Privacy Policy

1. Overview

Aeon Kairos ("we," "us," or "our") is a business operations platform for boutique fitness businesses, operated by MNBK LLC. This Privacy Policy explains how we collect, use, store, and share information when you use the Aeon Kairos platform, including our web dashboard, APIs, and any associated services (collectively, the "Platform").

Aeon Kairos operates as both a data controller (for information we collect directly, such as account information from business owners and staff) and a data processor (for information that fitness businesses — our customers — collect from their members and process through our Platform).

By using the Platform, you agree to the practices described in this policy.

2. The AK Members Mobile App

AK Members is the member app for fitness locations that use Aeon Kairos. A member's location creates their account. As described in this policy, the location is the data controller for its members' information, and Aeon Kairos, operated by MNBK LLC, processes that information on the location's behalf.

What the app collects and uses

• Account information: name, email address and, where the location provides it, phone number. Members sign in with an email and password. The app has no public sign-up.
• Class activity: the member's bookings, waitlist spots, cancellations and check-ins at their location.
• Messages: messages a member sends to their coach and the coach's replies.
• Notifications: if the member allows notifications, we store a device push token so the location can send class reminders and coach messages. Members can turn notifications off in their phone settings at any time.
• Location (optional): if the member allows location access, the app uses the phone's location only while the app is open, to tell when the member has arrived at their location and offer a check-in. The comparison happens on the phone. The phone's coordinates are not sent to us or stored. Only the check-in itself (which member, which class, and when) is recorded. Members can deny or withdraw location permission in their phone settings, and can still check in manually.
• Language preference.

What the app does not do

• It contains no advertising and does not track members across other apps or websites.
• It does not use third-party analytics or crash-reporting services.
• It does not sell personal information.

Sharing

Information is shared with the member's own location (the controller) and with service providers that run the platform, such as our hosting and database provider and the services that deliver push notifications and email. See Section 8 for details.

Deleting your account

Members can request deletion of their account in the app (Profile, then Delete account, which opens a request form), or by contacting their location or privacy@aeonkairos.com. We process verified requests within 30 days. Some records may be kept where the location or the law requires it, for example billing records.

Children

The AK Members app is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

Contact

privacy@aeonkairos.com

3. Who This Policy Covers

This policy applies to:

• Business Owners and Staff — businesses and individuals who create an Aeon Kairos account and use the Platform to manage their operations
• Business Members and Leads — individuals whose information is entered into the Platform by a fitness business using Aeon Kairos

If you are a business member or lead and have questions about how your specific business handles your data, please contact that business directly. They are the data controller for your personal information within their account.

4. Information We Collect

4A — Information from Business Owners and Staff

When a fitness business creates an account, we collect:

• Business name, address, and contact information
• Owner and staff names, email addresses, and phone numbers
• Billing information (processed by Stripe — we do not store payment card details)
• Account credentials and authentication data
• Platform usage data, including feature interactions and session activity

4B — Information Processed on Behalf of Business Customers

Fitness businesses using Aeon Kairos may enter or import data about their members and leads. This may include:

• Member names, email addresses, and phone numbers
• Membership plan and billing status
• Class attendance, booking history, and check-in records
• Health and fitness data, including body composition scans (InBody), physical assessments, and nutrition logs
• Coaching notes, program phases, and call history
• SMS and in-app message history
• Gamification data including experience points, badges, and skill progression
• Lead source and advertising attribution data
• Consult and appointment history

We process this data on behalf of and under the instruction of the fitness business. We do not use member data for our own marketing or sell it to third parties.

4C — Information from Meta (Facebook/Instagram)

A business can connect its own Facebook Page, the Instagram professional account linked to that Page, and, optionally, its own Meta ad account to Aeon Kairos using Facebook Login for Business. Only the business's owner or admin in Aeon Kairos can connect, change, or disconnect the integration. A plain-language summary is available on our Meta integration page.

Data we receive from Meta:

• Names and IDs of the Facebook Page, ad account, and Meta business the person selects when connecting, and the name, ID, and username of the Instagram professional account linked to that Page
• Instant Form (Lead Ads) submissions for the connected Page, including the submitter's name, email, phone number, form answers, and the form, ad, ad set, and campaign IDs
• Campaign, ad set, and ad status and budgets, and performance metrics such as spend, impressions, clicks, and leads for the connected ad account
• Messages: the text of Messenger and Instagram Direct messages sent to, or sent from, the connected Page or Instagram account, attachment type and link, timestamps, and the sender's Meta-scoped ID and, where Meta provides them, public name or username
• Comments: the text of comments on the connected Page's and Instagram account's posts, the commenter's ID and public name, and the comment and post IDs
• Post performance: reach, engagement, and similar insight numbers for posts published through Aeon Kairos, refreshed once a day for posts up to 28 days old
• IDs and links of posts that Aeon Kairos publishes for the business
• Meta access tokens that let Aeon Kairos make requests on the business's behalf

How we use it: solely to provide Meta features to the business that connected it — turning Instant Form submissions into leads in that business's lead pipeline (duplicates are prevented), ad reporting and lead attribution (including a daily sync of ad-level performance), and ad management that the business's owner or admin initiates (pausing and resuming campaigns, ad sets, and ads; changing daily budgets within a maximum the business sets; and creating new lead campaigns, which always start paused), publishing the image posts the business's staff approve to its Facebook Page and Instagram account, showing messages and comments to the business's staff and letting them reply and moderate, and showing post performance. Messages and comments are the business's customer communications and are handled like its other message history (such as SMS). We never use one business's Meta data for another business, and we do not use Meta message or comment content to train AI models.

Who can act on it: the business's owner and admin roles can connect, disconnect, change ads, approve posts for publishing, and hide or delete comments or send private replies. Owner, admin, and coach roles can reply to messages and comments. Front desk staff can view Meta information but cannot change it. Consequential Meta actions (connecting, asset selection, disconnecting, lead syncs, ad changes, publishing, message sends, comment actions, and blocked attempts) are recorded in an activity log visible to the business.

Where it is stored: in our database hosted by Supabase. Meta access tokens are stored encrypted in the database's secret vault (Supabase Vault), used server-side only, and never sent to the browser. Tenant isolation is enforced with row-level security and per-location checks.

Retention, disconnection, and deletion:

• Disconnecting in Aeon Kairos deletes our stored Meta access tokens for that business location, unsubscribes the Page from our webhooks, cancels scheduled posts for that location, blocks sending, and stops further retrieval from Meta. Message and comment history stays readable to the business but is not refreshed.
• Removing Aeon Kairos in your Facebook settings, or sending a data-deletion request through Facebook, triggers our deauthorization and data-deletion callbacks: we delete the access tokens for every business location connected through that Facebook user, clear the stored Page, ad account, business, and Instagram names and IDs, and apply the same disconnection steps. For deletion requests, we provide a confirmation code and a status page where the request can be checked. More information is available on our data deletion page.
• Leads already imported are the business's customer records and are not automatically deleted when Meta is disconnected. The business can delete them in Aeon Kairos. If you submitted a lead form, you can ask that business, or contact us at privacy@aeonkairos.com.
• Ad performance metrics already synced remain part of the business's reporting history until the business account is deleted.
• Messages and comments are the business's customer communication and are kept like its SMS history while the integration is connected. After disconnection they stay readable to the business and are not refreshed. They are deleted at the business's request or when the business location is deleted. If a comment is deleted on Facebook, we remove it from our records when Meta notifies us; the same applies to a message that is unsent on Meta. Leads from Instant Forms are stored only in the business's own workspace.
• If you messaged or commented and want your information removed, you can ask the business, or contact us at privacy@aeonkairos.com; we handle these requests per business location.
• Posts already published remain on Facebook and Instagram; they are not deleted when the integration is disconnected.

4D — Automatically Collected Information

When you use the Platform, we automatically collect:

• IP address and device information
• Browser type and operating system
• Pages visited and features used
• Session timestamps and duration
• Error logs and performance data

5. How We Use Information

For Business Owners and Staff:

• To create and manage your account
• To provide, operate, and improve the Platform
• To process billing through Stripe
• To send transactional communications (account alerts, billing notices, platform updates)
• To provide customer support
• To monitor platform security and prevent fraud

For Business Member and Lead Data:

• To provide the features and functionality requested by the fitness business
• To power AI-assisted analysis, recommendations, and message drafting on behalf of the fitness business
• To generate action center signals, member health scores, and lifecycle metrics for the fitness business
• To facilitate SMS, email, and in-app communication initiated by the fitness business and its staff, or sent automatically by AI follow-up features the business has enabled (see Section 6)
• To display gamification progress (XP, badges, levels) within the Platform

We do not use business member or lead data to train AI models, sell it to advertisers, or contact members or leads for our own purposes.

6. Artificial Intelligence and Automated Processing

Aeon Kairos uses the Anthropic Claude API to power features including action center analysis, message draft generation, call brief generation, and ad performance verdicts.

When AI features are used, member and lead data relevant to the specific task is sent to Anthropic's API for processing.

Recommendations and drafts for staff

Some AI features generate recommendations, analyses, call briefs, and message drafts for the business's staff to review and act on.

Automated AI follow-up (AI Nurture add-on)

If a business enables the AI Nurture add-on and its automated follow-up setting, AI composes and sends SMS and email follow-ups to that business's leads automatically, in the voice the business has configured, without staff approving each message. These automated sends are limited by:

• SMS opt-out (replying STOP) and each lead's contact consent and channel settings
• Quiet hours
• Staff takeover — when a staff member takes over a conversation, AI follow-up stops for that lead

Leads received from Meta Instant Forms can enter this automated follow-up if the business has it enabled. Aeon Kairos does not use AI to send Messenger or Instagram messages or to reply to comments. The business is responsible for how it configures automated follow-up and for the consent and content of the messages sent on its behalf.

Drafted replies to Messenger and Instagram messages

If a business turns it on, AI may draft a reply to a Messenger or Instagram message when staff ask for one. To do this, the text of that conversation is sent to Anthropic's API. A staff member always reviews and sends the reply; AI never sends the message, and there are no automatic replies. Aeon Kairos sends replies only within Meta's standard 24-hour window; after that it blocks the reply until the customer writes again. Aeon Kairos does not use AI to reply to, hide, or delete comments.

We do not use customer data to train AI models. Anthropic processes data sent to its API under its own commercial terms and policies.

7. SMS Communications

Aeon Kairos facilitates SMS communications between fitness business staff and their members and leads via Twilio, including automated AI follow-up where a business has enabled it (see Section 5).

• Outbound SMS messages are only sent to individuals who have provided explicit SMS consent
• Consent records are maintained per member per fitness business location
• Members may opt out at any time by replying STOP to any SMS message
• SMS opt-out requests are processed immediately and recorded in the Platform
• Fitness businesses are responsible for obtaining and documenting member SMS consent

8. How We Share Information

We do not sell personal information. We share information only in the following circumstances:

Service Providers

We share data with third-party vendors who help us operate the Platform, including:

• Supabase — database hosting and authentication
• Vercel — platform hosting and deployment
• Stripe — payment processing
• Twilio — SMS and voice communications
• Anthropic — AI analysis and content generation

We select service providers that process data to provide their services to us under their terms.

Meta Platforms (Facebook/Instagram)

When a business connects its Facebook Page, Instagram account, and ad account, data flows from Meta to Aeon Kairos as described in Section 4C. Aeon Kairos sends requests to Meta's APIs to set up and remove the connection (such as subscribing or unsubscribing the Page from our webhooks), to retrieve that business's leads, ad data, messages, comments, and post performance, and to carry out actions the business's authorized staff initiate — for example, pausing a campaign, changing a daily budget, creating a new lead campaign in paused status, publishing an approved post, or sending a reply or moderating a comment. Message text is sent to Anthropic only for drafted replies as described in Section 6.

Fitness Businesses

Data entered by a fitness business is accessible to that business's authorized staff only. We do not share one business's data with another business or any third party.

Legal Requirements

We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of Aeon Kairos, our customers, or others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users prior to any such transfer.

9. Data Retention

• Business owner and staff account data is retained for the duration of the account and for 90 days following account termination, after which it is deleted
• Business member and lead data is retained as long as the fitness business account is active. Upon account termination, the fitness business may request export of their data within 30 days, after which data is deleted
• Billing records are retained for 7 years as required by financial regulations
• Audit logs are retained for 2 years
• SMS opt-in and consent records are retained for 5 years following the last recorded interaction
• Meta data is retained, disconnected, and deleted as described in Section 4C

10. Data Security

We implement industry-standard security measures to protect your information, including:

• Row-level security ensuring each fitness business can only access their own data
• Encryption of sensitive integration credentials at rest
• HTTPS encryption for all data in transit
• Webhook signature validation for all inbound data from third-party services
• Access controls limiting platform staff access to tenant data

No method of transmission or storage is 100% secure. In the event of a data breach affecting your information, we will notify affected parties as required by applicable law.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate information
• Deletion — request deletion of your personal information, subject to legal retention requirements
• Portability — request your data in a portable format
• Objection — object to certain types of processing

Business members and leads: To exercise these rights, please contact the fitness business that manages your membership. You may also contact us at privacy@aeonkairos.com and we will direct your request appropriately.

Business owners and staff: Contact us at privacy@aeonkairos.com.

We will respond to all verified requests within 30 days.

12. Children's Privacy

The Aeon Kairos Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor's information has been submitted to the Platform, please contact us at privacy@aeonkairos.com and we will take steps to delete it.

13. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify business owners via email. Your continued use of the Platform after any update constitutes acceptance of the revised policy.

15. Contact

For privacy-related questions, requests, or concerns: