Privacy Policy

Effective date: 20 October 2026 · Replaces the version of 15 May 2025

1. Who we are

CRMEXPERT is a cloud platform for fitness clubs, studios and wellness businesses. It includes the CRMEXPERT web system for club staff and the mobile apps that clubs provide to their clients. CRMEXPERT is operated by SRL TELSYSTEMS, IDNO 1013600012390, Republic of Moldova ("we", "us").

2. Our role

We license our software to organizations such as fitness clubs ("Clubs"). A Club decides what data about its clients and staff it keeps in CRMEXPERT. For that data the Club is the controller, and we process it on the Club's behalf and only to provide the service.

For data we collect for our own purposes — for example, the accounts of Club representatives who contact us, and technical data needed to run and secure our apps — we are the controller.

3. Data we collect

  • Mobile app users (Club clients): first name, last name, phone number, and data related to your membership, bookings and visits at the Club.
  • Club staff using the web system: name, email, phone number and role.
  • Data entered by Clubs: client profiles, memberships, visits, bookings, payments and notes.
  • Messaging data: when a Club connects its own Facebook Page, Instagram professional account or WhatsApp Business account to CRMEXPERT, we receive messages sent to that account, the sender's platform ID, name, username and profile picture, attachments, and delivery and read statuses, and we send the replies written by the Club's staff.
  • Technical data: device model, operating system, IP address, app version, crash reports and usage events.

4. Why we use data

  • Registration and sign-in to the apps.
  • Providing app features: memberships, class bookings, check-in, notifications, sales and client management.
  • Communication between the Club and its clients, including the messaging inbox.
  • Support, analytics to improve the apps, and security.
  • Compliance with legal obligations.

5. Data from Meta platforms (Facebook, Instagram, WhatsApp)

Data received through Facebook, Instagram and WhatsApp APIs is used only to provide the messaging feature to the Club that connected the account: to display conversations in the Club's inbox, send replies on the Club's behalf, and let staff link a conversation to a client profile.

  • Each Club sees only the conversations of the accounts it connected.
  • We do not sell, rent or share this data with third parties.
  • We do not use it for advertising, profiling, or training machine learning models.
  • We follow the Meta Platform Terms and Developer Policies.

6. Third-party services

To run the apps we use the following services, which process data under their own privacy policies:

  • Google Firebase (Authentication, Cloud Messaging, Crashlytics) — sign-in, push notifications, crash reports.
  • Google Analytics for Firebase — app usage analytics.
  • Meta Platforms (Facebook, Instagram, WhatsApp) — only when a Club connects its messaging accounts.
  • Hosting and infrastructure providers — servers on which CRMEXPERT runs.

7. Legal basis

We process data to perform our contracts with Clubs and to provide the apps to their clients, to comply with legal obligations, on the basis of our legitimate interest in operating and securing the service, and, where required, on the basis of your consent. We comply with Law of the Republic of Moldova No. 133/2011 on personal data protection and, for people in the European Union, with the GDPR.

8. Storage and security

Data is stored on protected servers and handled in accordance with applicable law and our contractual obligations. Access tokens for connected social accounts are stored encrypted. Access to data is limited to staff who need it to provide support, under confidentiality obligations.

9. Retention

  • Club data is kept for the duration of the contract with the Club and deleted or returned to the Club after it ends, unless the law requires longer storage.
  • When a Club disconnects a Facebook, Instagram or WhatsApp account, we stop receiving data from it and delete the stored access token. Message history is deleted on the Club's request or at the end of the contract.

10. Sharing

We do not transfer personal data to third parties, except to the services listed in section 6 as needed for the apps to work, or where required by law.

11. Your rights

You can request information about your data, its correction or deletion, restriction of processing or a copy of it, and you can object to processing or withdraw your consent. If your data was entered by a Club, we will forward your request to that Club or act on its instructions. You can also lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova or with the data protection authority in your country.

To request deletion of data received from Facebook or Instagram, see Data Deletion.

12. Changes

We may update this policy. The current version is always published on this page with its effective date.

13. Contact

SRL TELSYSTEMS, Republic of Moldova. Email: privacy@crmexpert.md.