Privacy Policy

This policy explains how Ludus Magnus handles the personal data of gyms, trainers, and athletes on ludusmagnus.fit and in the Ludus Magnus mobile app.

Who is responsible for your data

Ludus Magnus is operated by CWTI Ltd, 24 Tax Suite 137b Westlink House, 981 Great West Road, Brentford, TW8 9DN, United Kingdom. Contact: support@ludusmagnus.fit.

Data held in a gym's space (for example the athletes, plans, and training sessions of a gym that uses Ludus Magnus): the gym is the controller. CWTI Ltd processes this data only on the gym's instructions, as its processor. For requests about this data, contact your gym first. If you write to us, we forward your request to the gym.

Data in your own personal space (only accounts created by signing up before October 2026 have one; new accounts belong to a gym), and each gym's own account and billing data: CWTI Ltd is the controller.

One person can have data in both places, for example after joining a gym. Each rule applies to the data in that place.

What data we process

• Account data: name, email address, language, and password (stored only as a secure hash).
• Profile data: date of birth, gender, height, phone number, and profile picture, when given.
• Training data: training plans, training sessions, exercises performed, and body weight measurements.
• Gym data: gym details, memberships, trainers, and roles.
• Billing data of gyms, processed by Stripe. We do not store card numbers.
• Technical data: IP address, browser and device details, and error reports.

Health data

Body weight, height, and training history can reveal information about your health. The law gives this data extra protection (GDPR Article 9). We use it to provide the service: to show your progress to you and to the trainers of your gym. The mobile app also sends events about the training you record to Firebase Analytics, to measure how the app is used (see the services below). When this data is in a gym's space, the gym is responsible for the legal condition that allows its processing.

Why we process data, and on what legal basis

• To provide the service that you or your gym signed up for (performance of a contract).
• To bill gyms and keep accounting records (performance of a contract, and legal obligation).
• To keep the service secure, and to find and fix errors and crashes in the website and the mobile app (legitimate interest).
• To count website page views without cookies, and to measure use of the mobile app (legitimate interest).

Third-party services that receive personal data

These services receive personal data when you use Ludus Magnus. Each one receives only what its task needs.

• Cloudflare R2 (Cloudflare, Inc.): Stores uploaded files, such as profile pictures, and continuous backup copies of the main database and of the job queue, with 14 days of history. The job queue can hold emails that wait to be sent, including password reset links.
• Google Firebase Analytics and Crashlytics (Google LLC): In the mobile app: a pseudonymous user id, the gym id, your role and language; usage events, including the training you record (exercises, repetitions, and the load in steps of 5 kg); device details; and crash reports.
• Hetzner Online GmbH (Germany): Hosts our servers and the live databases of the service.
• SendGrid (Twilio Inc.): Sends our emails. It receives the email address of each recipient and the content of each email, including sign-in and password reset links.
• Sentry (Functional Software, Inc.): Receives technical data about errors and a sample of request timings, which can include details of the request, and the numeric id of the signed-in user.
• Simple Analytics: Counts page views on the website, without cookies. It receives the page address and browser details, and your IP address as part of the connection.
• Stripe: Processes the subscription payments of gyms: the name, email address, and payment details of the person who pays.
• WhatsApp (Meta Platforms): Only when a person opens a WhatsApp link on their own device. The link passes its content to WhatsApp when it opens, before the message is sent. Gym staff can open a link that carries a one-time sign-in link and the member's phone number. A training plan can be shared with the member's name, the plan name, and a public link to the plan.

Transfers outside the EU and the UK

Some of these services are companies in the United States, or use servers there. These transfers rely on the safeguards of each provider, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

How long we keep data

We keep your data while your account exists. When your account is deleted, we delete your data. Backup copies of deleted data expire within 14 days. We keep billing and accounting records for as long as the law requires.

Your rights

You have the right to access your data, to correct it, to delete it, to restrict or object to its processing, and to receive it in a portable format. You can also complain to a supervisory authority: in Italy the Garante per la protezione dei dati personali, in the United Kingdom the ICO, or the authority of the EU country where you live.

To delete your account, sign in on the website, open Profile and choose Delete account. The deletion happens at once. If you own the billing account of a gym, give it to another person first: the website does not delete an account that owns one. When you cancel your subscription with your gym, and it is your only gym on Ludus Magnus, the gym can also delete your account. For every other request, write to support@ludusmagnus.fit. We complete requests by email within 30 days. More details: Delete your account.

Children

Users must be at least 13 years old. We do not knowingly collect data from children under 13. If you think that a child under 13 gave us personal data, contact us and we will delete it.

Changes to this policy

When we change this policy, we change the date at the top of this page.