Privacy policy

Who is responsible

Your gym is the controller of the data about you as a member: your membership, bookings, check ins, training, payments and what is written in the gym's groups. Riggd handles that data on the gym's behalf, as a processor, under an agreement with the gym. The gym's name and its contact for data protection are shown in the app when you join the gym.

Riggd is itself the controller of your account and login, which you can use in several gyms, of support requests you send to Riggd, of the security of the platform and of what you leave on riggd.fit.

Riggd is provided by Alistra AB, Swedish company registration number (organisationsnummer) 559600-4241, Utsädesgränd 14, 175 52 Järfälla, Sweden. In this policy the company is called Riggd or we. You can reach us at info@riggd.se.

Riggd has no data protection officer, as the law does not require one for our business. All questions about data protection go to info@riggd.se.

Where the data comes from

Most of it you provide yourself: when you create the account, book, check in, log training or write in the app.

Some comes from your gym: the gym can add you as a member or lead, move your details over from the gym's previous system (name, contact details and membership) and write notes about you in the member register. The payment status comes from Stripe. If you are under 18, the gym may have received your guardian's name and contact details from you or from the guardian.

We do not collect data about you from publicly available sources.

What data we handle

• Account and profileName, email, phone, date of birth and a profile picture if you add one. The password is never stored in plain text.
• Membership and purchasesWhich gym and which membership you have, your role, cancellations, payments, receipts, PT bookings and items you reserve at the gym. You enter card details at Stripe, and they never reach Riggd.
• Bookings and check insClasses you book, waitlist places, check ins and when you opened the gym's door with the app.
• TrainingResults, records, RPE, competition results, comments and kudos.
• Health dataWeight, muscle mass and body fat percentage, and what you write yourself about injuries and limitations. Optional, see Health data below.
• GuardianName, email and phone of a guardian if you are under 18.
• Messages and support requestsWhat you write in the gym's group chats and, when the gym has turned them on, in direct messages, and support requests you send to the gym or Riggd. A support request includes the name of the screen, the app version, the platform and the app's latest error message, so a fault can be found.
• Notes from the gymWhat the gym staff write about you in the member register.
• Consents and choicesWhat you have said yes or no to, and when.
• LocationRead only when you open the door and compared on your phone. It is never stored, see Location data below.
• Push notificationsWhen you turn on push on your phone, the phone's push address (a push token), the phone's model, the app version and when the app was last used on the phone are stored. Rooms you have muted in the chat are stored too.
• From riggd.fitThe email address you leave in the form to get started, and which language the page was shown in.
• The gym's agreements with RiggdIf you accept the data processing agreement and the terms for gyms on a gym's behalf, your name, your role in the company, the gym's name and registration number and when you accepted are stored.

Riggd has no advertising, no tracking, no analytics of how you use the app and no crash reporting. The app does not read your contacts, your calendar, your photos or any advertising ID.

Push notifications are only sent if you have allowed them on your phone, and you choose in the app which kinds of notices you want. A push carries the notification's title and text, and from the chat the room's name, who wrote and the start of the message. The notices are also in the app's inbox.

The app has no AI feature today, and no data about you is sent to any AI service. If such a feature is added, this policy is updated before it is switched on.

Why, and on what legal basis

• ContractWhat is needed for you to be a member: account, membership, booking, check in, the door, payment, group chat and support requests, and notices about them in the app and as push notifications when you have turned them on. Without that data the service cannot be used.
• ConsentHealth data, location at the door, showing your name and profile picture on the gym's public website (staff), anonymised statistics on attendance, the gym's newsletter to you as a member (only when you have turned on E-postutskick (email newsletters) in the app), and contact after you have left your address on riggd.fit. You can withdraw a consent at any time, in the app under Jag, Integritet (Me, Privacy), the newsletter under Jag, Notiser och e-post (Me, Notifications and email), or by emailing info@riggd.se.
• Legitimate interestKeeping the platform secure and free from abuse, for example the log of door openings, handling of reported messages and comments, the word filter and suspension from writing under the terms of use, and troubleshooting with the app details in a support request. An email when your support request has been answered, which you can turn off in the app.
• Legal obligationPayments and invoices are kept under the Swedish Bookkeeping Act. The acceptance of the gym's agreement with Riggd is kept to show that the data processing agreement exists, as the GDPR requires (Article 28).

The data under Contract is needed for you to use the app and be a member, and without it that is not possible. Everything under Consent is optional: if you say no, the app still works, just without that part.

Riggd makes no decisions about you based solely on automated processing that have legal effects or similarly significantly affect you, and we do not profile you. The word filter stops the worst words in a message before it is published and sends others to the gym for review, but it decides about the message, not about you.

Guardians and age

The app works out your age from your date of birth. If you are under 18, a guardian needs to approve the membership, and it becomes active only once that is done. Memberships with a binding period cannot be taken out by anyone under 18.

The guardian's name, email and phone are stored on the membership and deleted with your account.

The app is intended for people aged 13 and over. Anyone under 18 needs a guardian's approval for their membership, and we ask for the guardian's name and contact details at registration. The gym decides whom it accepts.

In short, if you are young: what you write and train is stored so you can book and follow your training. Your gym sees it. Other members of the gym only see your name, your profile picture if you have added one and what you share yourself, never publicly. Nobody sells your data. You can always see, change and delete it in the app. Ask us at info@riggd.se if anything is unclear, you or your guardian.

Location data

The door key in the app opens the gym's door only when you are at the gym. When you tap to open, the app reads the phone's position once and compares it with the gym's position, on the phone. The position is never sent to Riggd or the gym and is not stored.

The app reads the location only if you have approved Plats vid dörren (Location at the door) in the app and given the app access to location on your phone, and only while the app is open. Location is never read in the background and never used for tracking.

What is stored is that the door was opened, when and by whom, in the gym's door log.

Health data

Body measurements (weight, muscle mass and body fat percentage) and what you write yourself about injuries and limitations are health data, a special category under the GDPR. They are handled only if you have given explicit consent, and the question is asked separately.

You and the gym staff (coaches, head coaches and owners) can see your body measurements. What you write about injuries and limitations is seen by the owner and the head coach, and by a coach only when you are booked on a class that coach leads, from 14 days before the class to 14 days after. Other members cannot see any of it. Only you can write about your injuries and limitations, and a coach can record a measurement for you only if you have consented to body measurements.

Health data is never used for advertising, never sold and never disclosed to anyone outside the gym and Riggd's providers for running the service.

You can withdraw your consent in the app and clear the injury field at any time. When you delete your account, all health data is deleted.

Who receives the data

We never sell your data and we do not use it for advertising.

Your gym sees what it needs to run its business. The owner and the head coach see your membership, your class passes and your payments. A regular coach only sees whether you may train, not your membership, your class passes or your payments.

Only you and the gym staff see your email. If you are a coach or an owner, your name and profile picture are shown on the gym's public website and in the public schedule only if you have turned it on yourself, and you can turn it off at any time.

Other members of the same gym see your name and your profile picture if you have added one, in the chat, the groups, participant lists and leaderboards, and what you share yourself, such as what you write in the group chat. If you turn off Visa mitt namn för andra medlemmar (Show my name to other members, under Me, Privacy), other members only see a number in the participant list, in On the box now and in the Feed. None of it is shown publicly.

Direct messages, when your gym has turned them on, only exist between adults whom the gym's staff have confirmed as adults, and anyone under 18 does not see the gym's chat at all. Only you and the person you write with read a direct message; the gym does not. If someone reports a message, the gym's owner and head coach see a copy of that message only, or Riggd when the gym's owner is a party. Direct messages are not end-to-end encrypted.

Riggd uses these providers. They only receive what their task requires. This list is also the list of sub-processors that the data processing agreement between the gym and Riggd refers to.

• SupabaseDatabase, login and server functions. The data is stored in Supabase's data centre in Stockholm (AWS eu-north-1).
• CloudflareDelivers riggd.fit, the web app and the dashboard. Sees technical details of the requests, such as the IP address.
• StripeTakes payments for memberships, PT and fees into the gym's own Stripe account. Receives your name, your email and an internal reference for the purchase. You enter card details directly at Stripe, which is itself responsible for them under Stripe's own privacy policy.
• Cloudflare (email)Cloudflare, Inc. sends email with Cloudflare Email Service: the gym's mailings, sign-in codes and links to choose a new password, and Riggd's notice that a support request has been answered. Receives the recipient's address and the content of the email. The email about support requests never says what the request is about.
• ExpoBuilds the app, delivers updates to it and receives the push notifications from Riggd to hand them to Apple and Google. When the app fetches an update, Expo sees a technical request, such as the IP address. For a push, Expo receives the phone's push token and the notification's title and text, but nothing else from your account.
• Apple and GoogleDeliver the push notifications to the phone, Apple Push Notification service on iPhone and Firebase Cloud Messaging (Google) on Android. Receive the phone's push token and the notification's title and text.
• The gym's lock systemReceives an order to open a specific door, using the gym's own credentials. No data about you is sent there.

When the gym takes payments through Stripe, the gym has its own agreement with Stripe, and Stripe handles the payment under that agreement.

We disclose data to authorities only when the law requires it.

Transfers outside the EU/EEA

The database with your data is in Stockholm, inside the EU.

Some providers are companies in the United States, so data may be processed there when they deliver their services. This only happens with a safeguard under the GDPR, per provider:

• SupabaseStorage is in Stockholm. Any access from the United States, for example for technical support, happens under Supabase's data processing agreement with the European Commission's standard contractual clauses.
• CloudflareEU-U.S. Data Privacy Framework (certified).
• StripeEU-U.S. Data Privacy Framework (certified), under the gym's own agreement with Stripe.
• ExpoEU-U.S. Data Privacy Framework (certified).
• Google (Firebase Cloud Messaging)EU-U.S. Data Privacy Framework (certified).
• Apple (Apple Push Notification service)The European Commission's standard contractual clauses, under Apple's terms.

A company certified under the EU-U.S. Data Privacy Framework is covered by the European Commission's adequacy decision for the United States. If you want to know more about the safeguards, write to info@riggd.se.

How long data is kept

• The account and what belongs to itAs long as you have the account. An account whose memberships have been ended for 24 months is deleted automatically, with a notice in the app one month before.
• Group chatsMessages are removed by the nightly cleanup once they are 12 months old. Posts pinned by the group's host or the gym's staff stay as long as they are pinned. A message that is deleted is removed by the nightly cleanup 30 days after deletion. A reported message stays until the report is closed.
• Direct messagesRemoved 12 months after they were written. A message you delete is kept so the recipient can report it, and is removed by the nightly cleanup 30 days after deletion, or when it is 12 months old if that comes first. A reported message stays until the report is closed.
• Reported messagesA copy of what was reported is kept while the report is handled and for 6 months after it is closed, even if the author deletes their account.
• Notifications in the appRead notifications after 90 days, unread after 180 days.
• The phone's push tokenUntil you log out on the phone, delete the account or the phone stops receiving notifications, and at most nine months after the app was last used on it.
• Support requestsAs long as the account exists. When the account is deleted, the request stays with the gym or Riggd without your name.
• Payments and invoices7 years under the Swedish Bookkeeping Act. After the account is deleted they are attached to a profile without your name and email.
• LocationNever stored.
• Visits to gym websitesThe counted visits are removed after 13 months.
• Addresses from riggd.fit24 months after our last contact with you, or after you left the address if we were never in touch. A nightly job deletes them. If you want us to delete the address sooner, write to info@riggd.se. If you delete a Riggd account with the same address, it is removed at the same time.
• Acceptances of the gym's agreementsAs long as the gym uses Riggd, as proof that the agreement exists. The name and role stay even if the person who accepted deletes their account, and are removed with the gym's data when the gym leaves Riggd.

How to delete your account, and exactly what is removed immediately and what is kept for a period, is described at riggd.fit/en/radera-konto.

Your rights

• See your data and take it with youDownload a data export with what is stored about you, as a file, in the app under Jag, Integritet (Me, Privacy), Ladda ner mina uppgifter (Download my data).
• CorrectChange your details yourself in the app under Jag, Min profil (Me, My profile), or ask the gym or us to correct what you cannot reach.
• DeleteDelete your account yourself in the app, or email info@riggd.se. How it works is described at riggd.fit/en/radera-konto.
• Withdraw a consentIn the app under Jag, Integritet (Me, Privacy), and for the newsletter under Jag, Notiser och e-post (Me, Notifications and email). It does not affect what has already been done on the basis of the consent.
• Object and restrictYou can object to processing based on legitimate interest, and ask us to restrict processing while a question is investigated. You unsubscribe from the gym's newsletter with the link in every mailing, or turn off E-postutskick in the app.
• ComplainYou can complain to the Swedish Authority for Privacy Protection (IMY), imy.se. Please contact us first, and we will try to resolve it.

If your question concerns data the gym is responsible for, you can contact the gym or us. We reply, or help the gym reply, within one month at the latest.

Cookies

riggd.fit sets no cookies and has no statistics or tracking. The fonts are served from our own server.

The app uses no cookies. Your login is stored in the phone's protected storage. In the web app at app.riggd.fit, the login is stored in the browser's storage.

The dashboard, where gym staff work, only uses the cookies needed for the login and to remember which gym you are working in.

Gym websites delivered by Riggd count visits without cookies. A visit gets a code derived from the IP address and the browser, which changes every day and cannot be followed over time. The IP address is not stored. If you click a link in a mailing from the gym, the gym can see that you clicked.

Security and incidents

Access is controlled in the database, so each user only reaches what they are entitled to and no gym can see another gym's data. All traffic is encrypted over HTTPS.

Alistra AB is responsible for handling personal data breaches. The person responsible for incidents is Ali Storm, with Hans Grobecker and Maria Svensson in the Riggd team. If something happens that affects data the gym is responsible for, we notify the gym without undue delay and within 24 hours at the latest, so the gym can do what the law requires. If it concerns data Riggd itself is responsible for, we report the breach to IMY within 72 hours when the law requires it, and inform you if it is likely to result in a high risk to you. Every breach is documented, including those that do not need to be reported.

Changes and contact

We update this policy when Riggd changes, and the date at the top shows when the text was last changed. We tell you about major changes in the app before they apply.

Send questions about data protection to info@riggd.se, or by post to Alistra AB, Utsädesgränd 14, 175 52 Järfälla, Sweden.

Data processing agreement

The data processing agreement between the gym and Riggd is at riggd.fit/en/bitradesavtal. The gym accepts it when it becomes a Riggd customer.