The short version: We collect only what we need to run the service. We do not use tracking cookies, advertising pixels, or third-party analytics. We do not sell your data. We do not share it with anyone except the payment processor and the infrastructure providers who host the service. You can request deletion of your data at any time.
Data controller: KN Software & Services B.V.
Registered address: Veluwezoom 5, 1327AA Almere, the Netherlands
Contact: support@punchcard.online
This policy applies to two categories of people who interact with Punchcard:
If you are a Client reading this, your Trainer is primarily responsible for how your data is entered into Punchcard. We process that data on their behalf as a data processor. This policy explains what we do with that data at the infrastructure level.
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| Email address | Account identification and magic link authentication | Contract performance (Art. 6(1)(b)) |
| Name and role label | Displayed to clients on their session view | Contract performance (Art. 6(1)(b)) |
| Client names | Identifying clients within the Trainer's account | Contract performance (Art. 6(1)(b)) |
| Session records | Core function of the Service — tracking session balances and history | Contract performance (Art. 6(1)(b)) |
| Subscription and billing data | Managing paid plan access. Payment details are held by Paddle, not us. | Contract performance (Art. 6(1)(b)) |
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| IP address and HTTP request metadata | Security, abuse prevention, and aggregate traffic analysis via nginx access logs and Plausible Analytics | Legitimate interest (Art. 6(1)(f)) |
| Session tokens | Keeping Trainers logged in securely | Contract performance (Art. 6(1)(b)) |
| Client link access timestamps | Powering the "last seen" indicator on the Trainer's client list | Contract performance (Art. 6(1)(b)) |
We do not use tracking cookies, advertising pixels, or fingerprinting technologies of any kind. We do not collect payment card details — these are handled entirely by Paddle. We do not collect phone numbers, physical addresses, dates of birth, or any health or fitness data about clients. We do not build advertising profiles. We do not use Google Analytics, Meta Pixel, or any third-party behavioural analytics service.
We use Plausible Analytics for website and application usage statistics. Plausible is a privacy-first analytics tool that does not use cookies, does not collect personal data, and does not track individuals across sessions or websites. All analytics data is aggregated and anonymised. Plausible is self-hosted on our own infrastructure — data does not leave our servers.
We also analyse nginx web server access logs for security monitoring and performance purposes. These logs contain IP addresses and are retained for 30 days before automatic deletion.
Punchcard uses a single session cookie to keep Trainers authenticated. This cookie is strictly necessary for the operation of the Service and does not track you across other websites. It is deleted when you log out or when your session expires.
We do not use analytics cookies, advertising cookies, or any third-party cookies. No cookie consent banner is required because we use no cookies that require consent under applicable law.
We use the data we collect solely to:
We do not use your data for advertising, profiling, or any purpose beyond what is necessary to operate the Service.
We do not sell, rent, or trade your personal data. We share data only with the following categories of third parties, and only to the minimum extent necessary:
Paddle.com Market Limited processes all subscription payments as Merchant of Record. When you subscribe to a paid plan, Paddle collects your payment details and billing information directly. We receive only a subscription status confirmation — we never see or store your payment card details. Paddle's privacy policy is available at paddle.com/legal/privacy.
Your data is hosted and processed on servers operated by the following providers, all under data processing agreements:
All primary data storage is located within the European Economic Area. Backups are encrypted before transmission and storage.
Transactional emails (magic links, subscription notices) are delivered via Brevo SAS (primary) and Mailjet SAS (backup), both headquartered in Paris, France and operating within the EU. Only your email address and the content of the specific email being sent are shared with these providers for the sole purpose of delivering that message. Both are subject to GDPR. Their privacy policies are available at brevo.com and mailjet.com.
We retain your data for as long as your account is active. When you close your account:
We do not retain anonymised or aggregated versions of your personal data after deletion.
We take reasonable technical and organisational measures to protect your data, including:
No method of transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR.
If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at support@punchcard.online. We will respond within 30 days. We may need to verify your identity before processing certain requests.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the UK, this is the Information Commissioner's Office (ico.org.uk).
Your data is stored and processed within the European Economic Area. Where any third-party service providers are located outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, before transferring any personal data.
The Service is intended for use by professionals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Contact us at support@punchcard.online
KN Software & Services B.V. · Veluwezoom 5, 1327AA Almere, the Netherlands