store your IP address or browser user-agent in our database. They appear in short-lived server logs, as they do for any website.

What you store about your clients

You choose what to record. The application makes room for names, email addresses, phone numbers, dates of birth, height, body measurements you define, coaching notes, attendance history, session packages, payments you record, and a photo.

Some of that may be health data. Body measurements, and notes about injuries or conditions, are treated as a special category under Article 9 of the GDPR and need a stronger lawful basis than ordinary details — usually the client's explicit consent. Getting that is your responsibility as the controller, and our Terms say so.

Why we use it, and on what basis

To provide the service — performance of a contract

Running your account, showing your schedule, sending your clients their booking confirmations and reminders.

To take payment for Lanistably — performance of a contract

Only for the subscription you pay us. Money you take from your own clients does not pass through us.

To keep the service secure and working — legitimate interests

Preventing abuse, diagnosing faults, keeping backups.

To meet our obligations — legal obligation

Keeping invoices and accounting records for as long as Slovenian tax law requires.

We do not use your data, or your clients' data, to train models, to build advertising profiles, or for any purpose you have not asked for.

Who else touches the data

Only the companies that run the infrastructure underneath us. Each is bound by a contract to process data only on our instructions.

Heroku (Salesforce, on Amazon Web Services)

Hosting and the database. Everything in Lanistably lives here.

Twilio SendGrid

Sending email — confirmations, reminders, magic links, password resets. They see the recipient's address and the content of the message.

Stripe and PayPal

Taking payment for your Lanistably subscription. They handle card details directly; we never see or store them.

That is the complete list. There is no analytics service, no advertising network, no session recorder and no third-party tracker anywhere in Lanistably. We will update this list before adding to it.

Where the data lives

Our servers and database are in the European Union. Some of our providers are US companies who may access data from outside the EU for support; where that happens it is covered by the European Commission's standard contractual clauses.

How long we keep it

• While your account is open: we keep your data so the product works.
• When you delete your account: your account and everything in it, including every client record you created, is deleted from our live systems.
• Backups: deleted data can persist in encrypted backups for up to 30 days before those rotate out.
• Invoices: kept for as long as Slovenian tax law requires, currently ten years. We cannot delete these on request.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Write to [email protected] and we will answer within one month.

We will never charge you for exercising a right, and we will never make the service worse for you because you did.

If you think we have handled your data badly, you are entitled to complain to the Slovenian Information Commissioner (ip-rs.si), or to the supervisory authority where you live.

Cookies

Lanistably sets two kinds of cookie, both strictly necessary: one that keeps you signed in for the length of your visit, and one that remembers you between visits if you ask it to. A client following a booking link gets a similar cookie so they stay signed in to that page.

We set no analytics, advertising or tracking cookies. That is why you have not been shown a consent banner — under the ePrivacy rules, cookies that are strictly necessary to deliver a service you asked for do not need consent.

Children

Lanistably is for coaches, and you must be 18 or over to hold an account. A coach may record a client who is a minor; where that happens, obtaining a parent's or guardian's consent is the coach's responsibility.

Security

Traffic is encrypted in transit. Passwords are stored hashed, never in a form we could read. Each studio's data is separated at the database level so one account cannot reach another's, and a public booking link is addressed by an unguessable token rather than by an account number that could be guessed by counting.

No system is perfect. If we discover a breach that puts you at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.

Changes

When we change this policy in a way that matters, we will update the date at the top of this page and ask you to accept the new version the next time you sign in.

Getting in touch

[email protected] reaches a person. We are a small business, not a support queue, and we would rather hear from you than have you wonder.