Privacy Policy

1. Overview

Aeon Kairos ("we," "us," or "our") is a business operations platform for boutique fitness businesses, operated by MNBK LLC. This Privacy Policy explains how we collect, use, store, and share information when you use the Aeon Kairos platform, including our web dashboard, APIs, and any associated services (collectively, the "Platform").

Aeon Kairos operates as both a data controller (for information we collect directly, such as account information from business owners and staff) and a data processor (for information that fitness businesses — our customers — collect from their members and process through our Platform).

By using the Platform, you agree to the practices described in this policy.

2. Who This Policy Covers

This policy applies to:

• Business Owners and Staff — businesses and individuals who create an Aeon Kairos account and use the Platform to manage their operations
• Business Members and Leads — individuals whose information is entered into the Platform by a fitness business using Aeon Kairos

If you are a business member or lead and have questions about how your specific business handles your data, please contact that business directly. They are the data controller for your personal information within their account.

3. Information We Collect

3A — Information from Business Owners and Staff

When a fitness business creates an account, we collect:

• Business name, address, and contact information
• Owner and staff names, email addresses, and phone numbers
• Billing information (processed by Stripe — we do not store payment card details)
• Account credentials and authentication data
• Platform usage data, including feature interactions and session activity

3B — Information Processed on Behalf of Business Customers

Fitness businesses using Aeon Kairos may enter or import data about their members and leads. This may include:

• Member names, email addresses, and phone numbers
• Membership plan and billing status
• Class attendance, booking history, and check-in records
• Health and fitness data, including body composition scans (InBody), physical assessments, and nutrition logs
• Coaching notes, program phases, and call history
• SMS and in-app message history
• Gamification data including experience points, badges, and skill progression
• Lead source and advertising attribution data
• Consult and appointment history

We process this data on behalf of and under the instruction of the fitness business. We do not use member data for our own marketing or sell it to third parties.

3C — Information from Meta (Facebook/Instagram)

A business can connect its own Facebook Page and, optionally, its own Meta ad account to Aeon Kairos using Facebook Login for Business. Only the business's owner or admin in Aeon Kairos can connect, change, or disconnect the integration. A plain-language summary is available on our Meta integration page.

Data we receive from Meta:

• Names and IDs of the Facebook Page, ad account, and Meta business the person selects when connecting, and the name and ID of any Instagram professional account linked to that Page (detected but not used for any feature)
• Instant Form (Lead Ads) submissions for the connected Page, including the submitter's name, email, phone number, form answers, and the form, ad, ad set, and campaign IDs
• Campaign, ad set, and ad status and budgets, and performance metrics such as spend, impressions, clicks, and leads for the connected ad account
• Meta access tokens that let Aeon Kairos make requests on the business's behalf

How we use it: solely to provide Meta features to the business that connected it — turning Instant Form submissions into leads in that business's lead pipeline (duplicates are prevented), ad reporting and lead attribution (including a daily sync of ad-level performance), and ad management that the business's owner or admin initiates (pausing and resuming campaigns, ad sets, and ads; changing daily budgets within a maximum the business sets; and creating new lead campaigns, which always start paused). We never use one business's Meta data for another business. We do not access Messenger, Instagram Direct, comments, or publishing features.

Who can act on it: the business's owner and admin roles can connect, disconnect, and change ads. Other staff of that business can view Meta information but cannot change it. Consequential Meta actions (connecting, asset selection, disconnecting, lead syncs, ad changes, and blocked attempts) are recorded in an activity log visible to the business.

Where it is stored: in our database hosted by Supabase. Meta access tokens are stored encrypted in the database's secret vault (Supabase Vault), used server-side only, and never sent to the browser. Tenant isolation is enforced with row-level security and per-location checks.

Retention, disconnection, and deletion:

• Disconnecting in Aeon Kairos deletes our stored Meta access tokens for that business location, unsubscribes the Page from our lead webhook, and stops further retrieval from Meta.
• Removing Aeon Kairos in your Facebook settings, or sending a data-deletion request through Facebook, triggers our deauthorization and data-deletion callbacks: we delete the access tokens for every business location connected through that Facebook user and clear the stored Page, ad account, business, and Instagram names and IDs. For deletion requests, we provide a confirmation code and a status page where the request can be checked. More information is available on our data deletion page.
• Leads already imported are the business's customer records and are not automatically deleted when Meta is disconnected. The business can delete them in Aeon Kairos. If you submitted a lead form, you can ask that business, or contact us at privacy@aeonkairos.com.
• Ad performance metrics already synced remain part of the business's reporting history until the business account is deleted.

3D — Automatically Collected Information

When you use the Platform, we automatically collect:

• IP address and device information
• Browser type and operating system
• Pages visited and features used
• Session timestamps and duration
• Error logs and performance data

4. How We Use Information

For Business Owners and Staff:

• To create and manage your account
• To provide, operate, and improve the Platform
• To process billing through Stripe
• To send transactional communications (account alerts, billing notices, platform updates)
• To provide customer support
• To monitor platform security and prevent fraud

For Business Member and Lead Data:

• To provide the features and functionality requested by the fitness business
• To power AI-assisted analysis, recommendations, and message drafting on behalf of the fitness business
• To generate action center signals, member health scores, and lifecycle metrics for the fitness business
• To facilitate SMS, email, and in-app communication initiated by the fitness business and its staff, or sent automatically by AI follow-up features the business has enabled (see Section 5)
• To display gamification progress (XP, badges, levels) within the Platform

We do not use business member or lead data to train AI models, sell it to advertisers, or contact members or leads for our own purposes.

5. Artificial Intelligence and Automated Processing

Aeon Kairos uses the Anthropic Claude API to power features including action center analysis, message draft generation, call brief generation, and ad performance verdicts.

When AI features are used, member and lead data relevant to the specific task is sent to Anthropic's API for processing.

Recommendations and drafts for staff

Some AI features generate recommendations, analyses, call briefs, and message drafts for the business's staff to review and act on.

Automated AI follow-up (AI Nurture add-on)

If a business enables the AI Nurture add-on and its automated follow-up setting, AI composes and sends SMS and email follow-ups to that business's leads automatically, in the voice the business has configured, without staff approving each message. These automated sends are limited by:

• SMS opt-out (replying STOP) and each lead's contact consent and channel settings
• Quiet hours
• Staff takeover — when a staff member takes over a conversation, AI follow-up stops for that lead

Leads received from Meta Instant Forms can enter this automated follow-up if the business has it enabled. Aeon Kairos does not use AI to send Messenger or Instagram messages. The business is responsible for how it configures automated follow-up and for the consent and content of the messages sent on its behalf.

We do not use customer data to train AI models. Anthropic processes data sent to its API under its own commercial terms and policies.

6. SMS Communications

Aeon Kairos facilitates SMS communications between fitness business staff and their members and leads via Twilio, including automated AI follow-up where a business has enabled it (see Section 5).

• Outbound SMS messages are only sent to individuals who have provided explicit SMS consent
• Consent records are maintained per member per fitness business location
• Members may opt out at any time by replying STOP to any SMS message
• SMS opt-out requests are processed immediately and recorded in the Platform
• Fitness businesses are responsible for obtaining and documenting member SMS consent

7. How We Share Information

We do not sell personal information. We share information only in the following circumstances:

Service Providers

We share data with third-party vendors who help us operate the Platform, including:

• Supabase — database hosting and authentication
• Vercel — platform hosting and deployment
• Stripe — payment processing
• Twilio — SMS and voice communications
• Anthropic — AI analysis and content generation

We select service providers that process data to provide their services to us under their terms.

Meta Platforms (Facebook/Instagram)

When a business connects its Facebook Page and ad account, data flows from Meta to Aeon Kairos as described in Section 3C. Aeon Kairos sends requests to Meta's APIs to set up and remove the connection (such as subscribing or unsubscribing the Page from our lead webhook), to retrieve that business's leads and ad data, and to carry out actions the business's authorized staff initiate — for example, pausing a campaign, changing a daily budget, or creating a new lead campaign in paused status.

Fitness Businesses

Data entered by a fitness business is accessible to that business's authorized staff only. We do not share one business's data with another business or any third party.

Legal Requirements

We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of Aeon Kairos, our customers, or others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users prior to any such transfer.

8. Data Retention

• Business owner and staff account data is retained for the duration of the account and for 90 days following account termination, after which it is deleted
• Business member and lead data is retained as long as the fitness business account is active. Upon account termination, the fitness business may request export of their data within 30 days, after which data is deleted
• Billing records are retained for 7 years as required by financial regulations
• Audit logs are retained for 2 years
• SMS opt-in and consent records are retained for 5 years following the last recorded interaction
• Meta data is retained, disconnected, and deleted as described in Section 3C

9. Data Security

We implement industry-standard security measures to protect your information, including:

• Row-level security ensuring each fitness business can only access their own data
• Encryption of sensitive integration credentials at rest
• HTTPS encryption for all data in transit
• Webhook signature validation for all inbound data from third-party services
• Access controls limiting platform staff access to tenant data

No method of transmission or storage is 100% secure. In the event of a data breach affecting your information, we will notify affected parties as required by applicable law.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate information
• Deletion — request deletion of your personal information, subject to legal retention requirements
• Portability — request your data in a portable format
• Objection — object to certain types of processing

Business members and leads: To exercise these rights, please contact the fitness business that manages your membership. You may also contact us at privacy@aeonkairos.com and we will direct your request appropriately.

Business owners and staff: Contact us at privacy@aeonkairos.com.

We will respond to all verified requests within 30 days.

11. Children's Privacy

The Aeon Kairos Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor's information has been submitted to the Platform, please contact us at privacy@aeonkairos.com and we will take steps to delete it.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify business owners via email. Your continued use of the Platform after any update constitutes acceptance of the revised policy.

14. Contact

For privacy-related questions, requests, or concerns: