Privacy policy

About this policy

This policy explains how Aunova Technologies Ltd ("Aunova", "we", "us") handles personal data collected through GymGuide, a comparison of boutique gym membership prices in Dubai. We are the controller of that data. Our privacy contact is our Data Protection Lead at privacy@aunova.ae.

GymGuide uses no ad networks, no advertising or cross-site tracking, and no tracking cookies. Featured gyms are paid placements (occasionally free ones), marked "Featured"; our terms explain where they appear. It counts page views with Cloudflare Web Analytics, which sets no cookies and does not store your IP address (see "Visitor statistics" below). You can browse every listing, the map and the filters without an account; beyond the server logs and cookieless statistics described below, browsing gives us no personal data; the map provider sees your IP address when the map loads.

What we collect

• Gym accounts. If you manage a gym's listing, the email address you sign in with, when you signed in, which listing you claimed and when, and a record of each change you make to the listing (what changed, before and after, and when). Sign-in works by an emailed link; we never ask for a password.
• Cover photos. A gym account may upload one cover photo for its listing. It is stored in Supabase Storage, with the rest of our data in the European Union (Frankfurt), and shown publicly on the listing. Before the upload, the dashboard re-encodes the photo, which removes camera metadata such as location. The gym is responsible for having the consent of anyone who can be identified in it.
• Launch partner payments. If your gym takes out a launch partner subscription, you pay through Stripe. Stripe receives your name, email address, billing address, tax ID if you give one, and card details. Card details go directly to Stripe and never reach GymGuide. We store your gym's Stripe customer ID, its subscription status and the date it is paid through.
• Reports. When you use "Report inaccuracy", what you tell us about the listing and, only if you choose to give it, your email address so we can reply.
• AI search. If you sign in with NanoGPT, NanoGPT issues an app key for your account. We keep it only in an encrypted cookie in your browser and never store it on our servers. The questions you type are sent, with GymGuide's published listing data, to NanoGPT to produce the answer.
• Bot protection. The sign-in and report forms use Cloudflare Turnstile, which checks your browser for signs of automation. Your IP address is passed to Cloudflare for that check.
• Server logs. When you load a page, our hosting provider records technical data such as your IP address, the time, the page requested, and your browser and device type, to keep the service secure and working.
• Visitor statistics. We use Cloudflare Web Analytics to see which pages are used and how fast they load. For each page view it records the page address, the referrer, your country, browser, operating system and device type, plus page-load performance (Core Web Vitals). It uses no cookies or browser storage, does not fingerprint your device or track you across sites, and does not store your IP address.
• Listings. Gym listings hold business information: names, areas, prices, offerings, opening hours, business contact numbers and links. Most of it comes from each gym's own website, from the gym directly, or from the gym's own account; every price shows where it came from. A Google rating, where shown, is taken from the gym's Google Maps page.

Why we use it, and our legal basis

• To run gym accounts, verify that an account belongs to the gym it claims, publish the cover photo a gym uploads, and keep a record of listing changes: performing our agreement with the gym and our legitimate interest in accurate listings (GDPR Article 6(1)(b) and (f)).
• To take payment for a launch partner subscription and keep track of its status: performing our agreement with the gym (Article 6(1)(b)). To keep accounting records of those payments: our legal obligations (Article 6(1)(c)).
• To check reports and reply where you asked us to: our legitimate interest in correcting errors (Article 6(1)(f)).
• To provide AI search you have chosen to use: performing that service at your request (Article 6(1)(b)).
• To keep the service safe, stop automated abuse, and keep it working: our legitimate interest in a secure service (Article 6(1)(f)).
• To know which pages are used and how fast they load, through cookieless visitor statistics: our legitimate interest in understanding and improving the service (Article 6(1)(f)).
• To handle privacy and rights requests: our legal obligations (Article 6(1)(c)).

We do not use your data for ad targeting or profiling, and we do not sell it. Our visitor statistics count page views without cookies, fingerprinting or cross-site tracking.

Cookies and browser storage

GymGuide sets no analytics, marketing or tracking cookies, so there is no cookie banner. Our visitor statistics (Cloudflare Web Analytics) use no cookies or browser storage at all. GymGuide only stores what a feature you use needs:

• When you sign in to a gym account, your sign-in session is kept in your browser's local storage until you sign out.
• When you sign in with NanoGPT, an encrypted cookie holds your NanoGPT app key for up to 30 days, plus a short-lived cookie (up to 30 minutes) while the sign-in is in progress. Signing out deletes them.
• Cloudflare Turnstile may set a cookie needed for its bot check on the forms that use it.
• When you search or filter on the home page, your last search (and the featured gyms an AI search returned) is kept in this browser tab's session storage so the Featured row can show matching gyms first. It is never sent to us and is deleted when you close the tab.

Who processes data for us

• Cloudflare hosts GymGuide, serves its pages worldwide, keeps the server logs, runs Turnstile, and provides the cookieless Web Analytics visitor statistics.
• Supabase hosts our database, sign-in service and cover photos in the European Union (Frankfurt).
• Resend sends the sign-in emails from noreply@gymguide.ae and processes your email address in the United States (us-east-1). That address does not receive mail; to contact us, write toprivacy@aunova.ae.
• NanoGPT runs AI search when you choose to use it, on your own NanoGPT account; the AI model it routes to receives your question and the published listings. NanoGPT's own terms and privacy policy apply to your NanoGPT account.
• Stripe takes launch partner payments, emails invoices and receipts, and runs the billing portal where a gym manages its subscription. Stripe may process payment data outside the UAE, including in the United States.
• OpenStreetMap map tiles load from OpenStreetMap's servers, which see your IP address when the map is shown. Links to Google Maps only contact Google if you click them.

International transfers

Cloudflare runs on a global network, Resend processes the email address you sign in with in the United States (us-east-1), Stripe may process launch partner payment data outside the UAE, including in the United States, and NanoGPT processes data outside the DIFC, the UAE and the EEA, including in the United States, so your data may be transferred internationally. We rely on the lawful transfer mechanisms recognised under DIFC Data Protection Law No. 5 of 2020 and, for EEA visitors, the safeguards required by the GDPR, including our providers' data processing terms and standard contractual clauses where they apply.

How long we keep it

• Gym accounts: until you ask us to delete the account. The change history of a listing is kept while the listing exists.
• Cover photos: until the gym replaces or removes the photo, or a moderator removes it.
• Reports: the email address you gave, if any, is deleted when we resolve the report. The report itself is kept while the listing exists, as the record of why the listing changed or did not.
• Launch partner billing records (the Stripe customer ID, subscription status and paid-through date): for as long as accounting and tax law requires.
• Server logs: as long as our hosting provider keeps them for security and operation, and no longer than 90 days.
• The NanoGPT app key: in your browser only, until you sign out or the cookie expires after 30 days.

Your rights

You have the rights to access, correct, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent where we rely on it, under DIFC Data Protection Law No. 5 of 2020 and, for EEA visitors, GDPR Articles 12 to 22. To exercise a right, email privacy@aunova.ae. We aim to respond within 30 calendar days. You may also complain to the DIFC Commissioner of Data Protection or, if you are in the EEA, your local data protection authority.

A gym can ask us to correct or remove its listing at any time: use "Report inaccuracy" on the listing, claim the listing and edit it, or email us.

How we confirm the request is yours

• We reply only to the email address named in the request. The address a message happens to arrive from is not treated as proof of anything, because it is easy to fake.
• The person named must confirm from that same address that the request is theirs. Until that confirmation reaches us, nothing is actioned: we send no data, correct nothing and delete nothing.
• If no confirmation comes back, or the reply asks us to send the data somewhere else, we refuse the request and keep a note of the refused attempt and its date.
• Please do not send copies of identity documents unless we specifically ask for them.

Children

GymGuide is not directed at children, and we do not knowingly collect children's data.

Changes

We keep this policy under review and update the version and date when we change it. The current version always governs. See also our terms of use.