Privacy policy

Last updated 7 October 2026

This policy explains what personal data RainBox handles, why, who sees it and what your rights are. RainBox is a mobile app for gyms and personal trainers and the people they coach.

Who we are

RAINBOX STUDIO LTD ("RainBox", "we", "us") is a private limited company registered in England and Wales, company number 17506726. Our registered office is 128 City Road, London, EC1V 2NX. You can reach us about anything in this policy at privacy@rainbox.me.

Our role, and your gym's

RainBox serves many gyms, and each gym keeps its own members, staff and records separate from every other gym.

• Your gym decides why and how its members' and staff's data is used for running the gym: your membership, bookings, check-ins, workout scores and orders. For that data your gym is the controller and we are its processor, acting on its instructions. If you have a question about how your gym uses your data, ask your gym first.
• We are the controller for your RainBox account and for running and securing the service: signing you in, protecting accounts, sending you the emails and notifications the app needs, and keeping the service working.

What we collect

What we handle depends on which features your gym uses.

• Account details: your email address and name, and the sign-in identifiers from the method you use (password, Google or Apple).
• Sign-in security: whether you have set up two-step verification, which is optional. We do not store your password; it is handled by our sign-in provider.
• Gym membership: which gyms you belong to, your role there (member, coach, owner and so on), and invitations you have received.
• Activity your gym records or you submit: class bookings, check-ins, workout scores and progress.
• Orders: what you buy from a gym's store. Card payments are handled by a payment provider; we do not store your card number.
• Messages and posts: messages between you and your gym's staff, and posts, comments and reactions in your gym's feed, if your gym uses these.
• Device and technical data: a push notification token if you allow notifications, your app version, and server logs, which include your IP address and the errors the app hits.
• Administrative records: a log of important administrative actions, such as changing someone's role. It records who did what and when, not the content of messages.

We do not sell personal data, and we do not use it for advertising.

Why we use it, and our legal basis

• To provide the service you or your gym signed up for (performance of a contract).
• To keep accounts and the service secure, prevent abuse and fix faults (our legitimate interests).
• To send push notifications, only if you allow them in your device settings (consent, which you can withdraw there at any time).
• To meet legal obligations, such as keeping certain records (legal obligation).

Who we share it with

We use a small number of service providers to run RainBox. They process data on our instructions.

• Google Cloud and Firebase host the service and provide sign-in, our database, real-time messaging and push notifications. Our main database is in London.
• Postmark sends the emails the app needs, such as email verification and invitations.
• Apple and Google deliver push notifications and, if you choose them, provide sign-in.
• A payment provider handles card payments for gym stores, where a gym uses them.
• Your gym sees the data it is responsible for, and its staff see what their role allows.

We may also disclose data if the law requires it.

Transfers outside the UK

Some providers, such as Postmark, process data outside the UK. Where they do, we rely on approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or on the UK's adequacy regulations.

How long we keep it

We keep your data while your account is active and your gym uses RainBox. When you delete your account, or ask us to, we delete your account data, including the messages you sent, and remove you from the gym's records. Copies in backups age out as the backups expire. We keep records we need for security or legal reasons, such as the administrative log, for as long as that purpose lasts.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct it if it is wrong;
• delete it;
• restrict how we use it, or object to a use based on our legitimate interests; and
• give you your data in a portable format.

Email privacy@rainbox.me from the address on your account. We reply within one month. If your request is about data your gym is responsible for, we may pass it to the gym, which must deal with it. See also Support for how to delete your account.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would like the chance to put it right first.

Children

RainBox is not intended for children under 13, and we do not knowingly collect their data.

Security

We encrypt data in transit, keep each gym's data separate from every other gym's at the database level, offer optional two-step verification, and limit who at RainBox can reach production data. No system is perfectly secure, and we will tell you and the regulator about a breach where the law requires it.

This website

This website does not use cookies, analytics or advertising trackers.

Changes

If we change this policy in a way that matters, we will update the date above and, where it affects how we use your data, tell you in the app or by email.