Legal
Privacy Policy
1. Who we are
Gridiron is software for fitness studio operators, provided by ONYX Technologies, LLC ("Gridiron", "we", "us"), a company registered in Illinois, USA, at 102 W Chicago Ave, Chicago, IL 60654.
This policy explains what we do with personal information. It covers our website at getgridiron.ai and the Gridiron platform.
2. Two different roles
We handle personal information in two distinct ways, and your rights differ depending on which applies.
When we decide what happens to the data
For our own website visitors, prospective customers and the staff of studios who use Gridiron, we decide why and how information is used. This policy governs that directly.
When a studio decides, and we only hold it
When a studio uses Gridiron to run its business, the studio decides what happens to its members' information. We process it on their instructions and under a contract with them.
If you are a member of a studio that uses Gridiron, the studio is responsible for your information. Ask them first. We will help them answer you, and we will act on their instruction.
3. What we collect
From our website
- Anything you send us, such as your name, email address and what you wrote
- Basic technical information: IP address, browser, pages viewed, referring site
From studios using the platform
- Staff accounts — name, email, phone, role, pay rate, shifts, time-clock records, and the studio location at clock-in where a studio enables that
- Studio members — name, email, phone, date of birth, bookings and attendance, memberships and credits, purchase and payment history, notes staff record, and communication preferences
- Payment information — handled by our payment processor. Card numbers are stored by them, never by us
4. How we use it
- To run the platform: schedules, bookings, check-in, memberships, billing and payroll
- To send messages a studio has asked us to send on its behalf
- To produce the studio's own reporting and the insights Gridiron surfaces
- To keep the service secure, diagnose faults and prevent abuse
- To meet legal and tax obligations
- To contact prospective customers who asked to hear from us
We do not sell personal information. We do not share it with advertisers. We do not use studio member data to train machine learning models that serve anyone other than that studio.
5. Email and text messages
Where a studio uses Gridiron to message its members, those messages are sent on the studio's behalf and from the studio's identity.
Text messages
- Marketing texts are sent only to people who gave express written consent to that studio
- Reply STOP to any message to opt out, and HELP for assistance
- Message frequency varies. Message and data rates may apply
- Consent to marketing messages is never a condition of buying anything
- Opting out is recorded immediately and applies across every list that studio holds
Every marketing email carries an unsubscribe link. Operational messages about something you bought or booked are not marketing and may still be sent.
6. Who else processes it
We use third parties to run the service. Each is bound by contract to protect the information and to use it only as we instruct.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database and authentication | USA |
| Railway | Application hosting | USA |
| Vercel | Website hosting | USA |
| HighLevel | Email and text delivery, communication records | USA |
| Stripe | Card payments and payouts | USA |
This list changes as the platform does. We keep it current rather than writing "and others".
7. Cookies
Our website uses cookies that are necessary for it to work, and may use analytics cookies to understand which pages are read. The platform uses cookies to keep you signed in. We do not use advertising cookies and we do not permit third parties to track you across other websites from here.
8. When we share information
- With the providers listed above, to run the service
- With the studio whose members or staff the information belongs to
- Where the law requires it, or to establish or defend a legal claim
- With a buyer, if the business is sold — and you will be told before it happens
9. How long we keep it
- While a studio is a customer — for as long as they need it to run their business
- After a studio leaves — their data is available for export for 30 days, then deleted within 90 days unless the law requires us to keep it
- Financial records — kept as long as tax and accounting law requires, usually seven years
- Website enquiries — two years, unless you become a customer
10. Security
Information is encrypted in transit and at rest. Access is limited to people who need it, and every change to a member record is logged with who made it and what it looked like before. Card numbers never reach our systems.
No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires.
11. Your rights
Depending on where you live, you may have the right to:
- Know what information we hold about you, and get a copy
- Correct information that is wrong
- Ask us to delete it
- Opt out of marketing at any time
- Not be discriminated against for exercising any of these
If you are a studio member, contact your studio — they decide, and we act on their instruction. If you are a studio or a prospective customer, contact us directly at the address below. We will respond within 45 days.
12. Children
Gridiron is not intended for children under 13 and we do not knowingly collect their information. Where a studio serves minors, the studio is responsible for obtaining parental consent. If you believe a child's information has reached us, tell us and we will remove it.
13. Changes
We will post any change here and update the date at the top. If a change materially affects how we use your information, we will tell you directly rather than relying on you noticing.
14. Contact
ONYX Technologies, LLC
102 W Chicago Ave, Chicago, IL 60654
privacy@getgridiron.ai