GreetRep

Privacy Policy

Last updated 18 October 2026.

GreetRep is a sole-trader business based in Dublin, Ireland. This policy covers the website at greetrep.com and the receptionist service gyms use. The contact for privacy requests is hello@greetrep.com.

No company number, registered office, or other legal name is stated here. Those details are not published until a solicitor has reviewed them.

Who decides, and who processes

GreetRep has two roles.

• Controller for the gym owner's account: the email address, the gym details the owner types in, login codes, and how the owner uses the product.
• Processor for each gym. The gym decides why its website visitors, enquirers, and social-message senders are contacted. GreetRep stores and answers those people only on the gym's instructions, including the details the gym saved and the Data Processing Addendum.

If you chatted with a gym, write to that gym first. They are the controller of that conversation. You can also email hello@greetrep.com and we will help, including by passing the request to the gym.

What we collect

Gym owners

• Name and email address, from the pilot form or when you create the gym.
• Gym details you save: name, town, address, phone, website text, classes, prices, questions, booking links, and handoff contacts.
• Login codes. We store a salted hash of the code, not the code itself. The code expires after 10 minutes.
• A session so you stay signed in, and a short record of which setup steps you opened.
• If you connect them: a PushPress company id and an encrypted API key, a Zapier hook address, and booking-page addresses.

Website visitors and enquirers

• Chat messages.
• Name, email, phone, and the class they asked about, after they reply YES to the consent question in the chat.
• The time they agreed, stored on the conversation.
• A salted hash of a visitor cookie, so the same browser can continue one chat. We do not store the raw cookie value.

Meta channels, when a gym turns them on

See the Meta section below. Until a gym connects a Page, we do not receive Facebook, Instagram, or WhatsApp messages.

Why we use it, and the lawful basis

• To create the owner account and run the pilot: contract, Article 6(1)(b).
• To keep logins safe (codes, session, rate limits): legitimate interests, Article 6(1)(f). The interest is stopping someone else signing in as the owner.
• To answer a visitor and, if they agree, send their details to the gym: the gym's legitimate interest in replying to an enquiry, and the visitor's request before a trial. The chat asks for YES before a name or contact detail is taken. That agreement can be withdrawn by emailing the gym or hello@greetrep.com.
• To send the owner their own login code, lead alerts, and the weekly report they asked for: contract.
• To meet a legal request: legal obligation, Article 6(1)(c).

We do not sell personal data. We do not use it for advertising. We do not ask for health information. If a visitor mentions an injury, the chat stops and hands the conversation to the gym. It does not give advice.

A testimonial is not published unless the owner ticks the consent box, and not automatically even then.

Meta Platform data

This section is for Facebook, Instagram, and WhatsApp, and only after a gym connects them.

• What we access. The Facebook Page id and name, the linked Instagram account id, a WhatsApp phone-number id if Meta returns one, and an access token. The token is stored encrypted. When someone messages the gym, we receive their Page-scoped id, Instagram-scoped id, or WhatsApp id, and the text of the message.
• What we use it for. Only to answer that gym's messages, inside Meta's messaging window. The text may be sent to Cloudflare Workers AI so a reply can be drafted from the gym's saved details.
• What we do not do. We do not sell Meta data. We do not use it to show ads, to build advertising profiles, or to train a public model. We do not use it for any gym other than the one that received the message.
• Disconnect. When the gym disconnects in setup, we delete the stored tokens and the messages we kept for that connection.
• Deletion request. Anyone can ask Meta to delete their data, or email hello@greetrep.com. The callback at /meta/data-deletion removes messages stored for that Meta user id. See how to ask for deletion.

How long we keep it

These are the periods the product actually uses.

• Login code. It stops working after 10 minutes. We keep the row (email, salted hash, attempt count, and a salted hash of the IP address) until the owner account is deleted. A daily job does not wipe old codes.
• Owner session. The sign-in cookie and the session row last 30 days. When the account is deleted, the session is deleted with it.
• Chat, leads, gym details, emails we logged, feedback, and Meta messages. Kept while the gym account exists.
• Cancel. The chat switches off immediately. A daily job at 03:15 UTC hard-deletes that gym's data 30 days after cancellation. The owner can download a copy until then. A deletion log keeps the gym id and the time, not the name or the messages.
• Delete my account. Settings deletes the gym, chats, leads, and tokens immediately.
• Meta deletion callback. Messages stored for that Meta user id are deleted when the signed request arrives. An email request is finished within 30 days.
• Pilot form for someone who has not created a gym: kept until we delete that row. If they later create a gym, it is deleted with the account.
• Rate-limit counters are hourly buckets, not a named profile.

Cancelling or deleting GreetRep does not delete anything already sent to the gym's booking software, PushPress, Zapier, or Meta.

Who else handles it

• Cloudflare, including Workers, Workers AI, and D1. The app and the database run there, and Workers AI drafts replies when that binding is on.
• Resend, to send login codes, lead alerts, and owner emails from hello@greetrep.com. Login-code email bodies are not stored in our log unless a private development switch is on. That switch is not used on the live site.
• When a gym turns them on: Meta (Facebook, Instagram, WhatsApp), PushPress, Zapier, and the gym's own booking platform. We send only what that connection needs, such as a lead or a reply to a message the gym received.

International transfers

GreetRep is in Ireland. Cloudflare, Resend, and Meta may process data in the United States and other countries. Where those providers offer them, the transfer uses the EU-US Data Privacy Framework and standard contractual clauses. PushPress, Zapier, and a booking platform are the gym's choice. Their location depends on the tool the gym connected.

People in the UK have the same rights described here. UK transfers rely on the UK extension to the Data Privacy Framework or the UK addendum to the standard contractual clauses, where the provider offers them.

Security

Sessions and API keys are stored as hashes or as encrypted values, not as the raw secret. Login codes are salted hashes. Pages are sent over HTTPS on the live site. Access to the owner area needs the emailed code. No method is perfect. Email hello@greetrep.com if you think an account is at risk.

Your rights

You can ask for a copy of your data, a correction, deletion, a limit on how it is used, a portable copy, or to object. Where we rely on consent, you can withdraw it. You can also complain to a supervisory authority.

Email hello@greetrep.com. Owners can download a JSON copy at Settings and can delete the account there. Visitors can ask the gym, or ask us and we will deal with it within 30 days. We may need to confirm it is you before we delete or send a copy.

Ireland: the Data Protection Commission. United Kingdom: the Information Commissioner's Office.

Cookies

We do not use advertising or analytics cookies. Every cookie below is first-party, httpOnly, and used to run the product.

• gr_session, 30 days. Keeps a gym owner signed in. Essential.
• gr_verified, 10 minutes. Set after a login code is accepted, so the same browser can finish creating the gym. Essential.
• gr_meta, 10 minutes. Holds the Meta login state while a gym connects a Page. Set only during that connection. Essential.
• gr_vid, 30 days. A random id so one browser keeps one chat. We store a salted hash of it, not the cookie itself. Essential for the chat.
• gr_ref, 60 days. Set only if you open a link that contains a referral code. It stores that code so a later signup can be attributed. It is not used for ads.

Children

GreetRep is not directed at anyone under 16. Gym-owner accounts are for adults running a gym. A parent or guardian may use a gym's chat to ask about a children's class. We do not knowingly create an owner account for a child. If you believe we have, email hello@greetrep.com and we will delete it.

Changes

If this policy changes, we will post the new version on this page and change the date above. The current version took effect on 18 October 2026.

Home · Privacy · Terms · Data processing · Delete data · Gym login