last updated 1 September 2026

Data processing terms

These terms cover member data. They apply from the moment a gym uploads its first member list and sit alongside the privacy notice, which covers only the details a gym gives us about itself.

Who is responsible for what

The gym is the data controller. It decides which members are uploaded, what is said to them, and when. casdey, operated by the casdey team and reachable at info@casdey.com, is the processor: it acts on the gym's instructions and does nothing with member data that the gym has not asked for.

A gym confirms this, and confirms it has a lawful basis to contact these members about their membership, before casdey will accept a single record. The product refuses the upload otherwise.

What casdey holds

• Member name, email address and phone number, as given in the gym's own export.
• The date of their last visit and how many visits are on record.
• The gym's own reference for that member, where their software provides one.
• What casdey has done: which messages were sent and when, whether a member unsubscribed, and whether the gym recorded them as having returned.

casdey does not hold health records, training or medical notes, images or payment details, and has no way to receive them.

What it is used for

One purpose: identifying members who have not been seen for a while and contacting them on the gym's behalf to invite them back. Member data is never sold, never shared with another gym, never used for advertising, and never used to train any model.

Where it is held

Your member data is stored in the European Union, in Ireland, encrypted in transit and at rest.

Who else touches it

casdey uses these sub-processors, and no others. Each is bound by equivalent terms.

• Supabase, EU region, for storage and accounts.
• Vercel, for running the application.
• Stripe, for the gym's own subscription payments. Stripe never receives member data.
• Zoho Mail, or Resend where configured, for delivering messages. These receive a member's email address and the message text, and nothing else.
• Google Calendar, only if the gym chooses to connect one, for writing bookings into the gym's own calendar. It receives the booked member's name and email address, and is processed by Google in the United States. A gym that does not connect a calendar shares nothing with Google.
• Twilio, only if the gym turns on the WhatsApp channel, for sending and receiving WhatsApp messages. It receives the member's phone number and the message text, and processes them in the United States. A gym that leaves WhatsApp off shares nothing with Twilio.
• Anthropic, in two places, both of which the gym turns on itself. If the gym asks casdey to write each message individually, it receives the gym's own message and the few facts casdey holds about that member: their first name, roughly how long since their last visit, the reason for leaving if the gym recorded one, and the gym's offer. If the gym turns on the WhatsApp channel, it also receives the text of a conversation once a member has replied. In both cases it receives the gym's name, processes in the United States, and is contractually barred from training on any of it. A gym that leaves individual writing off and WhatsApp off shares nothing with Anthropic.

How long it is kept

• Member records: for as long as the gym keeps its account, then deleted within 30 days of it closing.
• Immediately, and permanently, whenever the gym deletes a member or asks casdey to delete everything. Both are buttons in the product, not a support request.
• Unsubscribe records: kept indefinitely, and deliberately. They hold an email address and nothing else, and deleting them would mean somebody who asked to be left alone could be contacted again after the next import.
• The activity log: 24 months.

Member rights

A member's rights are exercised against the gym, which is their controller. casdey will help a gym answer any request, at no charge and without delay. Every message casdey sends carries a working unsubscribe link, and using it stops all contact from that gym through casdey immediately, including anything already queued.

If something goes wrong

casdey will tell the affected gym about any personal data breach without undue delay and in any case within 24 hours of becoming aware of it, with what is known at the time, and will keep the gym updated. Reporting to a supervisory authority is the gym's decision to make as controller, and casdey will provide whatever it needs to make it.

Ending the arrangement

A gym can export everything at any time and delete everything at any time, both from within the product. On account closure, member data is deleted within 30 days without needing to be asked.

Getting in touch

Questions about any of this go to info@casdey.com, and reach a person rather than a queue.