Privacy Policy

We collect information you provide when you create an account or use our platform. This includes: • Personal information: name, email address, phone number, business name • Billing information: payment method details (processed securely via Square, Stripe, or Interac — we do not store raw card numbers) • Usage data: how you interact with the platform, features used, session timestamps • Member data you upload: names, contact details, membership plans, and check-in records for your gym members We also collect technical information automatically, including IP address, browser type, device identifiers, and pages visited.

We use the information we collect to: • Provide and improve the Tollana platform and its features • Process payments and manage subscriptions • Send transactional emails (receipts, renewal notices, feature updates) • Provide customer support and respond to inquiries • Analyze usage patterns to improve product performance • Comply with legal obligations and enforce our Terms of Service We do not sell your personal information or your members' data to third parties.

All data is stored on servers located in Canada. We use industry-standard encryption (TLS 1.3) for all data in transit and AES-256 encryption for sensitive data at rest. We maintain SOC 2-aligned security practices, including access controls, audit logging, and regular security reviews. Our payment integrations with Square and Stripe are PCI-DSS compliant. In the event of a data breach that poses a risk to your information, we will notify you within 72 hours in accordance with PIPEDA requirements.

You (the gym owner) are the data controller for your members' personal information stored in Tollana. We process this data on your behalf as a data processor. You are responsible for obtaining appropriate consent from your members to collect and process their data. Tollana provides you with tools to manage member data, including deletion and export capabilities. We do not use your members' data for any purpose other than providing the platform services to you.

We share your data with third parties only as necessary to provide our services: • Payment processors (Square, Stripe) to process transactions • Cloud infrastructure providers (hosting and database services) • Email delivery services for transactional emails • Analytics services to understand platform usage (anonymized) All third-party providers are contractually bound to protect your data and may not use it for their own purposes.

We retain your account data for the duration of your subscription. Upon cancellation, we retain data for 30 days to allow for re-activation, after which it is permanently deleted unless you request earlier deletion. You may export all your data at any time from your account settings. Member data exports include all profiles, payment history, and check-in records.

As a Canadian business serving Canadian customers, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to: • Access the personal information we hold about you • Correct inaccurate information • Withdraw consent for non-essential data processing • Request deletion of your account and associated data • File a complaint with the Office of the Privacy Commissioner of Canada To exercise these rights, contact us at privacy@tollanagym.com.

We use essential cookies to maintain your session and authentication. We do not use third-party advertising cookies or tracking pixels. Analytics cookies (anonymized, no personally identifiable information) help us understand how the platform is used. You can opt out of analytics cookies in your account settings.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email at least 14 days before they take effect. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related questions or requests: Privacy Officer, Tollana Inc. Email: privacy@tollanagym.com Phone: +1 (416) 555-0100 Address: Toronto, Ontario, Canada