Privacy Notice: Kakuto Members' App

This notice explains how personal data is handled in the Kakuto members’ app, which gym members, students and their parents use to book classes, check in and manage their membership. The app runs on iPhone and Android and on the web at app.kakuto.io. Your gym may show it under its own name and logo.

It does not cover the kakuto.io website, which has its own privacy policy, or the apps that gym owners, staff and coaches use, which have their own privacy notice.

Who is responsible

Kakuto is run by Kakuto Technology GK (“Kakuto”, “we”, “us”).

Your gym decides what happens to your data. Your gym uses Kakuto to run its memberships, classes and payments. The gym is the controller of your data, and we process it on the gym’s behalf, following its instructions. To see, correct or delete your data, please ask your gym first. We will help the gym answer you.

We are responsible for running the service. We are the controller for the data we need to run Kakuto itself: your sign-in, security records and server logs.

To ask anything about this notice, email info@kakuto.io.

Where your data is kept

Your data is stored on Amazon Web Services (AWS) in its London region (eu-west-2), in the United Kingdom. That includes your profile, photos, bookings, check-ins, backups and logs. Each gym’s data is kept separately from every other gym’s.

There are a few exceptions, each explained below:

• Where your gym enables enterprise AI features, requests are processed within the EU through Amazon Bedrock or sent to OpenAI under the configuration described in Enterprise AI features.
• Emails sent to you through Kakuto (such as verification codes and your gym’s emails) go out through AWS’s email service in Ireland, in the EU.
• The app’s own code (not your data) is delivered through AWS’s worldwide content network, so it loads quickly wherever you are.
• Some features send data to the service providers listed under Who we share data with, such as Stripe for payments and Google for app notifications.

What the app collects

Your account

• your email address, which is how you sign in
• the gyms you belong to

Sign-in is handled by Amazon Cognito. Your password is checked by Cognito and we never see it.

Your profile

You fill in your profile in the app. Your gym needs most of it to run your membership and keep you safe in class:

• your name and nickname
• your date of birth and gender (you can choose “prefer not to say”)
• your telephone number
• an emergency contact: their name, address and telephone number
• your profile photo, so coaches can recognise you at the door (see Profile photos)
• the colours you choose for how your nickname is shown
• a payment email, if you paid for your membership with a different email address from the one you sign in with. We email a code to that address to confirm it is yours.

Family members

A parent or guardian can add the children or other family members they sign up and pay for. For each one, the app keeps their name, nickname, date of birth, gender and profile photo. A parent can also tell the gym whether their children may arrive at class on their own.

Consent forms

If your gym asks you to sign a consent form (for example, agreeing to its rules or to the risks of training) in the app, we record that you signed it.

Classes, check-ins and progress

• the classes you and your family members book and cancel
• your check-ins and attendance, and how each check-in was made (QR code, nearby check-in or by a coach)
• your progress, such as belts, grades, stars, badges and Training Journey rewards
• your place on gym leaderboards, such as Best of the Month

Nearby check-in and your location

If your gym offers nearby check-in, the app asks for your device’s location only when you tap Check in, and only once. It sends your position and its accuracy to our server, which checks that you are at the gym. We do not store your location. We keep only the check-in itself. The app never tracks your location in the background, and you can check in another way if you do not allow location access.

Profile photos

When you or a parent uploads a profile photo, we use Amazon Rekognition, in AWS London, to check that it shows a face. This only detects whether a face is present. It does not identify who you are, and we do not create or keep any facial template or “faceprint”. We keep the result of the check (whether a face was found, and how sure the check was) alongside the photo.

The photo is stored in AWS London and shown to the staff at your gym who need it.

Membership and payments

Card payments are taken by Stripe and Direct Debits by GoCardless, on their own secure pages. Kakuto stores your plan, amounts, payment dates and statuses, failed payments and refunds, and the billing address you gave. Your card number and bank account details stay with Stripe and GoCardless; Kakuto only receives the last few digits, so you and your gym can tell accounts apart.

Your gym may use your billing address to see roughly where its members live, using Google’s Geocoding service to turn the address into a map position. This helps the gym plan its locations. Other members never see it.

Training Circle

Training Circle is an optional social feature, available only where your gym turns it on. Nothing is shared until you choose to join. If you join, the app keeps:

• your Training Circle profile: a portrait you choose, a short bio, your disciplines, what you are working on, and your badges. This portrait is separate from your account photo.
• your friends and friend requests, and the members you have blocked
• the Moments you post (photos and short video clips from class), who you share them with, and reactions to them
• requests to the people shown in a Moment to agree to it being shared, and their answers
• reports you make about other members or posts, and what the gym decided

Other members only see your nickname, avatar and what you choose to share. They never see your email address, telephone number, date of birth or other account details. You can leave Training Circle at any time.

Votes

If your gym runs votes or polls, the app keeps your vote and any comment you add.

Notifications

If you allow notifications, the app registers your device with Google Firebase Cloud Messaging and, on iPhones, Apple’s push service, and we store the device’s notification token. Notifications tell you about class changes, gym announcements and Training Circle activity. They carry only the notification’s own text. You can turn them off in your device’s settings.

Messages from your gym

Your gym may contact you by email or WhatsApp using the details in your profile. Those messages are covered by the gym’s use of Kakuto Admin, explained in the Kakuto Admin privacy notice.

Enterprise AI features

Some gym owners subscribe to Kakuto’s enterprise tier, which supports optional AI features to help staff manage the gym and respond to members. Where your gym enables these features, your messages and relevant membership records may be included in AI requests to provide those services on the gym’s behalf.

Depending on the gym’s configuration, AI requests are processed using one of the following arrangements:

• Amazon Bedrock in the EU. AI processing takes place through the Amazon Bedrock runtime in AWS regions within the European Union. The data submitted for AI processing remains within the EU and is not used to train AI models.
• OpenAI commercial API. AI requests are sent to an OpenAI API endpoint under a commercial agreement with Zero Data Retention enabled. OpenAI does not retain the content of those requests or the responses after processing, and does not use that data to train AI models.

These protections apply to processing by the AI provider. They do not change how Kakuto stores the gym’s records or any conversations described in this notice. You can ask your gym which configuration applies.

The gym remains responsible for how your data is used. Staff access remains subject to the roles and permissions set by the gym. AI assistant conversations kept by Kakuto are described in the Kakuto Admin privacy notice.

Storage on your device

The app does not use analytics or advertising cookies or trackers. It keeps only what it needs on your device:

The Kakuto sign-in page, run by Amazon Cognito, sets cookies that are needed for signing in. Signing out, or deleting the app, removes this data from your device.

The app asks for permission before it uses your camera or photos (to choose a photo), your location (for nearby check-in) or notifications. You can change these at any time in your device’s settings.

Server logs

When you use the app, our servers record your IP address, the time and the request you made. We use these to run the service, keep it secure and fix faults. Logs are kept in AWS London.

Why we use the data, and the lawful basis

On the gym’s behalf. We use your data only to provide the app’s features to your gym and to you, under our contract with the gym. Your gym is responsible for having a lawful basis for its own use. For most of your data this is your membership contract with the gym. For your emergency contact and family members’ details, it is usually the gym’s legitimate interest in keeping people safe in class. Optional features such as Training Circle, nearby check-in and notifications rely on your choice to use them.

For our own purposes. We use sign-in records and logs to provide the service and keep it secure. The basis is our contract with the gym and our legitimate interest in running a secure, reliable service. Where the law requires it, the basis is a legal obligation.

We do not sell personal data, use it for advertising, or use it to train AI models.

Who we share data with

Your gym. Staff at your gym see your data according to the roles the gym gives them. A coach, for example, does not see your payments.

Service providers. We share data only with the service providers that run parts of the app, under contracts that require them to protect it, and only as needed:

• Amazon Web Services provides storage, sign-in (Amazon Cognito), email sending (Amazon SES), the photo face check (Amazon Rekognition) and, where configured, enterprise AI processing (Amazon Bedrock).
• OpenAI processes AI requests where your gym’s enterprise AI configuration uses its commercial API, with Zero Data Retention and no use of the data for model training.
• Stripe and GoCardless take card and Direct Debit payments.
• Google delivers app notifications (Firebase Cloud Messaging) and turns billing addresses into map positions for your gym (Geocoding).
• Apple delivers app notifications to iPhones.

The Kakuto team accesses your data only to provide support, fix faults or when the law requires it. We may also disclose data where the law requires it.

International transfers

Data stored by Kakuto stays in the UK, apart from the EU processing described in Where your data is kept. The UK recognises the EU as giving adequate protection.

Stripe, GoCardless, Google and Apple may process data outside the UK, including in the United States. Where they do, they protect it with safeguards the UK recognises, such as the UK Extension to the EU-US Data Privacy Framework or the UK’s International Data Transfer Addendum to the standard contractual clauses.

OpenAI may process AI requests outside the UK and the EU, depending on the configured endpoint. Where this involves an international transfer of personal data, we use the safeguards required by applicable data protection law. The EU-only processing arrangement applies to the Amazon Bedrock configuration described in Enterprise AI features.

Keeping data safe

• All connections to the app use encryption (HTTPS).
• Data is encrypted when stored.
• Each gym’s data is separate, and access within a gym is limited by role.
• Photos and videos in Training Circle are delivered through short-lived private links, only to the people allowed to see them.

How long we keep data

• Your account and profile are kept while you have an account. You can delete your account from the app at any time. This deletes your sign-in, your profile details and your Training Circle profile.
• Records your gym needs, such as attendance, memberships and payments, are kept by your gym for as long as it needs them, for example for its accounts. Ask your gym if you want them deleted.
• If your gym stops using Kakuto, we delete or return its data as it instructs, unless the law requires us to keep some of it (for example financial records).
• Server logs are kept only as long as we need them for the purposes above.

Your rights

Under the UK GDPR (and the EU GDPR, if you are in the EU), you have the right to:

• get a copy of your personal data
• have inaccurate data corrected. You can change most of your profile in the app yourself.
• have your data deleted
• restrict or object to how it is used
• receive data you gave in a portable format
• withdraw your consent to optional features, such as by leaving Training Circle or turning off location access or notifications

Your gym decides what happens to your data, so please contact your gym first. For anything about your sign-in or our own records, email info@kakuto.io. We reply within one month.

If you are unhappy with how your data has been handled, please tell your gym or us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or to the data protection authority in your country.

Children

Children are usually added by a parent or guardian as family members, rather than having their own account. The parent manages their details, including their photo. The gym is responsible for that data, and only staff whose roles allow it can see it. A parent can delete a child’s details from the app, or ask the gym to.

Changes to this notice

If we change how the app uses personal data, we will update this page and the date at the top.