Privacy policy
Last updated: November 1, 2026
1. Data controller
ELOHI, a French simplified joint-stock company (SAS), is the controller of the personal data processing described in this policy, for the elohi.fitness website, the member area it hosts, the emails sent from it, and the running of the studio, customers and staff.
Company details
- Company name
- ELOHI SAS
- Trade register
- 922 246 962 RCS Paris
- Registered office
- Bureau 326
- 59 rue de Ponthieu
- 75008 Paris
- Personal data contact
- direction@elohi.fr
2. Data collected
Only the data a person enters, and the data the service produces while serving them, is collected. No data is bought or matched with an outside source. By journey:
By journey
- Waiting list, on the home page
- First name, last name, email address, phone number, and the language of the form. All four fields are required: without them, the sign-up is not recorded.
- The consent text shown under the button, its version and the date of the click.
- A customer record is created at sign-up with these details, to prepare the first booking.
- Account and first login
- The login email address. First name, last name and phone, entered at the first login.
- Postal address and date of birth are entered at the studio only, never online.
- Display language, the choice of session reminders and the choice of marketing emails.
- Bookings
- The session, the machine, the booking date, any cancellation, attendance or absence.
- The first and last name of a guest, entered by the member who invites them.
- Purchases
- The product, the amount, the payment method, the date, and the payment reference at the payment service.
- No card number is received or kept by Elohi.
- Login
- A login link is sent to the email address. With Google sign-in, the identity of that Google account is received from the authentication service.
- Traffic statistics
- Without cookies: the page viewed, the referring page, country, region and city, device type, browser and operating system, tied to a request fingerprint discarded after 24 hours.
- With Google Analytics, after acceptance only: page views and visit activity (first visit, session start and duration), tied to a browser identifier set by a cookie, plus the IP address of the connection, which Google says it does not store. The address sent carries no query string and no fragment.
- Form protection
- A fingerprint of the IP address, hashed with a secret key and the current ten-minute window, limits repeated submissions. It cannot be reversed to the address, and is erased by the first submission after the window.
- Technical logs
- The hosting provider keeps request logs, IP address included, for the security and operation of the service.
3. Purposes and legal bases
Why, and on what basis
- Waiting list and newsletter
- Letting people know about the opening, sending the studio's news, preparing the first booking.
- Legal basis: consent, withdrawn at any time through the link in every email.
- Account, bookings, purchases
- Opening and keeping the account, booking, taking payment, reminding of a session.
- Legal basis: performance of the contract.
- Invoicing
- Keeping the accounts and the supporting documents.
- Legal basis: legal obligation.
- Cookie-free statistics
- Knowing the site's traffic, in aggregate, without identifying anyone.
- Legal basis: legitimate interest. Objection by email, at the address below.
- Google Analytics
- Measuring the site's traffic with cookies.
- Legal basis: consent, given with "Accept" on the cookie bar and withdrawn with "Manage cookies".
4. Recipients and processors
Data is shared only with the providers that run the site, each for what it does, and is never sold. Every transfer outside the European Union relies on the Data Privacy Framework or on the European Commission's standard contractual clauses, depending on the provider.
Processors
- Vercel Inc., United States
- Hosting of the site and execution of its code, in Paris. Cookie-free traffic statistics.
- Data Privacy Framework certified; standard contractual clauses in its data processing agreement.
- Supabase Pte. Ltd, Singapore
- Database and login, by link or by Google account. Data is hosted in Paris, on Amazon Web Services.
- Standard contractual clauses.
- Resend (Plus Five Five, Inc.), United States
- Email delivery, sent from the European Union. Email content and delivery logs are kept in the United States for 30 days.
- Data Privacy Framework certified; standard contractual clauses.
- Stripe Payments Europe, Limited, Ireland
- Online payment, memberships and invoices, on Elohi's behalf. Stripe receives the email address, the amount and the product reference; the card number and what is entered on its payment page are given to Stripe directly and never reach Elohi.
- For fraud prevention and its regulatory obligations, Stripe acts as an independent controller, under its own privacy policy. Stripe, Inc., United States, is Data Privacy Framework certified.
- Google Ireland Limited, Ireland, and Google LLC, United States
- Google Analytics, after acceptance only. Google sign-in, when the person chooses it.
- Google LLC is Data Privacy Framework certified.
5. Retention periods
For how long
- Waiting list and newsletter
- Until you unsubscribe, or three years after signing up without any booking or contact with the studio.
- Customer account
- For the duration of the relationship, then three years after the last contact. Then deletion or anonymisation: purchases and past sessions remain, without the name.
- Purchases and invoices
- Ten years, accounting obligation.
- Payment card
- Never kept by Elohi. The payment service keeps it under its own rules.
- Staff
- Five years after departure.
- Login logs
- One year.
- Google Analytics
- Fourteen months.
6. Your rights
Everyone has, over the data concerning them, a right of access, rectification, erasure, restriction and objection, a right to data portability, the right to withdraw consent at any time, and the right to give instructions on what happens to their data after death.
These rights can be exercised by email at direction@elohi.fr. A reply is given within one month. A complaint can be made to the CNIL, the French data protection authority, www.cnil.fr.
8. Health data
No health data is collected. The forms of the site and of the member area ask for no medical history, injury or treatment, and no information of that kind should be given to the studio through these forms or through a free-text field.
9. Minors
Elohi's services are for adults only. No data is knowingly collected from a minor.
10. Security
Data travels encrypted (HTTPS) and is hosted with providers that are Data Privacy Framework certified or bound by standard contractual clauses, named under "Recipients and processors". Access to the back office is restricted to the studio team, identified by a personal login link, and every change to a customer record is logged. No password is stored: login works through a link sent by email or through a Google account.