Legal

Privacy Policy

Last updated: 10 July 2026

Megan AI Ltd ("Megan", "we", "us", "our") provides AI-managed WhatsApp messaging for gyms. This policy explains how we handle personal information when you visit megan-ai.uk, get in touch with us, or message a gym that uses our platform. Megan AI Ltd is registered in England & Wales (company details to follow upon incorporation). We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The short version

What we collect. The details you give us when you request a demo (name, gym, email, phone number, the software you use) and standard server logs when you browse the site. For gyms on our platform, we handle WhatsApp conversations on the gym's behalf.
Why. To respond to enquiries, run and secure the website, and deliver the messaging service gyms pay us for. Nothing else.
Where it lives. In the UK and EU. WhatsApp itself is operated by Meta on global infrastructure, protected by legally recognised transfer safeguards.
No ad tracking. We use essential cookies only — no advertising cookies, no cross-site tracking, and we never sell personal information.
Your rights. You can ask for access, correction, deletion and more; see section 8.
Questions? Email hello@megan-ai.uk.

1. Our two roles: controller and processor

Data protection law distinguishes between a "controller" (who decides why and how personal information is used) and a "processor" (who handles it on the controller's instructions).

For this website and sales enquiries, Megan is the controller. This covers visitors to megan-ai.uk, demo requests, and anyone who emails us directly.

For member and lead data processed through the platform, the gym is the controller and Megan is the processor. When a gym uses Megan to manage its WhatsApp conversations, the members and leads in those conversations are the gym's contacts, not ours. We process their information only on the gym's documented instructions, under a data processing agreement (DPA) available on request from hello@megan-ai.uk.

If you are a gym member or lead and want to know how your information is used, or wish to exercise your rights over it, please contact the gym you have been messaging. We will support the gym in responding to you.

2. Information we collect

Through this website:

Demo and contact requests — your name, gym or business name, email address, phone number, and the gym management software you currently use.
Server logs — IP address, browser type, pages requested and timestamps, recorded automatically for security and reliability.
Correspondence — emails you send to hello@megan-ai.uk.

Through the platform (processed on behalf of gyms):

WhatsApp messages — the content of messages sent to and from the gym's WhatsApp number, including attachments.
Contact details — phone numbers and WhatsApp profile names of people who message the gym.
Lead and member status — labels and notes the gym keeps, such as "trial booked" or "membership renewed".
Derived analytics — statistics generated from conversations, such as response times, enquiry volumes and conversion rates.

3. Why we use information, and our lawful bases

Where Megan is the controller, we rely on the following lawful bases under UK GDPR:

Responding to demo requests and enquiries — legitimate interests: replying to a request you made and promoting our services to businesses, in ways you would reasonably expect when you contact us.
Providing and securing the website — legitimate interests: keeping the site available, safe and free from abuse.
Providing the platform to subscribed customers, including account administration and billing — performance of a contract.
Sending service updates and closely related product news to customers — performance of a contract, or legitimate interests. You can opt out of anything that is not essential to running your account.
Keeping business, billing and tax records — legal obligation.

Where Megan is the processor, the gym decides the purposes and lawful bases for the message data; we act only on its instructions under the DPA.

4. How long we keep information

Demo requests and sales correspondence — up to 24 months after our last contact with you, then deleted.
Server logs — up to 90 days.
Customer account and platform data — for as long as the subscription is active. When a subscription ends, the customer has a 30-day window to export its data, after which we delete it from live systems; residual copies are removed from encrypted backups within a further 60 days.
Billing and tax records — six years, as required by UK law.

5. Where information is stored, and international transfers

Megan stores website and platform data with hosting and database providers in the UK and the European Economic Area.

WhatsApp is operated by Meta Platforms on global infrastructure, so message data necessarily passes through Meta's systems and may be transferred outside the UK and EEA. Those transfers are protected by legally recognised safeguards, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses where EU law applies. If any of our other providers process data outside the UK or EEA, we put the same safeguards in place.

6. Who we share information with

We share personal information only with the service providers (subprocessors) needed to run Megan:

Meta Platforms — operates the WhatsApp Business API that delivers messages.
Hosting and infrastructure provider — runs the platform in UK/EU regions.
Database provider — stores platform data in UK/EU regions.
AI model providers — generate automated and suggested replies. Customer conversation data is not used to train shared or foundation AI models; providers may process it only to produce responses for that customer.
Payment provider — handles subscription billing. Card details go directly to the payment provider; we never see or store full card numbers.

We may also disclose information to our professional advisers, or where the law requires it. A current list of subprocessors is available on request. We do not sell personal information and we do not share it with advertising networks.

7. Security

We protect information with encryption in transit and at rest, access controls that limit staff access to what their role requires, and logging of administrative activity. No system is completely secure, but if a breach affects your information we will notify you and the Information Commissioner's Office where the law requires.

8. Your rights

Under UK GDPR you have the right to:

Access the personal information we hold about you.
Rectify information that is inaccurate or incomplete.
Erase your information in certain circumstances.
Port information you provided to us to another service, in a machine-readable format.
Object to processing based on legitimate interests, including any direct marketing — we will always stop marketing if you object.
Restrict processing while a dispute about the information is resolved.

To exercise any of these rights, email hello@megan-ai.uk. We will respond within one month. If your request concerns messages exchanged with a gym, we will pass it to the gym as controller and help it respond.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to resolve your concern first, but you can go to the ICO at any time.

9. Cookies

We use essential cookies only — the small files needed for the site and customer dashboard to function, such as session and security cookies. We do not use advertising cookies, cross-site tracking or any third-party ad technology. If we measure website traffic, we use privacy-preserving, cookieless analytics that count visits in aggregate and cannot identify individual visitors. Because we only set strictly necessary cookies, we do not need to ask you for cookie consent.

10. Children

Our website and services are designed for businesses and are not directed at children. Gyms are responsible for how they communicate with their own members, including any members under 18.

11. Changes to this policy

We may update this policy from time to time. We will post changes on this page and, where a change materially affects customers, notify them by email. The date at the top shows when the policy was last revised.

12. Contact

Megan AI Ltd, registered in England & Wales (company details to follow upon incorporation).

Email: hello@megan-ai.uk
Website: megan-ai.uk

If you have any question about this policy or how we handle personal information, we aim to reply within two working days.