Last updated: September 26, 2026
ZX Consulting LLC, EIN 37-2131941, registered address at 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110 (USA), operates Trainbay (the "Platform") under that trade name. Contact for data protection matters: contact@trainbay.app.
Who is responsible for which data depends on whose data it is:
From the trainer (Platform user):
From the trainer's contacts and clients:
The following providers are used, under a data processing agreement:
Data is never sold or shared with third parties for advertising purposes.
Trainbay is operated by a US entity, and some of the providers listed above (such as Anthropic) process data outside the European Economic Area. Where this happens, it is covered by the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) or another transfer mechanism recognized under the GDPR, incorporated by reference into the Data Processing Addendum.
Trainbay integrates with products of Meta Platforms, Inc. — the WhatsApp Business Cloud API, the Instagram API with Instagram Login (Graph API), and Facebook Login for Business — so that a trainer can receive and reply to leads that message them on WhatsApp or Instagram (direct messages, story replies, or comments) directly inside Trainbay. On Instagram, this uses the permissions instagram_business_basic, instagram_business_manage_messages, and instagram_business_manage_comments — Trainbay does not request public_profile, email, pages_show_list, business_management, or ads_management, and has no consumer "Login with Facebook" flow.
Through these integrations we receive: the sender's phone number (WhatsApp) or Instagram user ID and username (Instagram), their profile name where available, and the content of the messages they send. This data is stored as part of that person's contact record and conversation history in Trainbay, exactly like any other channel described in section 2 — it is used only to let the trainer (and, on their behalf, the AI assistant described in section 3) see and reply to that conversation. It is never used for advertising, never sold, and never shared with Meta beyond what is technically required to send and receive messages through their API.
A trainer can disconnect their WhatsApp or Instagram account from Trainbay at any time from Meta Business Suite or their Instagram account settings; Trainbay receives an automated notification from Meta when this happens (our deauthorize callback). See our Data Deletion Instructions for how to request deletion of data obtained this way.
A trainer can optionally connect their Google Calendar so that busy times already in their calendar block availability on their Trainbay booking page, and so that each new booking is added to their calendar. For this, Trainbay requests only two permissions: calendar.freebusy (to know which time ranges are busy, without reading event titles, descriptions, or attendees) and calendar.events (to create the event for a booking made on Trainbay).
The data received from Google is used only to provide that feature to the trainer who connected their calendar. It is not used for advertising, not sold, not used to train AI models, and not shared with anyone except as needed to provide the feature or as required by law. Trainbay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The trainer can disconnect their calendar at any time from Bookings → Public page in Trainbay, or revoke access from their Google Account (Security → Third-party apps). The stored access credentials are then deleted.
Data is retained for as long as the relationship with the trainer or client lasts, and afterward for as long as needed to meet legal obligations. Progress photos and the meal log are deleted when the client's account is closed, or at their request.
Anyone can exercise their rights of access, rectification, erasure, objection, restriction, and portability by writing to contact@trainbay.app. For a client's data, the request should first be directed to their trainer (who is the controller of that data, see section 1); Trainbay cooperates with them to handle it. Clients can also request deletion of their account from within the app ("My account" section). If you believe your rights have not been addressed, you can lodge a complaint with the data protection authority in your EU country of residence.
Access to data is restricted at the database level (each trainer only sees their own data; each client only sees their own data). Photos are stored in private storage with temporary, signed links. Passwords are stored encrypted.
Trainbay does not use tracking or advertising cookies. It only stores, in the browser, the session token needed to keep you signed in.