01Who is responsible
Freya Tech, CVR 41047968, Islands Brygge 92, 2300 Copenhagen, Denmark, operates Fitgig and is the controller for the platform processing described here. Contact support@caroloom.com for privacy questions, legal notices or requests.
This notice covers the Fitgig service. A studio receiving your application may be a separate controller for its recruitment decisions and records. Accepting Fitgig’s terms does not mean you consent to marketing or waive your data-protection rights.
02Information we handle
- Account: email, account type, verification status, authentication identifiers, and a record of the terms version and acceptance time. With Google sign-in, we receive basic identity information such as your email, name and profile image; not your Gmail messages.
- Profile: name or studio name, contact person, location and disciplines or class types. Optional details include photos, biography, qualifications, availability, experience, rates, facilities and links. We may derive coordinates from a location you supply.
- Work and communication: jobs, saved gigs, applications, bookings, reviews, conversation participants, messages, read status and related timestamps.
- Community: follows, posts, photos, videos, comments, likes, reposts, quotes and moderation reports. Posts can use your profile location to support the local feed.
- Service and payment: support requests, Hiring Assist briefs, approved criteria, contact details, introductions, order and refund records, and Stripe payment references. Payment details are entered in Stripe checkout; Fitgig’s application does not store full card numbers.
- Operations: signed-in activity dates and first/last-seen times, external-job clicks and platform-action records. Hosting and security services may process IP addresses, device/request information and error logs.
We receive information from you, other members who interact with you, authentication and payment providers, and public business websites or job sources used for external listings. Publicly sourced business data is not evidence that a studio created an account or endorsed Fitgig.
03Why we use it
We use the following legal bases under the GDPR. Where we rely on legitimate interests, the processing must be necessary and proportionate and must not override your rights.
| Purpose | Legal basis |
|---|---|
| Provide your account, profile, messages, community interactions and requested hiring services. | Performance of our contract, or steps you request before a contract — Article 6(1)(b). |
| Prevent abuse, keep the service secure, handle reports, support users and defend legal claims. | Legitimate interests in a safe, reliable platform and protecting legal rights — Article 6(1)(f). |
| Understand platform participation through first-party activity records; maintain relevant external business and job listings. | Legitimate interests in operating and improving a useful professional marketplace, subject to your right to object — Article 6(1)(f). |
| Keep legally required accounting records or respond to binding legal demands. | Compliance with applicable legal obligations — Article 6(1)(c). |
| Send optional promotional emails or use optional tracking where consent is required. | Your separate consent, which you can withdraw — Article 6(1)(a). |
For new accounts, required setup details let us identify your account and show relevant professional opportunities; without them, member access is restricted. Existing accounts do not have to re-enter profile details to accept the terms. Email verification remains required for member access. Optional profile fields are not a condition of basic access. Accepting the terms does not opt you into marketing.
04Who can see your information
Public: published instructor and studio profiles, jobs and external listings can be seen by visitors and search engines. Avoid putting a home address, private phone number or confidential information in public fields.
Members: the community feed, comments and associated media are available to signed-in members. Follows and reactions may be visible through community features. Other members can repost, quote or copy content; signed-in access is not a confidentiality guarantee.
Recipients: studios receive applications sent to them, and conversation participants receive messages. Notification emails may contain names and message excerpts. Hiring Assist staff handle briefs and share agreed role details and candidate information as needed for introductions.
Staff: authorised staff have restricted access for support, operations, moderation and security. The administrative dashboard includes account and activity information; ordinary users cannot access it. Messages are not end-to-end encrypted. We do not promise that staff can never access them when legitimately needed.
05Service providers and transfers
The application uses Supabase for authentication, database and file storage; Vercel for hosting; Resend for service emails; and Stripe for checkout and payment processing. Google handles optional sign-in. Mapbox and, as a fallback, OpenStreetMap’s Nominatim can receive location searches. Google-hosted fonts and some externally hosted images or icons can receive ordinary browser request information.
Fitgig’s primary Supabase database is configured in London, United Kingdom. Vercel serves the website through its international infrastructure, including application processing in the United States, and Resend’s primary email processing is in the United States. Provider support and subprocessors may operate in additional countries. Data is therefore not confined to Denmark or the EEA.
For restricted transfers, applicable provider data-processing agreements include the European Commission’s Standard Contractual Clauses and relevant UK provisions. See the Supabase, Vercel and Resend data-processing terms. Contact us for information or a copy of the safeguards relevant to your data, subject to necessary protection of confidential information.
Providers receive information needed for their function. Google, Stripe and other third-party services may also act as separate controllers under their own notices. We may disclose information to professional advisers or authorities when required by law or necessary to protect users and legal rights. We do not sell your personal data.
07How long information is kept
Retention depends on the record’s purpose; there is no single deletion period for every type of data. We use these criteria:
- Account, profile and community content: while your account and the content are needed for the service, until you remove supported content or we process a valid erasure/account-closure request. Inactivity does not currently trigger automatic account deletion. Unneeded information is deleted or anonymised when identified through a retention review or request.
- Applications, bookings and messages: while needed for the relevant interaction, the account’s work history, or an unresolved issue. Closure and erasure requests consider the other participant’s rights and any specific legal reason to retain a record.
- Support, verification evidence and moderation records: while needed to handle the request, substantiate a current verification result, address an appeal or investigate abuse. Where continued retention is necessary for a claim or security concern, access is restricted and retention is tied to resolving that concern or the applicable limitation period.
- Activity and click records: while needed for account-level reporting, reliability and abuse investigation. These records are not a licence to retain unnecessary personal history indefinitely. You can request deletion or object to processing based on legitimate interests.
- Payments and contractual records: for the duration of the service and applicable statutory accounting or legal-claim periods. We keep only records relevant to that obligation; it does not extend retention of all other account data.
Verification links expire after 24 hours and successful verification consumes the token. Unattached community uploads are eligible for the scheduled cleanup after 24 hours. Cleanup failures can delay file removal until a successful retry.
Provider logs, delivery records and backups follow the relevant provider’s configured lifecycle. A removal from the active service is not immediate erasure from every backup or email system. If retained backup data is restored, applicable deletion requests must be reapplied. Search engines, recipients and independent recruitment controllers may retain their own copies; we can help you identify who to contact. Ask support for the retention circumstances relevant to a particular record.
08Your choices and rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent where we rely on it. Withdrawal does not invalidate earlier lawful processing. You may object to direct marketing at any time.
Email support to exercise your rights or request account closure. We may need proportionate identity verification, but do not send passwords or sensitive documents unless we agree a suitable channel. We normally respond within one month; if a lawful extension is needed, we explain it within that month. Some information may need to be retained, and we explain the reason when a request cannot be fully granted.
You can complain to a competent data-protection authority, including Datatilsynet in Denmark. You do not have to give up that right by contacting us first.
09Matching, security and updates
Location and discipline information help filter opportunities and select a local feed. Match indicators and profile-strength scores are suggestions, not autonomous hiring decisions or proof of identity. Studios and instructors make their own decisions; Fitgig does not automatically hire or reject applicants on their behalf.
Access controls and protected administrative access help secure the platform, but no service can guarantee absolute security. Keep your credentials private and report suspected misuse. Do not submit sensitive medical data through ordinary profile or community fields.
We will update this notice when processing changes, state the effective version and notify users of material changes as appropriate. For an independent explanation of your rights, see the European Data Protection Board’s guide.