Privacy notice

Floorpass · Breath Global, Inc. · Effective October 28, 2026

The short version

Who we are

Floorpass is a product of Breath Global, Inc. ("Breath", "we", "us"), a North Carolina corporation, which decides how your information is used. This notice covers floorpass.io: its home page, the 90-day pilot page, Floorpass accounts (floorpass.io/login), the investor room (floorpass.io/investors), the demo (floorpass.io/demo) and the invite-only pages where a new gym is set up (floorpass.io/activate). It doesn't cover the Floorpass software that gyms use once they are set up, including each gym's own pages under floorpass.io/g/ and its command center, or other websites we link to. Breath's privacy policy for breathglobal.com, northofnoise.io and gotern.io is at breathglobal.com/privacy.

What we collect and why

• Book a demo (the home page). Your name, your gym, studio or business, and your email; what you run (a gym or studio, your own training business, or several locations) and how many locations; and, if you give them, your mobile number, your booking or club software and your message. We note when you sent it. We use it to reply to you and set up your demo. If you take the live test call during your demo, we enter the phone number you choose for it (such as your mobile) in Floorpass, which rings it through Twilio, the phone service Floorpass uses.
• The 90-day pilot (floorpass.io/90-day-pilot). Your name, your gym or location, your email, your mobile number and your number of active members; if you give them, your city and state and your brand or franchise and booking software; and that you accepted the pilot terms. We note when you sent it. We use it to hold your spot, take your payment and set up your pilot. If the pilot is full or closed, the same form puts you on the waitlist instead, and we email you when the next round opens.
• Paying the pilot fee. When you hold a spot, we email you a secure Stripe payment link. The fee is paid to Breath Global, Inc. Stripe processes the payment for us: it handles your card or other payment details. In our Stripe account we see the details you give on Stripe's page (such as your name, email and billing address), what you bought, when and for how much, your card's brand, last four digits, expiry month and year and country, and the IP address you paid from, never your full card number. Stripe also uses payment details under its own privacy policy (stripe.com/privacy), for example to prevent fraud.
• Floorpass accounts (floorpass.io/login). You sign in with Google, which shares your name, email and Google account ID, and a link to your profile photo that we don't use. We ask Google for nothing more. Then, once, you tell us your name, your gym or company, what describes you (such as a gym owner or an investor) and what you're here for. We keep these with your email, when you asked, and whether we approved, declined or closed your account and, for a pilot gym, its pilot start date. We use them to decide who gets in and to run your account.
• The investor room (floorpass.io/investors). You sign in with Google, as above, or with an email and password (and your name, when you create an account that way). Google's Firebase Authentication handles your password, and our code never stores it; it also sends the emails that confirm your address or reset your password. To sign the confidentiality agreement, you give your full name and, if you like, your company or fund and your title, and type your name as your signature. We record these with your email, which version of the agreement you signed (and a fingerprint of its text), when you signed, how you signed in, and your browser's description of itself (its "user agent", which names your browser, its version and your device's operating system), as the record of your signing. We also keep whether we approved you or closed your access, and a log of what you open in the room, each with its time: when you open the room, which forecast you try and what you download. We use these to keep the room confidential, to keep the record of the agreement and to see which materials investors use.
• Setting up a new Floorpass gym (floorpass.io/activate, opened only with an invitation link from us). You give your name, your mobile number, a login email and a password, and your business's name, kind and one-line description, its address, phone and email, its intro offer, membership price and class schedule, a name for its AI assistant and the web address you want or, if you bring over what you have, your current website and domain, your Instagram and Facebook pages, your booking software and which accounts you already have. We note which invitation you used and when your gym was built. We use these to build and run your gym's Floorpass workspace, website, command center, member app and brand kit, to give you your login and to reach you about your account. Your business's details, such as its name, address, offers and schedule, appear on its new website. Your password is kept only as a scrambled code (a hash), never as you typed it. Once your gym is live, your mobile is the number Floorpass rings when a new lead comes in, as the setup page says.
• Alerts and email. When you send a form, ask for an account or sign the agreement, we receive an email alert with what you sent. If you email us, we keep your email and what you wrote.
• The demo (floorpass.io/demo). It shows a made-up gym, and what you do in it stays in your browser: our code doesn't send it to us. If you allow the microphone and talk to it, your browser's own speech recognition turns your speech into text. Some browsers, such as Chrome and Edge, send the audio to the browser maker to do this. When the demo reads its answers aloud, some browsers' voices send that text to the browser maker.
• Collected automatically. Google's Firebase Hosting receives your IP address, browser details, the page you asked for and the time, which Google uses to protect the service and to give us traffic reports. Google's sign-in and database services also receive your IP address and browser details when you send a form or sign in, and so does Google Cloud Run, which runs the gym setup pages. Our pages load their typefaces from Google Fonts, which receives your IP address. On our home page and the 90-day pilot page, while your visit is counted, your browser also connects to Google Analytics (see Analytics).

How we use it

We use personal information only to reply to you, set up and run your demo, pilot or gym, run your account and the investor room, take your payment, understand how our home page and pilot page are used (see Analytics), see which investor materials are used, keep the site secure, and keep business records and meet our legal obligations. We use your mobile number only to reach you about what you asked for (including your demo's live test call, if you take it, and, for a gym owner, the calls about new leads), never for marketing calls or texts. We won't send you marketing email unless you agree first. We don't make automated decisions about you.

Who we share it with

We don't sell personal information or share it for advertising. We share it only with:

• Google, our main service provider: Firebase Hosting, Firebase Authentication, our Cloud Firestore database, Google Cloud Functions (which sends us the email alerts), Google Cloud Run and Cloud SQL (which run Floorpass's own server, including the gym setup pages and the demo's test call, and keep what they collect), Google Workspace email, Google Analytics and Google Fonts.
• Stripe, which processes pilot payments for us. Stripe also uses payment details under its own privacy policy, for example to prevent fraud.
• Twilio, the phone service Floorpass uses. It receives the phone number for your demo's live test call, if you take it, and places the call; once a new gym is live, it rings the owner's mobile when a new lead comes in.
• Anthropic. When a new gym is set up, Anthropic's AI, Claude, may write the words of its brand kit from the business's name, kind, city, description, intro offer and website and the owner's name.
• Breath staff who need it for their work.
• Others when the law requires it, or to protect the rights and safety of Breath, the people who use our sites, or the public.
• A buyer or successor, if Breath or Floorpass becomes part of a merger, a sale or a reorganization. This notice would still apply to your information.
• Anyone you ask us to share it with.

Your information is handled in the United States and wherever our service providers operate. For transfers from the EU, the UK and Switzerland, we rely on our service providers' data processing terms, which include the European Commission's Standard Contractual Clauses (and the UK's addendum to them), and, where a provider is certified, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

Analytics

On our home page and the 90-day pilot page (never on your account's pages, in the investor room, in the demo or on this page), Google Analytics records the pages you view and what you do on them, such as the links you follow and the forms you send. It also records your device, browser, general location (worked out from your IP address) and the link that brought you. We never send it your name, email, company or anything you type, and its advertising features are off.

Google Analytics sets two cookies, _ga and _ga_<ID>, to tell one visit from another. They last up to two years from your last visit and aren't used for advertising. Unless your browser sends Global Privacy Control, you see a small card with Accept and Decline, and we remember your answer on this site for a year. If your browser's time zone is in the EU, the EEA, the UK or Switzerland (and nearby places that follow their rules, such as the Channel Islands, Gibraltar and the Faroe Islands), or your browser doesn't share its time zone, nothing is counted and no cookie is set until you accept. Everywhere else, your visit is counted unless you decline. Decline stops it at once: nothing more is sent to Google Analytics from that page, and these cookies are deleted. If your browser sends Global Privacy Control, nothing loads from Google Analytics and we don't ask; "Cookie choice" shows a short note that says so. Google keeps the detailed records for up to 14 months.

Change your cookie choice

Cookies, storage and tracking

Our own code sets no cookies (Google Analytics' two are described under Analytics). Your browser keeps a few things for the site:

• your cookie choice;
• the gym name you type into the home page's brand preview;
• while you set up a new gym, your answers (never your password), until the gym is built or you close the tab;
• your sign-in to your account or the investor room, kept by Google's Firebase software, which also sends Google its version and the dates it ran, without any personal identifier;
• in the investor room, the forecast settings you try;
• in the demo, where you are and the changes you make.

If you use Sign in with Google, Google's sign-in pages may use Google's cookies, under Google's privacy policy. To remove what the site saved on your device, sign out, then clear the site's data in your browser settings.

Do Not Track. We don't track you across other websites, so a Do Not Track signal has nothing to turn off. Apart from Google Analytics on our home page and the 90-day pilot page, which counts your visits to this site over time but not your activity on other websites, no other company collects information through floorpass.io about what you do over time or on other websites. Google Fonts receives your IP address when your browser loads our typefaces, and Google's sign-in pages work under Google's own privacy policy.

How long we keep it

• Forms, accounts, gym setups, demo test calls, investor room records and emails: there's no deletion schedule yet. They stay until we delete them, and we delete them when you ask, except the record of a signed confidentiality agreement, which we keep while the agreement lasts (three years from when you sign it, and longer for trade secrets) and as long as we may need it to enforce or defend the agreement.
• Payments: there's no deletion schedule yet for the records in our Stripe account. When you ask, we delete what we don't need to keep for tax and accounting. Stripe also keeps its own record of each payment, as the law requires it to.
• Google Analytics keeps its detailed records for up to 14 months; its cookies last up to two years from your last visit.
• Google keeps hosting IP data for a few months and sign-in IP logs for a few weeks, and Google Cloud Run's request logs for the gym setup pages (your IP address and browser details) for about 30 days. When we delete an account, Google removes its sign-in data within 180 days, backups included.
• Your browser's storage stays until you clear the site's data, except a gym setup's answers, which last only until the gym is built or you close the tab. Signing out removes your sign-in.

How we protect it

Every page uses an encrypted connection (HTTPS). Our database rules let anyone send a form but only signed-in Breath staff read it. You can read only your own account and investor room records. What you give when you set up a gym goes to Floorpass's own server and database, kept apart from every other gym's, where only your gym's own logins and Breath staff who sign in can see it. The investor room is an encrypted file, and its key is released only to an investor we approved who has signed the agreement. We have no security certification, such as SOC 2, and no independent security audit yet. No system is perfectly secure. If a security incident affects your personal information, we'll tell you as the law requires.

Your choices and rights

You can leave optional fields blank and say no when your browser asks for your microphone; the demo works without it. Wherever you live, you can ask us to show you what personal information we have about you and send you a copy, correct it, delete it (including your account; there's no delete button yet), or stop emailing you.

How to ask. Write to hello@breathglobal.com. We'll confirm your request by writing to the email address we have for you, and we'll answer within 30 days or tell you why we need longer. Someone you authorize can ask for you; we may ask for proof. If we say no, we'll explain why, and you can appeal by replying to our answer. We won't treat you differently for asking.

Children

floorpass.io is for gym owners, their staff and business professionals, and isn't meant for anyone under 16. We don't knowingly collect personal information from anyone under 16. If you think a child has given us information, write to us and we'll delete it.

Changes to this notice

We'll post any new version here with its effective date. Before we add anything that collects new kinds of information, we'll update this notice.

Contact us

Breath Global, Inc., a North Carolina corporation. Email: hello@breathglobal.com

For residents of California, other US states, the EU and the UK

This part adds to the notice above. You need it only if you live in one of these places.

California. We don't sell your personal information, share it for cross-context behavioral advertising (what California law calls "sharing"), or give it to others for their own marketing. We honor Global Privacy Control as a request to opt out of sale and sharing. We do neither today, and anything we add later will respect the signal.

On floorpass.io we collect identifiers (name, email, mobile number, billing address, account ID and IP address); professional information (your gym or company, your role, its locations, active members and software, your city and state and, for a new gym, its address, phone, email, offers, schedule and web pages); account sign-in details; commercial information (what you bought from us, if you pay the pilot fee); payment details (your card's brand, last four digits, expiry and country, from Stripe, if you pay the pilot fee); internet activity (web server records, your browser's description when you sign the investor agreement, what you open in the investor room and, while your visit is counted, the pages you view and what you do on our home page and the 90-day pilot page); and what you choose to tell us (messages and your typed signature). It comes from you, your device, Google (if you use Google sign-in) and Stripe (if you pay us). We use your sign-in details only to give you what you asked for. You have the right to know what we collect, to correct it, to delete it, to opt out of its sale or sharing, and to equal treatment when you use these rights.

Other US states. Residents of states such as Colorado, Connecticut, Oregon, Texas and Virginia have similar rights, including the right to appeal. Write to the same address. We don't do targeted advertising, we don't sell personal information, and we don't profile people in ways that have legal or similar effects.

The EU and UK. Breath Global, Inc. is the company responsible for your information (the "controller"). Our legal bases are doing what you asked (answering your request, setting up your demo, pilot or gym, running your account and the investor room, taking your payment, and the confidentiality agreement you sign); our legitimate interests (replying to businesses, keeping a record of what investors open in the room, and keeping the site secure); your consent where we ask for it, such as for analytics cookies, which you can withdraw with "Cookie choice", or your microphone in the demo, which you can withdraw in your browser settings; and our legal obligations. You can ask to access, correct, delete or move your information, and to restrict or stop how we use it. You can also complain to your data protection authority; in the UK, that's the Information Commissioner's Office.