Privacy Policy

1. Who we are

Nvora (Nvora Technology Solutions) provides web-based software that gyms and fitness studios use to manage members, memberships, payments, reminders, access control and finances. This policy explains what personal data the service handles, why, and what rights you have. You can reach us at hello@nvora.app or through our contact page.

2. Who is responsible for which data

• Gym member data: each gym decides which member data it records in Nvora and what it uses it for. The gym is the data controller for its members, and Nvora acts as a data processor on the gym's behalf, following its instructions.
• Account data of gyms and their staff, and messages sent to us: Nvora is the data controller.

If you are a gym member and want to access, correct or delete your data, please contact your gym first. We help gyms respond to those requests.

3. Data we process

Gym account and staff users

• Gym name, owner name, email, phone, address (optional) and business type.
• Staff users: name, email, role and permissions.
• Passwords are stored as a one-way hash, never in plain text.
• Subscription information: plan, due dates and payment records for the Nvora subscription.

Gym members (entered by the gym)

• Full name, email, phone, date of birth, gender, address and internal notes, as filled in by the gym.
• Member photo, used on the digital member card and for photo verification at the front desk.
• Membership plan, start and end dates and status (active, expiring, expired or suspended).
• Payment records: amount, method (cash, card terminal, transfer or SINPE), receipt number and status.
• Attendance history: date and time of each check-in.
• Messages sent to members (renewal reminders and birthday greetings) and their delivery status.

Facial data (only if the gym turns it on)

Face recognition is an optional feature, currently in beta, that is off by default. When a gym enables it, the browser on the front-desk device computes a face template of 128 numbers from the member's card photo and compares it on that same device with the camera image. Camera images are not uploaded or stored: only the 128-number template is saved, linked to the member. The template is deleted when the member's photo changes or is removed, and it stops being used if the gym turns the feature off. The gym is responsible for informing its members and obtaining their consent before using this feature.

Website visitors and contact messages

• If you use our contact form or sign-up form: name, email, gym name and message.
• Technical data such as IP address and browser information, used for security (for example, limiting repeated attempts) and in server logs.

Workout routines (only if the gym uses them)

• The routines a coach builds for a member (exercises, sets, notes), linked to that member.
• Access to a routine is protected with a personal link and a 4-digit PIN chosen by the gym. The PIN is stored encrypted.
• What the member ticks as done and the rest timer stay only on the member's own phone (local storage); they are not sent to Nvora.
• If the member installs the routine as an app and turns on notifications, we store the technical subscription of that device to send them a notice when their routine changes.

Team activity

• To help the gym owner supervise their team, Nvora records which staff user performed each action (for example, registering a member, recording a payment or changing a routine) and when.

Reviews

• If you leave a review of Nvora through a review link, we store your name, gym, comment, optional photo and your permission to publish it. We only publish it after reviewing it, and you can ask us to remove it at any time.

4. Website chat and live advisors

Automated assistant

• The chat on our website answers with an automated assistant that may use artificial intelligence. Its answers are informative, can contain mistakes and are not a binding offer: the prices and conditions that apply are the ones published on this website and in our Terms of Service.
• To answer you, the text of your messages (not your name or contact details, unless you type them) is sent to an AI provider: Groq, Google (Gemini), OpenRouter, Cerebras or Mistral, depending on availability. Please do not write sensitive personal data in the chat.
• The conversation is also stored in your own browser for 24 hours so it continues when you change pages.

Live chat with an advisor

• If you ask to talk to a person, we ask for your name and, optionally, your email or WhatsApp. A Nvora sales advisor will see the conversation, including what you typed earlier with the assistant.
• While the conversation is open, the advisor can see which page of our website you are viewing and the text you are typing before you send it, so they can help you faster. If you prefer they do not see a draft, write it somewhere else and paste it when you are ready.
• We also store the time of each message, your IP address and browser for security and to prevent abuse.
• We keep live-chat conversations for up to 24 months to follow up on your request and improve the service, and then delete them.

5. What we use the data for

• To provide the service: show the dashboard, record payments, verify access and generate reports.
• To send messages on the gym's behalf (renewal reminders and birthday greetings) by email and, if enabled, WhatsApp.
• To send service notices to gyms: account activation, credentials, subscription reminders and payment confirmations.
• To answer support requests and contact messages.
• To keep the service secure and prevent abuse.

We do not sell personal data and we do not use it for advertising.

6. Service providers

To run Nvora we rely on providers that process data on our behalf, only as needed to deliver the service:

• Hosting: the servers where the application and database run.
• Email delivery: Gmail SMTP (Google) or Brevo, depending on the configuration.
• WhatsApp: the WhatsApp Business API from Meta, only when a WhatsApp Business number is connected. The member's phone number and the message text are sent to Meta for delivery.
• Fonts: our website serves its own fonts. Each gym's public page and some sign-in screens load fonts from Google Fonts, which receives your IP address.
• Artificial intelligence (website chat): Groq, Google (Gemini), OpenRouter, Cerebras or Mistral receive the text of the chat messages to generate the answer.
• Notifications: push notifications travel through the push service of your browser or phone (Google, Apple, Mozilla or Microsoft), which only receives an encrypted, empty notice.
• Analytics: Google Analytics (Google), only if you accept analytics cookies.

Some of these providers may process data outside Costa Rica, under their own security and privacy commitments.

7. Cookies and local storage

• Session cookie: required to keep you signed in and to protect forms against forgery (CSRF). It is temporary and lasts only for your session.
• "Keep me signed in" cookie: only if you tick that option at login; it lasts up to 30 days.
• Preferences in your browser (cookies and local storage), such as the language and currency you chose, and your cookie choice (nv_consent, 6 months).
• Analytics cookies (Google Analytics): on the public website we use Google Analytics to measure visits and improve the site. Its cookies (_ga, _ga_*) are only set if you accept them in the cookie notice; until then Analytics stores nothing on your device. Google receives technical data about your visit (pages viewed, approximate location, device and browser). We do not use Analytics inside the gym dashboards.

We use no advertising cookies. You can change your choice at any time with the Cookies link in the footer, or delete cookies from your browser settings.

8. How long we keep data

We keep account and member data while the gym's account is active. Some specific periods:

• Live-chat conversations and contact messages: up to 24 months.
• Pending push notifications: 7 days.
• Website chat history in your browser: 24 hours.
• Payment records: for the time required by tax and accounting laws.

If a gym closes its account, it can ask us to delete its data; we will do so unless we must keep certain records by law (for example, payment records). Gyms can edit or delete their members' data from their dashboard at any time, and export their member list before leaving.

9. Security

We use encrypted connections (HTTPS), hashed passwords, role-based permissions for staff, encrypted storage for integration credentials and limits on repeated attempts. No system is 100% secure, but we work to protect your data and will notify affected gyms if we detect an incident that puts it at risk.

10. Your rights

Under Costa Rica's Law 8968 on the Protection of Individuals with Regard to the Processing of their Personal Data, and other applicable laws, you have the right to access, rectify and delete your personal data, and to object to its processing. To exercise these rights, write to hello@nvora.app. Gym members should contact their gym first. You may also file a complaint with Costa Rica's data protection agency (PRODHAB).

11. Minors

Nvora is intended for businesses: to create a gym account or a staff user you must be at least 18 years old. If a gym registers members who are minors, the gym is responsible for having the consent of their parents or guardians, including for photos and facial recognition.

12. Visitors and customers outside Costa Rica

Nvora is operated from Costa Rica and can be used from other countries.

• International transfers: some of our providers (hosting, email, WhatsApp, analytics and AI) may process data in other countries, such as the United States. We only use providers that offer appropriate security and privacy commitments.
• European Union, United Kingdom and similar laws: we process data to provide the service you requested (contract), to protect the service and answer your messages (legitimate interest), to meet legal obligations, and for analytics only with your consent. You can withdraw your consent at any time and you may lodge a complaint with your local data protection authority.
• California and other US states: we do not sell or share personal information for cross-context behavioral advertising.
• Gyms outside Costa Rica are responsible for complying with the data protection laws of their own country regarding their members, especially for photos and facial recognition (biometric data).

13. Changes to this policy

We may update this policy when the service changes. We will publish the new version on this page with its update date, and we will notify gyms by email of any significant change. See also our Terms of Service.