Last updated: September 7, 2026
This policy explains what personal data Veybase receives through veybase.club, crm.veybase.club, and related APIs, why we use it, who we may share it with, and the rights available to you.
1. Who is responsible for your data
The operator of the Veybase services is Veybase (referred to as “Veybase”, “we”, or “us”). For privacy questions, contact privacy@veybase.club.
This policy applies to the public website, Veybase CRM, the API, and the features we provide directly. It does not replace a club’s own privacy notice for its members.
- Clubs may be separate controllers for their members’ data and decide what they put into Veybase and why.
- If a club invites you to Veybase or creates your profile, contact that club first about its purposes, legal bases, and retention periods.
2. What data we receive
We receive only the data needed for the relevant feature. Some data comes from you when you register, sign in, or use CRM, and some comes from a club using Veybase.
- Account data: name, email address, password hash, account status, and user identifier.
- Session and security data: refresh-token hash, session expiry, request identifier, and technical information needed to protect and diagnose the service. We do not store passwords or tokens in plain text.
- Club data: club role and membership, client or trainer profile, phone number, birth date, emergency contact, notes, memberships, schedules, bookings, attendance, and programs when you or your club provides them.
- Order and payment data: order contents, amount, currency, status, payment-provider identifiers, and payment results. Veybase does not receive or store a full payment-card number unless a separately described payment flow requires it.
- Browser preferences: selected language, visual theme, and your choice about optional analytics.
- Technical usage data: route, method, status, duration, response size, error information, and technical logs. We do not send names, email addresses, account or club identifiers, free text, health data, or payment data to analytics.
3. How we use data
We use data to create and maintain accounts, authenticate users, show the clubs and workflows they are authorised to access, fulfil requests, process payments, send in-app notifications, prevent abuse, and maintain the security and reliability of the service.
Optional analytics helps us understand aggregated use of the website and CRM. It starts only after your explicit choice; advertising personalisation and remarketing are not used in the current configuration.
We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.
4. Legal bases
Depending on the operation, we rely on performance of a contract or steps before entering into a contract; our legitimate interests in security, abuse prevention, support, and service improvement; compliance with legal obligations, including accounting and payment records; or consent for optional analytics and related cookies.
If data is needed to create an account, authenticate you, or provide a club feature, that feature may not work without it. Refusing analytics does not limit access to Veybase’s core functions.
5. Main processing activities
This is a concise processing map. Retention can differ where required by law, contract, security needs, or a dispute.
| Data | Purpose | Basis | Retention |
|---|---|---|---|
| Account and session | Registration, sign-in, profile updates, session maintenance, and sign-out. | Contract; legitimate interest in security. | While the account is active; sessions until they end, are revoked, or expire. |
| Club and member data | Managing clubs, memberships, training, bookings, attendance, and programs. | Contract or club instructions; legitimate interests; another basis determined by the club. | Under the club’s rules or until deletion/deactivation, subject to legal duties and disputes. |
| Orders and payments | Creating orders, confirming payments, handling refunds, and preventing duplicate processing. | Contract; legal obligation. | As needed for the contract, accounting, audit, and dispute handling. |
| Technical security and reliability | Protecting the API, diagnosing errors, monitoring availability, and investigating incidents. | Legitimate interest in security and reliable service. | Limited by operational and security needs; then logs are deleted or aggregated. |
| Optional analytics | Measuring landing-to-CRM navigation and successful sign-ins/registrations without direct identification. | Consent. | Browser consent choice: 180 days; Google retention depends on the actual analytics configuration. |
6. Cookies and similar technologies
We distinguish necessary technologies, which support core functions, from optional analytics. Optional cookies and the Google Tag Manager tag are not loaded before you consent.
| Technology | Purpose | Choice | Retention |
|---|---|---|---|
| Necessary browser storage | Theme, language, CRM session, and other core settings. | Always active because it supports features you request. | On your device until cleared; tokens are also limited by the session lifetime. |
| Consent record | Remember whether you allowed analytics and avoid asking again during the active period. | Necessary to honour your choice. | 180 days or until the record is changed or cleared. |
| Google Analytics cookies | Aggregated analytics after consent; the exact set depends on the active GTM configuration. | Optional; refuse or change your choice through “Cookie settings”. | Depends on the specific Google tag and its settings. |
7. Your rights
Depending on your jurisdiction and circumstances, you may have the following rights over your personal data:
- obtain confirmation of processing and a copy of your data;
- correct inaccurate data or complete incomplete data;
- ask us to erase data where there is no lawful reason to keep it;
- ask us to restrict processing or object to processing based on legitimate interests;
- receive your data in a portable format where the law provides this right;
- withdraw analytics consent at any time through cookie settings.
To exercise a right, email privacy@veybase.club. We may ask you to verify your identity so that we do not disclose data to someone else. You may also complain to the competent data-protection authority in the country where you live, work, or where an alleged infringement occurred.
8. Recipients, international transfers, and security
To operate the service, we may use providers for hosting, databases, monitoring, messaging, and payments. They receive only the data needed for the relevant service and operate under contractual and organisational restrictions. After consent, analytics events may be sent to Google through the configured GTM container.
Veybase infrastructure runs on Google Cloud. If data is transferred outside your country or the EEA, we use the legal transfer mechanisms and safeguards required by applicable law. We can provide more information about a specific recipient and safeguard on request.
We use encryption in transit, password and token hashing, access controls, and separation of data between clubs. No transmission or storage method can guarantee absolute security, so do not share your password with anyone.
9. Contact
For privacy questions and data requests: privacy@veybase.club.
We may update this policy when our processing or legal requirements change. The new version takes effect on the date shown above, and we will communicate material changes through an appropriate channel.