Privacy Policy

Last updated: September 5, 2026

ArenaContact is a gym management app provided by NeuraPalette LLC (New Mexico, USA). This policy explains which personal data we process, why, and how, when you use the app and the arenacontact.com website. The data controller is NeuraPalette LLC; for any request, contact support@arenacontact.com.

Data we process

We process only the minimum data the service requires: full name, email, phone number, in-gym membership / dues / payment / reservation / attendance records, the IBAN the gym owner shows to members, the device push token used for notifications, and technical log (error) data needed to keep the service running properly.

The phone number is optional for gym members. For the gym owner it is required on the signup form: we need it to do the setup together with you and to reach you about matters concerning your account.

On top of that there are optional fields the gym owner may fill in: the member's profile photo, date of birth, guardian name and guardian phone number, and a free-text note the owner keeps about the member. None of them are required. Date of birth, guardian details and notes are hidden from other members of the gym; only the gym owner, the coaches the owner has given member-management permission to, and the member themselves can see them. The profile photo is additionally visible to the gym's coaches, so they can recognise the member when taking attendance.

Purposes and legal basis

We process data to perform the contract (your subscription), manage dues and reservations, send notifications, handle payments, and keep the service secure. The legal basis is the performance of the contract and legitimate interest; in cases such as notification permissions, we rely on your explicit consent (the Turkish Personal Data Protection Law (KVKK No. 6698) m.5 / GDPR m.6).

Children's data

Data of members under 18 is processed only with the consent of a parent/guardian, and obtaining that consent is the responsibility of the gym owner who registers the member. This is exactly why date of birth and guardian details are kept in a separate, narrowly accessible record — other members of the gym cannot see those fields. The birthday feature can be switched off per member, and when it is off no notification is produced for that person. If, as a guardian, you want your child's data deleted, just write to support@arenacontact.com.

Where your data is kept

The master record of your personal data — your name, email, phone number, membership and dues history, payment records, reservation and attendance history, and your gym's IBAN details — is stored and processed on our servers located in Türkiye. The database, including its backups, is never taken abroad.

Sharing and service providers

Your data is never sold to third parties. It is shared only with the management of the gym you belong to and with the processors that operate the service. The providers below are based abroad and see only the limited data their own function requires:

• Stripe (payments) — for the gym subscription only: the gym owner's name, email, and phone number. Your payment card details never reach us; card data is processed directly by Stripe. Gym members' data never goes to Stripe.
• Brevo and Resend (email) — delivery of invite, email verification and password reset emails: the recipient's name and email address. If one of them is unreachable, delivery automatically falls back to the other.
• Expo / Apple / Google (push notifications) — the device push token and the notification text, so the notification can reach your device.
• Sentry (error monitoring) — app crash/error records.

International transfers

The limited data listed above is processed on the servers of these providers abroad, as required to deliver the relevant service (KVKK m.9). All your other personal data stays in Türkiye. Transfers take place under the providers’ contractual safeguards.

Retention and deletion

Your data is kept for as long as your account is active and for as long as legal obligations require. You can permanently delete your account and data in the app via Settings → Danger zone → Delete my account; deletion is applied immediately and irreversibly. You can also request it by email if you prefer.

Pre-signup records: For people who fill in the signup form but do not complete a subscription, the name, email, and phone details are kept for at most 12 months so we can review the request and get back to them, and are then deleted. Since these people have no account, deletion cannot be done from within the app; simply write to support@arenacontact.com.

Invoice records: Even after you delete your account, the invoice and payment records that tax and accounting law require us to keep — held by the payment institution Stripe and in our own revenue ledger — are retained. Those records contain your gym's name, the invoice amount and its date; they carry no data about your members and are never used for marketing.

Your rights

Under KVKK m.11 and the GDPR, you have the right to access, rectify, and delete your data, to object to processing, and to data portability. To exercise these rights, write to support@arenacontact.com.