Privacy policy.

The controller of the personal data collected through the fiilin.fr website and the Fiilin mobile app is Yabbel, a French SAS with a share capital of €9,000, operating the Fiilin brand, registered with the Paris trade register (RCS) under number 980 945 190, whose registered office is at 14 rue Truffaut, 75017 Paris, France.

Contact: contact@fiilin.fr.

We only collect the data needed for the purposes described below. On the fiilin.fr website, depending on how you interact with it, the data collected may include:

• Identification data: last name, first name, email, phone (contact forms).
• Professional data: gym name, city, number of members, management software used (manager form).
• Technical data: browser and device type, pages visited, country, page performance metrics (Vercel Web Analytics and Speed Insights — no cookies, IP address not stored).

The Fiilin mobile app (and its web version app.fiilin.fr) lets you order a drink from the Fiilin vending machines installed in gyms. To provide this service, it processes:

• Account data: first name, last name, email address, age, device language.
• Consumption data: drinks ordered, date, time and machine used, memberships and packs purchased, remaining credits.
• Payment data: bank cards are stored and processed by our provider Stripe; Fiilin never stores your full card number.
• Loyalty and referral programme: points, level, completed challenges, referrals.
• Preferences: notification and communication settings, chosen fitness goals.
• Support: reviews and complaints you send us.
• Technical data: push notification token and device identifier (abuse prevention).

The camera is only used to scan the machine's QR code: no image is stored. This data is kept as long as your account is active, then deleted or anonymised, subject to legal retention obligations (accounting: 10 years). You can delete your account at any time from the app (My account ▸ My settings).

You can create your account or sign in to the Fiilin app with your Google account (“Continue with Google”) or Apple account. In that case, we only receive:

• your first and last name;
• your email address;
• your profile picture, if Google provides one.

This information is used solely to create your Fiilin account, identify you when you sign in and contact you about your account. We do not access any other data from your Google account (contacts, calendar, emails, files…).

Data received from Google is never sold, rented or shared with third parties, except with the technical processors strictly required to run the service (Google Cloud / Firebase hosting). It is never used for advertising, nor to train artificial intelligence models. Fiilin's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

It is kept as long as your account is active and deleted along with it. You can delete your account at any time from the app or by writing to contact@fiilin.fr, and revoke Fiilin's access to your Google account at myaccount.google.com/permissions.

Your data is processed for the following purposes:

• Responding to your contact and demo requests.
• Sending you information about our products if you have consented to it.
• Improving the site and our services through anonymised audience analysis.
• Meeting our legal and regulatory obligations.

Depending on the case, the processing of your data rests on the following legal bases:

• Your consent (GDPR, art. 6.1.a) for marketing communications.
• Performance of pre-contractual measures (art. 6.1.b) for demo and quote requests.
• Our legitimate interest (art. 6.1.f) for improving the site and for security.

Your data is only accessible to authorised Fiilin staff and to our technical processors: Google Cloud / Firebase (app hosting and authentication), Stripe (payments), Vercel (website hosting) and our email delivery tools. When your gym uses a management software connected to Fiilin, your email is used to check your membership with that software. All our processors are bound by confidentiality and security commitments compliant with the GDPR.

Your data is never sold or rented to third parties for commercial purposes.

• Contact / demo requests: 3 years from the last exchange.
• Prospect data: 3 years after the last active contact.
• Audience measurement data: no individual retention (the technical identifier used by Vercel Web Analytics is reset every 24 hours and cannot identify a visitor).
• Accounting and contractual documents: 10 years (legal obligation).

Under the GDPR and the French Data Protection Act, you have the following rights:

• The right to access, rectify and erase your data.
• The right to restrict and object to processing.
• The right to data portability.
• The right to withdraw your consent at any time.
• The right to lodge a complaint with the CNIL (cnil.fr).

To exercise these rights, contact us at contact@fiilin.fr, setting out your request and attaching a copy of an identity document if necessary.

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, alteration or destruction: TLS encryption, access control, regular backups, security audits.

The site uses a minimal number of cookies. No advertising or third-party tracking cookies are set. Audience measurement is handled by Vercel Web Analytics, a cookieless tool that does not identify visitors.

You can manage your preferences at any time through the module in the footer.

For any question about the processing of your personal data, you can contact our data protection officer:

Email: contact@fiilin.fr.