Privacy statement

Who we are

xBase360 (sole proprietorship) provides the xBase360 platform and is responsible for the processing of your data as described below.

• Postal address: Gravin Juliana van Stolberglaan 31, 2263 AB Leidschendam, Netherlands (not a visiting address)
• Chamber of Commerce (KvK) number: 42093846
• VAT number: NL005494735B95
• Email: support@xbase360.com
• Phone: +31 70 204 2081
• Privacy questions: privacy@xbase360.com

What we process about you

Not everything below applies to everyone. What is kept about you depends on what you use: someone who only trains doesn’t have a food diary.

Your account

Your name, email address and password (stored encrypted; we can’t read it). Optionally your date of birth, sex, height and profile photo. If you sign in with Apple or Google, we receive your email address and name from them.

What you record in the app

Your workouts and the sets you log, your cardio activities including the route you covered, your food diary, your water intake, your habits, your completed path days and your machine sessions with the photo of the screen you took for them.

Health data

This is a separate category, and we say so explicitly because the law is stricter about it. It concerns your weight and body measurements, your progress photos, your heart rate if you enter it or have it read out, and your cycle data — which you can also import from Apple Health or Health Connect. We process this data only with your explicit consent, which you give by entering it and withdraw by deleting it.

Your progress photos are kept in protected storage. They can never be accessed via a public link and are only shown to you, your active coach and the owner of your gym.

If you belong to a gym

Your membership, your bookings, your attendance at classes and — if the business uses access control — that you went through the door at a particular time. Your coach can see the data listed above; that’s what you have a coach for. When the coaching ends, that access lapses and you keep your history.

If you sign up with a gym via the Finder

If you tap “I’m interested” for a gym or coach in the app, you first see what that business will receive from you: your name and email address, your phone number only if you switch that on, and a message if you write one. This is a snapshot of what you share at that moment, not ongoing access to your profile. The business uses it to contact you. You can withdraw your sign-up in the app; if the business declines you or you withdraw, we delete your email address, phone number and message after twelve months. Becoming a member of a business, being linked to a coach or having your subscription taken over never happens without you saying yes to it in the app or via the link in our email.

Payment

Your payment details go directly to Stripe or to the App Store or Google Play. We never see a full card number; we keep what was paid, when, and whether it succeeded.

Technology and support

Your device token for push notifications, error reports if the app crashes, and the conversations you have with our customer service — including any attachments you send.

When you first and last opened the app, which version you use, whether it’s an iPhone or Android and whether notifications are on. That way you, your coach and our customer service can see whether you’re really using it, and which version you have if something goes wrong. We store this at most once an hour and don’t track what you do in the app.

If you work as a coach in the dashboard and get stuck, you can let our customer service view your account for 24 hours. They then see what you see, can’t change anything, and you see at the top of every page when it’s happening. You switch it on and off yourself, and we record every time someone views your account.

If you visit our website

If you’re just looking around, you leave nothing with us: there are no advertising or tracking cookies on the site. As with any website, our hosting and our error monitoring do see your IP address and browser in order to display the page and find errors.

A form (contact, scheduling a call, the demo business, a landing page or the waiting list for the Android app): what you fill in — your name, email address and, if you wish, your company, phone number and message — goes into our customer system, so we can reply to you or send you the link. We keep it for as long as we’re in contact with you; if you ask us to delete it, we will. Cloudflare Turnstile checks whether the form is submitted by a human, without cookies.

The chat: if you search the help centre, we keep nothing. If you want to talk to one of us, the chat window creates a session without a name or email address, and your conversation reaches us as a support query. The session expires after thirty days of inactivity; the conversation remains, like an email. A question to the automatic assistant goes to Anthropic; the answer is shown with a label.

We also use your IP address for the rate limit on forms and the chat: we count how often something comes in from a single address, so that nobody can flood us. For this we only store a hash, not a readable address, and it’s gone after two days at most.

Why we’re allowed to

• To perform the agreement. No account, no app; no workout log, no progress. This covers most of it.
• With your consent. For health data, for your location during an activity, for push notifications and for sharing your runs with the community. You withdraw consent by switching the feature off or deleting the data.
• On the basis of a legitimate interest. For the security of the service, preventing abuse (including the rate limit on forms and the chat), error reports we use to fix the app, when and with which version you open the app, and answering a question you ask via the website.
• Because the law requires it. Financial records must be kept for seven years.

What we don’t do

• We don’t sell your data. To anyone, ever.
• We don’t use your data to train AI models, and under our agreement the parties that provide our AI may not do so either.
• We don’t make decisions about you that are fully automated and have legal consequences. An AI plan or an AI recipe is a suggestion: you or your coach look at it and decide.
• There are no advertising or tracking cookies on our site.

Who else has access

To make the service work, we use other parties. We have a data processing agreement with each of them, and for the parties outside the EU the standard contractual clauses of the European Commission apply.

If you belong to a gym, that gym is itself responsible for the data it processes in the system. In that case we are its processor; the agreements about this are set out in our data processing agreement.

How long we keep it

Your rights

You may view what we hold about you, have it corrected, have it deleted, have the processing restricted, object to it, and receive your data in a readable file to take with you.

You can delete it yourself, straight away. In the app it’s under Profile → Delete account. Everything that belongs to you is then removed; what must be kept by law (the financial records) remains without being linked to you.

You can also view and take your data yourself. Under Profile → My data you can see what has been recorded about you and who looked at it, and request a copy of all your data.

For the other rights, email privacy@xbase360.com. We respond within one month.

If you don’t agree with how we handle your data, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (opens in a new tab). We’d rather hear about it ourselves first, but that right is independent of us.

Security

All connections are encrypted. Who may see which row is enforced in the database itself and not in the app — which means that a bug in a screen can never result in you seeing someone else’s data. Two-step verification is required for our own team in the CRM and for healthcare providers who create consultation reports; from 14 October 2026 also for every coach and owner who can see members’ data. If you discover a vulnerability anyway, report it to support@xbase360.com; we’ll respond, and we appreciate it.

Children

The app is not intended for children under sixteen. If you are younger, you may only use it with permission from your parent or guardian.

Changes

If something essential changes, we’ll show it in the app before it takes effect. The date at the bottom says when this text was last updated.