Privacy Policy

IronhausAI is operated by ABDUL SAMAD SIDDIQUI in Karachi, Pakistan. For our own website, owner accounts, support and billing administration, the operator is responsible for deciding how personal information is used. Privacy enquiries can be sent to privacy@ironhausai.com.

IronhausAI (“we,” “our,” or “us”) operates an AI-powered automation platform designed for independent gyms and fitness facilities. Our services include website and Instagram assistants, lead capture tools, pending intro-session request capture, and email notifications for gym owners.

This Privacy Policy applies to all users who interact with our platform, including visitors to our website at www.ironhausai.com, individuals who send messages through Instagram to gym pages powered by our AI, and gym owners who use our dashboard and notification services.

We collect the following categories of information:

Contact Form Enquiries

When you contact IronhausAI about the pilot, setup, or support, we receive your name, email address, optional gym or organisation, selected topic, and message. We send these details through Resend to our support mailbox to respond to your enquiry. Contact form messages are not stored in the application database or sent to our AI agent. A hashed IP identifier is used in Upstash to limit contact submissions and prevent abuse.

Chat and Instagram Interaction Information

• A website session identifier or Instagram-scoped sender ID
• Message content sent through website chat or to a connected gym's Instagram account
• Message IDs (used for deduplication and delivery confirmation)
• Timestamps of interactions

Owner Account and Workspace Information

• Account name and email address
• Gym profile information, including approved knowledge, notification address, website, phone, address, and timezone
• Connected Instagram profile identifiers, connection status, permission metadata, and encrypted provider access tokens
• Subscription status, billing period dates, provider customer and subscription identifiers, and monthly website-message usage

Information You Voluntarily Provide

• Full name, email address, and phone number (when you express interest in a gym membership or booking)
• Preferred session dates and fitness goals
• Any additional notes or messages shared during conversation

Automatically Collected Data

• Session identifiers (randomly generated UUIDs for conversation continuity)
• Basic analytics data via Vercel Analytics and Google Analytics (page views, device type, country)
• Aggregate AI run metadata, including model name, token counts, tool-call count, duration, success or failure category, and estimated cost. This record does not contain message content.

For owner accounts and requested services, we use information to perform our agreement or take steps you request before an agreement. We use limited security and diagnostic information for our legitimate interests in preventing abuse and keeping the service reliable, subject to applicable rights. Records required by law are processed to meet those obligations. Optional website analytics relies on your permission.

For a gym's customer conversations and leads, the gym decides the purposes and applicable legal basis. IronhausAI processes that information on the gym's instructions to provide its assistant and staff handoff. Contact the gym first about its customer records; we can help route a request. We do not use gym customer messages to train our own general-purpose model.

Do not send medical records, diagnoses or other unnecessary sensitive information to the assistant. It is an enquiry and staff-handoff service, not medical advice or an emergency service. AI responses and pending intro requests are subject to staff review; they do not determine eligibility for healthcare or credit.

We use the information we collect to:

• Respond to pilot enquiries, setup questions, and support requests sent to IronhausAI.
• Provide automated, AI-powered responses to your Instagram DM inquiries about gym memberships, pricing, and class schedules
• Capture and store lead information (name, email, phone) so the gym owner can follow up with you personally
• Record intro-session requests for gym staff to review and confirm; the assistant does not confirm calendar availability
• Send instant email notifications to gym staff when a new lead or booking is captured
• Maintain conversation context for coherent, helpful interactions across the website widget and Instagram
• Prevent abuse through rate limiting (maximum 10 messages per sender per minute)
• Diagnose failures and maintain platform reliability

Our operator is based in Pakistan. Providers may process information in other countries depending on their service and configured region. Contact privacy@ironhausai.com for information about a particular processing arrangement. Where applicable law requires a transfer mechanism or a gym data-processing agreement, that arrangement must be established before the relevant processing begins; this notice does not itself create a transfer safeguard.

We do not sell, rent, or trade your personal information to any third party. We use the following providers to operate the service and, when you permit it, provide optional website analytics:

We may also disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of our users and the public.

Automatic expiry is handled by scheduled cleanup rather than immediate deletion at the exact cutoff. Failed or delayed jobs can delay removal; contact us to request deletion or confirm the status of your records.

• Contact and support emails remain in our support mailbox until manually deleted; there is currently no fixed retention period or automatic deletion schedule. These mailbox copies are separate from the database records below. You can request deletion using the privacy contact in this policy.
• Lead and intro-request records currently have no automatic expiry and are retained until a valid deletion request or operational removal.
• Messages and conversation records are stored in PostgreSQL. Individual message records are deleted after 90 days. Inactive website conversation records are deleted after 90 days. Instagram conversation metadata has no automatic expiry and remains until a valid deletion request or operational removal.
• Agent session context may contain a separate copy of message history used to maintain conversation continuity. Individual history items are deleted after 90 days, including in active sessions. Inactive session records are also deleted after 90 days.
• Aggregate AI usage records contain no prompt or response text and are automatically deleted after 90 days.
• Webhook delivery records are stored in PostgreSQL and automatically deleted after 30 days.
• Rate-limiting state supports enforcement windows of one minute, ten minutes or one hour, depending on the endpoint. Provider diagnostic and aggregate analytics records may remain beyond these windows.

Rights depend on the applicable law and the purpose of processing. Where available, you may also request restriction, object to processing, request portability, or complain to your local data-protection authority, including the ICO in the UK. We may need proportionate information to verify a request without collecting unnecessary identity documents.

Google Analytics and Vercel Analytics are disabled until you select Accept all in the cookie banner. Your choice is stored in this browser for up to 180 days. Necessary only does not prevent sign-in or use of the service. Withdraw or change your choice using Cookie settings. Essential session, security and chat-continuity storage is separate from optional analytics. Read our Cookie policy for details.

You have the right to:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request that we delete your personal data from our systems.
• Opt-out — Stop interacting with the AI-powered Instagram DM assistant at any time by simply not sending further messages. The AI will not proactively message you.
• Withdraw consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at the email address listed in the Contact Us section below. We will respond to your request within 30 days.

We implement industry-standard security measures to protect your data:

• HMAC-SHA256 signature verification on all incoming Meta webhooks to prevent forged requests
• HTTPS encryption for all data in transit between your browser, Instagram, and our servers
• Timing-safe authentication using cryptographic comparison for API keys
• Per-sender rate limiting to prevent automated abuse
• Message deduplication and persistent reply state to reduce duplicate processing and replies
• Encrypted provider tokens using authenticated AES-256-GCM encryption
• Parameterized database queries to prevent SQL injection attacks

While no system can guarantee absolute security, we take reasonable and appropriate measures to safeguard your personal information against unauthorized access, alteration, disclosure, or destruction.

Our services are not directed at individuals under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 13, we will take steps to delete that information as promptly as possible.

If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this page periodically to stay informed about how we protect your data. This notice explains our practices; continued use does not give consent to new processing. Where a change requires your consent, we will ask separately.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:

We aim to respond to all privacy-related inquiries within 30 calendar days.