Privacy Policy

1. Who we are and our role

Retain Analytics is a membership retention analytics service run by Adam Kew, a sole trader based in Dunedin, New Zealand. We give gym and fitness studio operators a weekly dashboard showing which members show signs of disengaging, and tools to act on that information.

Member data:when a gym uploads its member data, the gym is the agency responsible for that personal information under the New Zealand Privacy Act 2020. Retain Analytics holds and processes it only as the gym's agent (a data processor), to provide the service to that gym.

Operator and enquiry data: for information about gym operators who use the dashboard and people who contact us, Retain Analytics is responsible for that information.

2. Information we collect

From gym operators (member export upload)

Gym operators upload a member export from their gym management software. This typically contains:

• Member IDs, names and email addresses
• Membership type and status
• Join date and last visit date
• Visit history and booking and cancellation records
• Account balance and payment status
• Membership start and expiry dates
• Freeze or pause status

We do not need, and ask gyms not to include: phone numbers, home addresses, dates of birth, health information, bank account details, or payment card details.

From the contact form

• Name and email address of the gym owner or staff member
• Gym name, location, type, and management software
• Any message content submitted voluntarily

From website visitors and logged-in operators

• Standard server logs and page-view analytics via Vercel (page views, browser type, country-level location). No advertising cookies or cross-site tracking.
• Product usage analytics via PostHog (page views and feature use such as uploads and outreach logging). This is used to understand and improve the product. We do not deliberately send member names or contact details to PostHog.
• Login details for operator accounts (email address and authentication records), handled by Supabase.

3. How we use information

Member data uploaded by gym operators

Member data is used to:

• Calculate a weekly rules-based early-warning score for each member, compared with their own visit history
• Populate the gym's Retain Analytics dashboard
• Track week-on-week movement (for example new risk, worsening, improving, recovered)
• Estimate revenue at risk, and estimate revenue retained after outreach
• Generate AI text (insights, answers and message drafts) when gym staff ask for it (see section 4)

We do not sell member data, and we do not use one gym's member data to provide services to another gym. We may use aggregated, de-identified statistics (for example, how well the score lines up with later cancellations across all gyms) to improve the service. These statistics do not identify any member or any gym.

Free scans and demos

If a gym sends us a member export for a free scan or demo, we use it only to run that scan or demo. It is deleted within 14 days unless the gym becomes a client.

Contact form submissions

Used only to respond to enquiries and free scan requests. Not added to any marketing lists.

4. Sub-processors, storage and security

We use the following service providers (sub-processors) to run Retain Analytics. Each receives only the data it needs for its purpose. We do not share member data with anyone else unless required by law.

Our providers encrypt data in transit and at rest. Dashboard access is limited to the gym's authorised staff through email-based login, and each gym can only see its own data.

AI features only run when gym staff actively request them, never automatically. Groq processes these requests under its own terms of service.

5. International data transfers

Retain Analytics is based in New Zealand, but our providers operate outside New Zealand. The main database is stored in Seoul, South Korea (Supabase region ap-northeast-2). Our processing, hosting, AI, analytics and email providers may process data in other countries, including the United States.

Gym operators should make sure their own privacy notice tells members that their information may be shared with service providers like Retain Analytics and processed overseas.

6. Automated processing and human oversight

Retain Analytics uses a rules-based scoring system to flag members who may be at risk of cancelling. Scores are based on attendance, booking behaviour, payment status, membership expiry and length of membership, compared with that member's own visit history.

No automated decisions are made about gym members. Scores are shown to gym staff as a prioritised list to help focus outreach. All decisions about whether to contact a member, what to say, and how to respond are made by a person at the gym. Members are not automatically notified, penalised, or removed based on their score.

7. Gym operator responsibilities

As the agency responsible for its members' personal information, each gym operator is responsible for:

• Being permitted to share member data with Retain Analytics (typically under their membership terms and privacy notice)
• Making sure their privacy notice covers third-party analytics and AI providers, including Groq if they use AI features
• Reviewing scores and AI-generated text before contacting any member
• Handling member requests to access or correct their information, with our help where needed

8. Data retention

• Active clients: Dashboard data is kept for as long as the gym is a client.
• After cancellation: All of the gym's data (member records, risk scores, report history, outreach logs) is deleted within 30 days of cancellation, either on request or automatically. Backups containing that data age out within a further 30 days.
• Free scans and demos: Exports sent for a free scan or demo are deleted within 14 days unless the gym becomes a client.
• Contact form submissions: Kept for up to 12 months, then deleted.

Deletion requests can be made at any time. See section 10.

9. Your rights under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, individuals can:

• Access: ask for a copy of personal information held about them
• Correction: ask for inaccurate information to be corrected
• Complain: make a complaint if they believe their privacy has been breached

If you are a gym member, your gym is responsible for your information, so please contact your gym first. We will help your gym respond. You can also contact us directly using the details in section 10.

10. Contact and data deletion requests

For privacy questions, access or correction requests, or data deletion requests:

We aim to respond within 20 working days.

You can also contact the Office of the Privacy Commissioner (privacy.org.nz) if you believe your privacy has been breached and we have not resolved your complaint.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page shows when it last changed. We will tell current clients by email about any significant change.