Policy of
confidentiality
This document clearly and transparently describes how JiyuFit processes your personal data.
Last update:
October 24, 2026
1. Data controller
Andre Pinfada (JiyuFit) is the controller of personal data collected via the platform jiyufit.com and its associated applications.
Company name
Andre Pinfada (JiyuFit)
107 rue de la Madeleine, 49000 Angers, France
Data Protection Officer (DPO)
Email: dpo@jiyufit.com
Address: 107 rue de la Madeleine, 49000 Angers, France
2. Data collected
JiyuFit only collects the data necessary for the operation of the platform, the security of payments and participation in governance.
Identification data
- • First and last name (encrypted)
- • Email address (encrypted)
- • Telephone number (optional)
- • Profile photo (optional)
Usage data
- • Reservation history
- • Sports preferences
- • Location (for gym search)
- • Participation in governance
- • Trust Score and User Tier
Payment data
- • Billing information
- • Transaction history
- • Stripe payment tokens (secure)
Technical data
- • IP address (anonymized after 90 days)
- • Browser type and device
- • Security logs
- • Session cookies
3. Purposes of processing
Your data is used exclusively for the following purposes:
- ✓ Manage your account, your reservations and your access to partner gyms
- ✓ Process your payments securely via our service provider
- ✓ Calculate and update your Trust Score to prevent abuse and fraud
- ✓ Allow your participation in the governance of the platform
- ✓ Improve our services through anonymized statistical analyzes
- ✓ Ensure the security, integrity and stability of the platform
- ✓ Interpreting your requests to the Copilot assistant, only if you choose to use it (performance of the requested service).
4. Legal basis
Execution of the contract
Account management, reservations and payments.
Consent
Sending marketing communications (optional, revocable at any time).
Legitimate interest
Fraud prevention, continuous improvement of the platform.
Legal obligation
Conservation of accounting documents and tax obligations.
5. Data security
Protective measures
- • AES-256 encryption for sensitive data
- • HTTPS required for all communications
- • 2FA authentication available for your account
- • Security audits regular
- • Strict CSP policy against XSS injections
- • Rate limiting on all critical APIs
In the event of a data breach, JiyuFit undertakes to notify you as soon as possible, and no later than 72 hours, in accordance with the GDPR.
6. Data sharing
Your data is not never sold. They are shared only with:
Partner gyms
Only the data necessary for managing reservations.
Stripe (payments)
PCI-DSS certified payment processor.
Render (hosting)
Hosting of the application, database and cache, in the United States (Oregon).
OpenAI (Copilot assistant)
Only if you use the Copilot assistant: the text of your request and your recent exchanges (12 at most) are sent to OpenAI (United States), which processes them on our behalf to interpret your request, without using them to train its models. If you save your own OpenAI or Anthropic key, that provider processes your messages under the contract you concluded with it. Do not include sensitive data in your messages.
Legal authorities
Only in the event of legal obligation or judicial requisition.
7. Your GDPR rights
Droit d'accès
Consulter vos données
Droit de rectification
Corriger vos informations
Droit à l'effacement
Supprimer votre compte
Droit à la portabilité
Exporter vos données
Droit d'opposition
Refuser certains traitements
Droit de limitation
Geler temporairement certains usages
To exercise your rights, contact: dpo@jiyufit.com or use the dedicated section in your account.
8. Shelf life
| Data type | Duration |
|---|---|
| Active user account | Duration of use |
| Inactive account | 3 years then deletion |
| Payment data | 10 years (legal obligation) |
| Security logs | 1 year |
| IP addresses | 90 days then anonymization |
| Session cookies | 30 days |
| Exchanges with the Copilot assistant (at JiyuFit, encrypted) | 30 minutes, erased at sign-out |
9. Cookies
JiyuFit only uses cookies that are strictly necessary for the operation of the platform:
-
🍪
Session cookie : maintains your connection
-
🍪
Preferences cookie : memorizes your language and certain interface settings
-
🍪
CSRF cookie : protection against cross-site request forgery attacks
No third-party advertising or tracking cookies is not used.
10. International transfers
Your data is hosted in the United States (Render, Oregon region). Hosting at Render (United States) is governed by Render's data processing agreement: the EU–US Data Privacy Framework or, failing that, the European Commission's standard contractual clauses.
In the event of support or technical operations involving transfers outside the European Union, we use the standard contractual clauses of the European Commission in order to ensure an adequate level of protection.
The Copilot assistant involves a transfer to the United States (OpenAI), governed by OpenAI's data processing agreement, which incorporates the European Commission's standard contractual clauses. OpenAI keeps the data it receives for a limited period set by its terms, in particular to detect abuse.
CNIL complaint
If you believe that your rights are not respected, you can file a complaint with the CNIL:
www.cnil.fr/fr/plaintes
3 Place de Fontenoy
75007 Paris
Contact us
Data Protection Officer
Email: dpo@jiyufit.com
Form: My GDPR rights
Customer Service
Email: support@jiyufit.com