سياسة الخصوصية Privacy Policy

1. Whose data do we store?

• Gym owners/admins/staff: name, email, mobile, password (hashed), permissions.
• Members (consent required): name, mobile, national ID (optional), birth date (optional), photo (optional), subscriptions and payments, check-in times.
• Technical info: IP address, browser type, device type (to prevent account sharing), login times.

2. Why we store it

• To run the Service (manage subscriptions, calculate payments, print reports).
• To secure accounts (detect breach attempts, prevent account sharing).
• To improve the product (anonymized usage statistics).
• To meet legal obligations (financial records kept 5 years per Egyptian law).

3. Where we store it

All data lives on Google Cloud servers in Frankfurt (EU). The servers comply with ISO 27001 + SOC 2.

4. Who can see it

• The gym owner and their team: can only see THEIR gym — no gym can see another gym's data (architectural multi-tenant isolation).
• The member: sees their own profile and subscription history in the member app.
• Us (Way Soft Pro): staff cannot access gym data except for technical support (at the customer's request), security incidents, or formal court order. Every access is logged in the audit log.
• Third parties: Google Cloud (infrastructure), Firebase (Auth + Storage), Paymob/Fawry (payment gateway — only payment-related data).

5. Your rights (GDPR)

• Right of access: request a full copy of your data as JSON/SQL.
• Right to correction: update any incorrect data at any time.
• Right to deletion: request account deletion from account settings (processed after a 30-day cancellation window).
• Right to object: stop processing of your data for non-essential purposes (analytics, marketing).

6. Cookies

• Essential cookies: for login and session — cannot be disabled.
• Analytics cookies (Firebase Analytics): help us understand site usage. Anonymized. You can disable them in your browser settings.
• No marketing or advertising cookies.

7. Retention

• Active member data: for membership duration + 30 days after termination.
• Financial records (payments/reports): 5 years (legal/tax obligation).
• Login + security logs: 2 years.
• Trial accounts that don't convert: deleted after 30 days.

8. Security

• Encryption in transit (HTTPS) and at rest (Google Cloud encryption-at-rest).
• SCRYPT password hashing.
• Role-Based Access Control (RBAC) — each staff sees only what they need.
• Audit log for all sensitive operations.
• 2FA available for admins (optional now, becoming mandatory soon).

9. Children

The Service is intended for gym owners. If members are children (under 13), the gym owner is responsible for obtaining parental consent before registration.

10. Contact

Privacy questions or requests: privacy@waysoftpro.com. We respond within 72 hours.