FormaCore Privacy Policy

1. Who We Are

FormaCore LLC (registration ID 405872854), registered at Georgia, Tbilisi, Zaza Panaskertel-Tsitsishvili Street, Building 1, Apartment 180 ("FormaCore," "we," "us," "our"), provides a multi-tenant Wellness & Leisure Management SaaS platform for gyms, fitness studios, spas, salons, and similar businesses ("Customers"), including an admin panel, a self-service Member Portal, and mobile applications (collectively, the "Service").

This Privacy Policy is interpreted in line with the Law of Georgia "On Personal Data Protection," and terms used here (Controller, Processor, Data Subject, Personal Data) carry the meaning given under that Law.

2. Two Relationships, Two Roles

FormaCore as Controller — for data about our Customers themselves (the businesses that sign up) and their staff users: account details, billing, support history. We decide how this data is used, for our own operational purposes.

FormaCore as Processor — for data about a Customer's own Members (gym-goers, clients), which the Customer submits to or generates on the platform. Here, the Customer is the Controller; we process this data only on their instructions, under the terms of our Data Processing Agreement (Annex to this policy).

If you are a Member of a business that uses FormaCore, that business is responsible for informing you how your data is used — please also check their own privacy notice.

3. What We Collect

From Customers directly: business and account registration details, staff user accounts, billing information, support correspondence.

Processed on behalf of Customers (Member data): Member profile data (name, contact details, date of birth, membership status), attendance/check-in records, payment and subscription history tied to memberships, data submitted via the Member Portal, and communications sent through the platform's email automation.

Collected automatically: usage and log data, device/browser information, and — once mobile apps are live — mobile-specific data described in Section 9.

AI-assisted features: certain features are supported by a third-party AI language-processing service. Interactions with these features may be processed by that provider strictly to generate the requested output; this data is not used to train external models beyond what a single request requires.

4. Why We Process It

To operate and maintain the Service; process subscription billing; provide support; send administrative communications; monitor security and performance; prevent fraud and abuse; and comply with legal obligations (including Georgian tax and accounting requirements). We do not sell Personal Data, and we do not use Member data for our own marketing purposes.

5. Legal Basis

Depending on the processing activity: performance of a contract with the Customer, our legitimate interests (security, fraud prevention, service improvement), your consent (e.g., direct marketing — see Section 8), or compliance with a legal obligation.

6. Who We Share Data With

• Infrastructure and service providers, currently: Railway and Hetzner (application/database hosting), Vercel (application hosting), Bank of Georgia and/or TBC Bank (card/bank payment processing — integration not yet live; cash payments are also accepted and are not processed through this channel), and Resend (email delivery for Member communications).
• Professional advisors (legal, accounting) as needed.
• Regulatory or law enforcement authorities where legally required.
• A successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent protections.

We do not sell or rent Personal Data to third parties for their own marketing purposes. A current subprocessor list is available on request or at www.formacore.io.

7. International Transfers

Where our infrastructure providers process data outside Georgia, we only do so where the destination country is recognized as offering an adequate level of protection, or where appropriate contractual safeguards are in place, consistent with the Law of Georgia "On Personal Data Protection."

8. Direct Marketing (Email)

Where a Member or Customer contact has agreed to receive marketing communications via email (sent through Resend), we process their name and email address for that purpose only. You may unsubscribe at any time using the link in any marketing email; we will stop processing your data for direct marketing purposes within 7 business days of your request.

9. Cookies and Tracking Technologies

Our marketing website uses cookies and similar technologies, including Google Analytics and/or similar analytics tools, to:

• Enable core site functionality (strictly necessary — set without consent, as they are required for the site to work)
• Analyze site traffic and usage patterns (analytics/performance — set only with your consent)
• Measure the effectiveness of marketing activity (functionality/advertising — set only with your consent)

Where required under the Law of Georgia "On Personal Data Protection," we obtain your consent via a cookie banner before setting non-essential cookies, and you may withdraw that consent at any time through your cookie settings or browser controls. Disabling certain cookies may affect site functionality. Analytics data collected through these tools is used in aggregate and is not linked to Member data processed within the Service itself.

10. Mobile Applications

FormaCore's iOS and Android applications (in development at the time of writing) are expected to request some or all of the following permissions, used only for the stated purpose:

• Camera — for QR-code check-in and profile photo capture
• Push notifications — for booking confirmations, reminders, and account alerts
• Device identifiers — for session security and app diagnostics

Device-level biometric login (Face ID / fingerprint), if offered, is handled entirely by the device operating system — FormaCore does not receive or store biometric data in this case. Before the apps go live, this section will be finalized to match the actual permissions requested, and a corresponding disclosure will be filed with Apple's App Store and Google Play as required.

11. Data Retention

• Customer account data is retained for the duration of the subscription and for a reasonable period afterward for legal, accounting, and dispute-resolution purposes, in line with Georgian statutory retention requirements.
• Member data is retained per the Customer's instructions. On termination, the Customer has 3 months to export their data before we delete or anonymize it, except where longer retention is required by law (e.g., financial records).
• Backup copies are purged on our standard backup rotation schedule following deletion from active systems.

12. Security

We apply technical and organizational measures designed to protect Personal Data, including encryption in transit, access controls limiting data access to authorized personnel, and secure hosting infrastructure. No system is guaranteed to be 100% secure.

13. Your Rights

Subject to the Law of Georgia "On Personal Data Protection," you may have the right to: obtain information about data processed about you; request correction, update, blocking, or deletion of your data; object to processing for direct marketing; and withdraw consent at any time. We aim to respond to such requests within 10 business days. If you are a Member, please first contact the business you are a member of, as they are the Controller for that data; if you are a Customer, contact us using the details in Section 15. You may also lodge a complaint with the Personal Data Protection Service of Georgia.

14. Minors

FormaCore accounts are intended for business use by adults. FormaCore's Services are not directed at, and we do not knowingly collect data directly from, individuals under 18 for account-holder purposes. Where a Customer's own business involves minors (e.g., youth sports programs), the Customer is responsible as Controller for obtaining any necessary parental/guardian consent for that Member data.

15. Changes to This Policy

We may update this Privacy Policy from time to time; the current version is always available on our website, with the "Last Updated" date reflecting the most recent revision. Material changes will be communicated to Customers via email or in-app notice where appropriate.

16. Contact

FormaCore
Georgia, Tbilisi, Zaza Panaskertel-Tsitsishvili Street, Building 1, Apartment 180
Email: info@formacore.io