Privacy policy

01Who processes your data

Fonji is a service provided by Pizero Design srl, VAT number 02313970465, registered at Via della Chiesa XXXII trav. I, 231, 55100 Lucca (LU), Italy. Our privacy contact is hello@fonji.app.

Pizero Design acts as controller for commercial and support enquiries received directly, the management of its own customer relationships and service security for its own purposes.

The school, studio or gym you join is the controller for its activities: member records, classes, bookings, memberships, payments and documents. For these records, Pizero Design acts as a technical provider on behalf of the studio. Your studio’s privacy notice supplements this policy and explains its purposes, legal bases and retention periods. Connecting multiple studios does not authorise one studio to access another studio’s records.

02What information we process and its sources

Information may be provided by you, entered by studio staff or imported from the studio’s records. Depending on the features you use, it includes:

• First and last name, email, optional phone number and other personal details required by your studio; account identifier, role, associated studio and information needed for authentication.
• Enrolments, courses, classes, bookings and cancellations, optional notes, attendance, memberships, credits, expiry dates and payment records.
• Status and expiry dates of medical certificates and insurance, and administrative documents managed by the studio. Medical certificate information may concern health: do not enter diagnoses or clinical details in free-text fields.
• Commercial or support requests, contact details and messages.
• Technical information: IP address, requests and security records, sessions, language and preferences; for push services, device tokens, installation identifiers and platform. Push service components may process diagnostic and operational technical data.
• If you use online payments enabled by your studio: the plan purchased, amount, currency, status and transaction references. Full card details are entered in the payment provider’s service, not in Fonji forms.

03Why information is used

Accounts, sign-in, password recovery, support and requested services rely on the performance of a contract or steps taken before entering a contract (GDPR Article 6(1)(b)). For people acting on behalf of an organisation, operational communications also rely on the legitimate interest in managing that relationship (Article 6(1)(f)). Administrative and statutory obligations rely on Article 6(1)(c).

Protecting accounts, preventing abuse and maintaining platform reliability rely on the legitimate interest in security (Article 6(1)(f)), taking users’ rights into account.

Your studio determines the purposes and legal bases for its processing, including bookings, renewals, service messages and documents. For any health-related data, it must also identify an applicable condition under GDPR Article 9 and inform the individuals concerned. Using the app does not constitute general consent to the processing of health data.

Automatic availability, credit and expiry checks apply the studio’s settings. Contact its staff for explanations or corrections to booking requirements. Fonji does not use this information for advertising profiling.

04Required information and optional permissions

Fields marked as required are needed to provide the requested function. Without them, creating an account or booking a class may not be possible. Optional details, such as a phone number where your studio does not require it, may be omitted.

Camera access is used to scan a studio’s QR code. Scanning takes place on your device: Fonji does not upload the camera video to its server. You can use the studio link instead.

Push notifications require device permission and availability of the service for your studio. You can disable them in your operating system settings. Essential emails, such as password recovery you request, are service communications, not advertising.

The app stores connected studios, preferences and session information locally. Disconnecting a studio removes the connection on your device; it does not cancel your enrolment or erase the studio’s records.

05Who may receive information

Authorised people at your studio and Pizero Design access information for their respective activities. Technical and professional providers may process it for hosting, security, messaging, support and legal obligations. Competent authorities may receive information where required by law.

External services used, or provided for optional features, include Qboxmail for email, Cloudflare for traffic protection and distribution, Google Firebase Cloud Messaging and Apple Push Notification service for notifications. When payments are enabled, Stripe processes the payment through the studio’s account; Fonji receives the references and outcome needed to record the payment and update the membership.

Each provider processes information according to its role and applicable terms. Policies for the main services are available below:

• Cloudflare privacy policy
• Firebase privacy and security
• Apple privacy policy
• Stripe privacy policy

06Where information is stored

Pizero Design manages platform hosting on servers located in the European Union. Backup servers are also located in the European Union.

This location does not rule out processing outside the European Economic Area by international providers, for example to deliver notifications or protect traffic. Depending on the service and recipient, these transfers are subject to adequacy decisions or contractual safeguards under the GDPR, including standard contractual clauses. You can request details of recipients and applicable safeguards from our privacy contact.

07How long information is retained

Retention depends on the purpose, your relationship with the studio or Pizero Design, applicable obligations and any need to establish or defend legal claims. Different categories have different retention needs.

Studio member records, bookings, memberships and documents are retained according to the studio’s instructions and the obligations associated with its activities. Ask your studio for the periods that apply to your enrolment. An erasure request may not cover information that must be retained to comply with the law or address a dispute.

Information and support enquiries are retained to handle the request and necessary follow-up. Correspondence relevant to a contractual relationship or dispute follows the duration of that need. Technical records are retained in relation to operational requirements, security and investigation of incidents.

Backup copies follow backup replacement cycles and may temporarily contain information removed from active systems. To ask about the criterion applied to a specific category or request erasure, contact your studio or Pizero Design.

08Cookies and device storage

The website and management platform use cookies and technical storage for sessions, security and preferences such as language or theme. The app uses local storage for connected studios and sign-in. Blocking these tools may prevent authenticated services from working.

Fonji does not integrate behavioural advertising or advertising tracking tools. External services opened through links, including payment services, have their own policies and settings. Studio operational statistics concern its activities and are not cross-site advertising tracking.

09Members who are minors

Studios may organise classes for minors. The studio manages enrolment and any requirements and parent or guardian authorisations under applicable law. To correct a minor’s information or exercise their rights, contact the studio; Pizero Design can provide technical assistance.

10Your rights and how to exercise them

Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability of your information, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

For enrolment, documents, classes and memberships, contact your studio. For processing by Pizero Design, or help identifying the right contact, email hello@fonji.app and specify your studio and account email. Do not send passwords or copies of medical documents. Proportionate information may be requested to verify your identity.

In the app, start deletion from Profile → Delete account. You can request deletion of the entire account associated with your email across all connected studios, or only your data at the selected studio. The form registers your request without requiring additional phone calls or emails and displays a reference and expected completion date, within 30 days. You receive an email confirmation when deletion is complete.

Deletion covers your account and associated personal data, except for tax, accounting or administrative records that must be retained to comply with legal obligations or protect legal rights. The confirmation explains any retained data and the reason. Uninstalling the app or disconnecting a studio is not a deletion request. Other accounts with different email addresses are not affected.

You have the right to lodge a complaint with the Italian data protection authority or the competent supervisory authority in the country where you live, work or believe an infringement has occurred.

• Italian data protection authority

11Updates to this policy

This page may be updated to reflect changes to the service, providers or applicable law. The date at the top identifies the version. Any new purposes requiring further information or choices will be presented before the relevant processing takes place.