Privacy Policy

Introduction

BrightCore (“we,” “our,” or “us”) is operated by BXF IRELAND LIMITED, a company registered in Ireland. We provide the BrightCore booking and membership platform, which includes the member mobile app, the branded member apps we publish for individual businesses, the business owner admin dashboard, and the public booking website.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use any part of the BrightCore platform. It applies to members, business owners, staff, and visitors to our websites.

By using BrightCore, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as a legal basis, we will obtain your explicit consent before processing your data for that purpose.

Apps and Sites Covered by This Policy

This policy applies to every app and site we operate on the BrightCore platform:

• The BrightCore member app for iOS and Android
• Branded member apps. Many businesses publish the member app under their own name, icon, and colours. A branded app is the same BrightCore member app, published and operated by BXF IRELAND LIMITED, and this policy covers it in full. If you downloaded an app from your gym, studio, salon, or wellness centre and it is powered by BrightCore, you are reading the right policy.
• The business admin dashboard at app.brightcore.ie, used by business owners and staff
• Public booking sites on brightcore.ie subdomains and on custom domains connected to them

Whichever of these you use, the data practices described below are the same. Your business manages its own membership records inside the platform, as set out under Information Sharing.

Information We Collect

Personal Information

• Name: For account creation, class bookings, and membership
• Email address: For account management, booking confirmations, and communications
• Phone number: For account verification and optional WhatsApp notifications
• Date of birth: Optional, for age verification and birthday communications

Health & Safety Information

• Medical notes: Health information you provide for safe class participation
• Waiver signatures: Digital signature data, IP address, and timestamp when you sign liability waivers

Financial Information

• Payment details: Processed securely by Stripe. We never store your card information
• Transaction history: Records of purchases, bookings, and refunds
• Subscription data: Current plans, billing cycles, and credit balances

Apple Pay and Google Pay

Where your business enables it, you can pay in the app with Apple Pay or Google Pay. These are payment methods presented by your device, and they work as follows:

• We never receive your card number. Your device passes a payment token to Stripe, our payment processor. Neither BrightCore nor your business ever sees or stores your real card number, its security code, or the Device Account Number held on your device.
• What we receive from Stripe is the outcome of the payment, the amount and currency, the card brand and the last four digits Stripe reports, and the payment identifier. We use these to confirm your booking or subscription, issue your receipt, and handle refunds and disputes.
• Billing contact details that the payment sheet collects, such as your name and, where the payment requires it, your email address, phone number, or billing address, are passed to Stripe to complete the payment and are stored against the transaction for accounting and tax records.
• Apple and Google do not receive your booking data from us. How they handle the payment credential stored on your device is governed by their own privacy policies, not this one.
• We do not use Apple Pay or Google Pay data for marketing, profiling, or advertising, we do not share it with your business beyond the transaction record described above, and we never sell it.
• Deletion. We store nothing on your device for these payment methods. The transaction records we hold follow the periods set out under Data Retention, and you can request erasure as described under Your Rights Under GDPR.

Activity Information

• Bookings & check-ins: Class reservations, attendance, and cancellations
• Waitlist entries: Classes you have joined the waitlist for
• Class reviews: Ratings and feedback you submit
• Last active timestamp: When you last used the platform

Device & Technical Information

• Push notification tokens: To send you booking reminders and updates
• QR codes: Generated for entry verification
• Wallet pass IDs: Apple Wallet or Google Wallet pass identifiers, if you add your membership pass
• IP address & user agent: For security, fraud prevention, and waiver verification

Communications

• In-app messages: Messages between you and your business
• Email threads: Support and notification emails

Optional / Opt-in Services

The following data is only collected if your business enables these optional features:

• Marketing attribution: If your business uses Meta Pixel, TikTok Pixel or Google Ads tracking, we may collect click identifiers (fbclid, ttclid, gclid), the advertising platform’s browser cookie (such as Meta’s _fbp or TikTok’s _ttp) and UTM parameters to measure ad performance. When you book or buy, a hashed (SHA-256) copy of your email address and phone number may be sent to that platform with the booking so it can match the sale to the ad; the platform never receives them in readable form
• Connected TikTok account: If a business connects its own TikTok account, we receive read-only information about that account: its display name, username and profile picture, its follower, like and video counts, and the view, like, comment and share counts of its public videos. We use this only to show the business its TikTok performance on its BrightCore dashboard. We never post to, or change anything on, the account, and the business can disconnect at any time, which revokes our access
• WhatsApp messages: If your business enables WhatsApp reminders (via Meta WhatsApp Business API), your phone number and message history are processed to deliver appointment reminders and booking notifications
• AI assistant conversations: If your business uses the Coral AI assistant (powered by Anthropic Claude), anonymised business data may be processed to generate insights and respond to business owner queries
• AI coach: If your business turns on the AI Coach, what you tell the coach in the app (your goals, schedule, training history, injuries you mention, bodyweight and eating habits) is stored with your account and processed by Anthropic Claude to build and adjust your training program. Your business’s staff can see the program it makes

Google Calendar and Outlook

Staff can connect their Google Calendar so their appointments appear in it and so bookings are not offered at times they are busy. Members can connect their Google Calendar so their planned training sessions appear in it. The same applies to Outlook and Microsoft 365 calendars, which connect through Microsoft sign-in instead of Google. Connecting is always optional, and you can disconnect at any time in the app, at myaccount.google.com/connections for Google, or at account.microsoft.com (or your organisation’s My Apps page) for Microsoft, which revokes our access.

• What we access: permission to create, change and delete events on the calendars you own, and, for staff, to see when you are busy (free/busy times only) so we do not double-book you. We only create, change or delete the events we add for your appointments or training sessions. We do not read the titles, descriptions or attendees of your other events
• What we store: the access tokens Google gives us, encrypted, and the IDs of the events we created, so we can update or remove them. Disconnecting deletes the tokens
• What we never do: we do not sell Google user data, use it for advertising, share it with anyone except as needed to provide this feature, or use it to train AI models. Our staff do not read it

BrightCore’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contractual necessity: Processing required to provide our services to you, including managing your account, processing bookings, handling payments, and fulfilling subscriptions
• Legitimate interest: Processing necessary for our legitimate business interests, including platform security, fraud prevention, service improvement, and analytics, where these interests do not override your rights
• Consent: Where we rely on your consent, including marketing communications and optional services such as WhatsApp notifications, AI assistant features, and ad conversion tracking. You may withdraw consent at any time
• Legal obligation: Processing required to comply with legal requirements, including financial record-keeping and tax compliance under Irish law

How We Use Your Information

We use your information to:

• Provide class booking and membership management services
• Send booking confirmations, reminders, and schedule changes
• Process payments and manage subscriptions through Stripe
• Manage your credit balance and subscription entitlements
• Generate QR codes for entry verification
• Send push notifications about bookings, waitlist updates, and announcements
• Generate Apple Wallet or Google Wallet membership passes (if you opt in)
• Send WhatsApp appointment reminders and booking notifications (if your business enables this)
• Provide AI-powered business insights to business owners (if your business enables Coral)
• Measure advertising effectiveness through conversion tracking (if your business enables this)
• Improve and maintain the platform
• Provide customer support
• Ensure account security and prevent fraud
• Comply with legal obligations

Information Sharing & Third Parties

Protection by the third parties we share data with

Every third party listed above, including analytics tools, advertising services, and the software libraries built into our apps, is bound by a written data processing agreement that requires them to provide the same or equal protection of your personal data as this policy sets out. They may process your data only on our documented instructions and only for the purpose we engaged them for, they may not use it for their own purposes, and they must apply appropriate technical and organisational security measures.

The same commitment applies to any parent, subsidiary, or related entity of BXF IRELAND LIMITED that has access to your data.

International Data Transfers

Your data is primarily stored and processed within the European Union on Railway's EU infrastructure.

Some of our service providers (including Stripe, Anthropic, Apple, and Google) may process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, including:

• EU Commission adequacy decisions for the receiving country
• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Binding corporate rules of the service provider

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained while your account is active, and for 30 days following a deletion request to allow for recovery
• Financial records: Retained for 6 years as required by Irish tax law (Taxes Consolidation Act 1997)
• Booking history: Retained for reporting and analytics purposes while your account is active
• WhatsApp messages: Retained for 90 days, then automatically deleted
• AI assistant conversations: Retained for 30 days, then automatically deleted
• Connected TikTok account: Access tokens are deleted as soon as the business disconnects; the account statistics already collected are kept for the business’s reporting until the business deletes its BrightCore account

Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

• All payment processing is handled by Stripe using industry-standard encryption
• All data is transmitted over secure encrypted connections
• Passwords are securely hashed. We never store plaintext passwords
• Data is isolated per business. Each business can only access its own members' data
• Role-based access controls restrict what staff and owners can view and modify
• Regular security updates and monitoring

Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to restrict processing: Request that we limit how we use your data
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at support@brightcore.ie. We will respond to your request within 30 days.

If you are unsatisfied with how we handle your request, you have the right to lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie.

Children's Data

BrightCore is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete that information promptly.

Contact Us

Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify users of significant changes through:

• Push notifications in the app
• Email notifications to your registered address
• Updates posted on this page with a new “Last updated” date