Privacy Policy
This Privacy Policy explains how Media Launch, LLC (“we,” “us,” or “our”) collects, uses, stores, and shares your information when you use GymCreatives (gymcreatives.com). By using the Platform, you consent to the practices described in this policy.
1. Information We Collect
1.1 Account Information
When you create an account, we collect your name, email address, and password (managed through Clerk, our authentication provider). We also collect any gym or business name and website URL you provide during onboarding.
1.2 Brand and Creative Assets
You may voluntarily upload brand assets to the Platform, including logos, color palettes, and images. These are stored to enable the Brand Toggle feature and personalize AI-generated outputs.
1.3 Content You Create and Generate
The Platform stores prompts you submit to AI agents, images you upload to the Elements library, and all AI-generated content saved to your Gallery. This data is associated with your account and used to deliver the Services.
1.4 Payment Information
Payment processing is handled by Stripe. We do not store your full credit card number, CVV, or payment card details on our servers. Stripe's collection and use of your payment data is governed by Stripe's Privacy Policy (stripe.com/privacy).
1.5 Usage Data and Analytics
We use PostHog to collect usage analytics including pages visited, features used, session duration, browser type, device type, and IP address. This data is used to improve the Platform and is processed in aggregated and anonymized form where possible.
1.6 Communications
If you contact us via email or submit feedback, we retain those communications to respond to you and improve our Services. We send transactional emails via Resend and marketing/onboarding emails via Kit (ConvertKit).
2. How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Provide, operate, and improve the Platform and Services
- Process payments and manage subscriptions
- Send transactional emails (receipts, account notifications)
- Send onboarding and feature update emails (you may unsubscribe at any time)
- Monitor usage, detect fraud, and enforce our Terms of Service
- Comply with legal obligations
We do not sell your personal information to third parties.
3. Third-Party Services and Data Sharing
To provide the Services, we share data with the following categories of third-party service providers:
- Authentication: Clerk (clerk.com) — manages account login and identity
- Payments: Stripe (stripe.com) — processes subscription billing
- AI Model Providers: OpenAI, xAI, Google — receive your prompts and uploaded images to generate content outputs
- Analytics: PostHog (posthog.com) — usage and event tracking
- Hosting and Infrastructure: Vercel (vercel.com), Convex (convex.dev) — platform hosting and backend
- Email Delivery: Resend (resend.com) — transactional emails; Kit (kit.com) — marketing and onboarding sequences
Each third-party provider has its own privacy policy and data processing terms. When your prompts and images are sent to AI model providers, those providers process the data subject to their policies. We recommend reviewing those policies if you have concerns about specific data handling.
We do not share your personal information with third parties for their own marketing purposes. We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Media Launch, LLC, our users, or the public.
4. AI-Generated Content and Your Inputs
Prompts and images you submit are sent to third-party AI model APIs (OpenAI, xAI, Google) for processing. These providers may retain submitted data pursuant to their own data retention policies. We do not use your specific brand assets or identifiable business content to train our own AI models without your explicit consent. We do collect aggregated, anonymized usage patterns to improve the Platform.
5. Data Retention
We retain your account data, uploaded assets, and generated content for as long as your account is active. If you cancel your subscription, we retain your data for 90 days before deletion to allow for account reactivation. You may request earlier deletion by contacting gymcreatives@gmail.com. Anonymized usage analytics may be retained indefinitely in aggregated form.
6. Data Security
We implement commercially reasonable technical and organizational measures to protect your information, including encrypted data transmission (HTTPS/TLS), access controls, and secure third-party infrastructure. However, no method of transmission over the internet is 100% secure. You are responsible for maintaining the security of your account credentials.
7. Your Rights — California Residents (CCPA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to Opt Out: We do not sell personal information. If this changes, you will have the right to opt out.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise these rights, contact us at gymcreatives@gmail.com with the subject line “California Privacy Request.” We will respond within 45 days.
8. Users Outside the United States
GymCreatives is operated from the United States. If you access the Platform from outside the U.S., your information may be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. By using the Platform, you consent to this transfer.
9. Children's Privacy
The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us information, contact gymcreatives@gmail.com.
10. Cookies and Tracking Technologies
We and our service providers use cookies and similar tracking technologies to maintain session state, authenticate users, and collect usage analytics. You may configure your browser to refuse cookies, but some features of the Platform may not function properly without them. We do not currently respond to Do Not Track signals.
11. Links to Third-Party Sites
The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a notice on the Platform. The updated policy will be effective as of the date posted. Your continued use of the Platform after that date constitutes acceptance.
13. Contact Us
Questions, requests, or concerns about this Privacy Policy:
- Email: gymcreatives@gmail.com
- Website: gymcreatives.com
- Mail: Media Launch, LLC, Livermore, California
GymCreatives is a product of Media Launch, LLC. These documents were last updated May 14, 2026.
GDPR Addendum
This GDPR Addendum (“Addendum”) supplements and forms part of the GymCreatives Privacy Policy. It applies to individuals accessing GymCreatives from the European Economic Area (EEA), United Kingdom (UK), and Switzerland (collectively, “European Users”). In the event of any conflict between this Addendum and the Privacy Policy, this Addendum takes precedence for European Users.
Media Launch, LLC, Livermore, California, USA acts as the data controller for personal data collected through GymCreatives. Questions regarding this Addendum should be directed to gymcreatives@gmail.com.
1. Legal Basis for Processing (Article 6 GDPR)
We process your personal data only where we have a valid lawful basis to do so. The table below summarizes our processing activities, the personal data involved, our lawful basis under the GDPR, and our retention periods.
| Processing Activity | Data Category | Lawful Basis | Retention Period |
|---|---|---|---|
| Account creation & management | Name, email, password | Contract (Art. 6(1)(b)) | Duration of account + 90 days |
| Subscription billing | Payment details (Stripe) | Contract (Art. 6(1)(b)) | 7 years (tax law) |
| AI content generation | Prompts, uploaded images | Contract (Art. 6(1)(b)) | Duration of account + 90 days |
| Platform analytics | Usage data, IP address | Legitimate interest (Art. 6(1)(f)) | 24 months |
| Marketing emails | Email address | Consent (Art. 6(1)(a)) | Until unsubscribe |
| Legal compliance | Any required data | Legal obligation (Art. 6(1)(c)) | As required by law |
2. Your Rights Under GDPR
As a European User, you have the following rights under the General Data Protection Regulation (or equivalent UK/Swiss legislation):
Right of Access (Art. 15)
You may request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification (Art. 16)
You may request that we correct inaccurate or incomplete personal data we hold about you.
Right to Erasure (Art. 17)
You may request deletion of your personal data where: (a) it is no longer necessary for the purpose it was collected; (b) you withdraw consent (where consent is the lawful basis); (c) you object to processing based on legitimate interests and we have no overriding grounds; or (d) the data has been unlawfully processed. Erasure requests are subject to our legal retention obligations.
Right to Restriction of Processing (Art. 18)
You may request that we restrict processing of your data in certain circumstances, such as while we verify the accuracy of data you have disputed.
Right to Data Portability (Art. 20)
Where processing is based on contract or consent and carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21)
You may object at any time to processing of your personal data carried out on the basis of legitimate interests. You also have an absolute right to object to processing for direct marketing purposes, including profiling.
Rights Related to Automated Decision-Making (Art. 22)
GymCreatives does not make decisions about you based solely on automated processing that produce legal or similarly significant effects. AI-generated content is produced at your direction and does not constitute automated decision-making under Art. 22.
Right to Withdraw Consent
Where we rely on your consent as the lawful basis for processing (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal. To withdraw consent for marketing, use the unsubscribe link in any marketing email or contact us at gymcreatives@gmail.com.
To exercise any of the above rights, contact us at gymcreatives@gmail.com with the subject line “GDPR Rights Request.” We will respond within 30 days. We may request verification of your identity before processing your request.
3. International Data Transfers
GymCreatives is operated from the United States. When we process your personal data, it is transferred to and stored in the United States, which is not considered by the European Commission to provide an adequate level of data protection equivalent to the EEA.
We rely on the following safeguards for international transfers:
- Standard Contractual Clauses (SCCs): Where we transfer data to our third-party processors (including Stripe, Clerk, PostHog, Vercel, Convex, Resend, and Kit), we rely on the European Commission's Standard Contractual Clauses (2021/914) to ensure adequate protection.
- AI Model Providers: Prompts and images submitted to OpenAI, xAI (Grok), and Google (Gemini) are processed in the United States. OpenAI and Google participate in or comply with SCCs. You should review their respective data transfer documentation for current details.
- UK Transfers: For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs where applicable.
4. Third-Party Data Processors
We have engaged the following sub-processors who may process personal data of European Users on our behalf. We conduct reasonable due diligence to ensure these processors provide appropriate GDPR protections.
| Processor | Purpose | Location / Transfer Mechanism |
|---|---|---|
| Stripe | Payment processing | USA — SCCs |
| Clerk | Authentication | USA — SCCs |
| OpenAI | AI content generation (GPT Image) | USA — SCCs |
| xAI (Grok) | AI content generation | USA — SCCs |
| Google (Gemini) | AI content generation | USA — SCCs / Adequacy |
| PostHog | Usage analytics | USA/EU — SCCs |
| Vercel | Platform hosting | USA — SCCs |
| Convex | Backend infrastructure | USA — SCCs |
| Resend | Transactional email | USA — SCCs |
| Kit (ConvertKit) | Email marketing | USA — SCCs |
5. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our general retention schedule for European Users is summarized in Section 1 above. Upon account deletion, we will erase or anonymize your personal data within 90 days, except where retention is required by legal obligation (e.g., financial records required for tax compliance).
You may request early deletion of your account and associated data at any time by emailing gymcreatives@gmail.com with the subject line “Data Deletion Request.”
6. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure, including encrypted data transmission (TLS/HTTPS), access controls, and secure third-party infrastructure. We will notify affected European Users and relevant supervisory authorities of any personal data breach without undue delay where required by GDPR Article 33.
7. Cookies and Consent
Where required by EU member state law (including the ePrivacy Directive), we obtain consent before placing non-essential cookies on your device. Analytics cookies placed by PostHog are used to improve Platform functionality and are considered non-essential. You may withdraw cookie consent at any time by adjusting your browser settings. Note that disabling analytics cookies does not affect your ability to use the Platform.
8. Right to Lodge a Complaint
If you believe we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
We encourage you to contact us first at gymcreatives@gmail.com — we are committed to resolving complaints directly and promptly.
9. Children's Data
GymCreatives is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. Where parental consent is required under applicable member state law for users under 16, we do not knowingly process such data without it. If you believe we have inadvertently collected data from a child under 16, please contact gymcreatives@gmail.com and we will delete it promptly.
10. Changes to This Addendum
We may update this Addendum to reflect changes in law, our data practices, or our service providers. Material changes will be communicated by email to European Users at least 30 days before the change takes effect. Your continued use of the Platform after the effective date of an updated Addendum constitutes acceptance.
11. Contact and Data Controller Details
Data Controller:
- Company: Media Launch, LLC (DBA GymCreatives)
- Location: Livermore, California, USA
- Email: gymcreatives@gmail.com
- Website: gymcreatives.com
We do not currently have a designated EU or UK representative or Data Protection Officer, as we do not meet the thresholds requiring their appointment under Article 27 or Article 37 GDPR. This will be reviewed as the Platform scales.
This Addendum supplements the GymCreatives Privacy Policy and Terms of Service. GymCreatives is a product of Media Launch, LLC. Last updated May 14, 2026.