Makom privacy notice
Last updated 2026-10-20
platform-privacy/2026-10-20
1. Who is responsible
WitzLyne Ltd operates Makom and its studio-branded apps, member websites, staff tools and marketplace. Your studio decides how to provide its membership and physical services and is the controller of its member-service records. WitzLyne processes those records on its instructions and has its own duties of security and confidentiality. WitzLyne is a separate controller for platform accounts, authentication, platform security and marketplace discovery. The studio’s own notice also applies. Contact either party if you are unsure where to send a request.
2. Information and purposes
Depending on the features you use, we process identity and contact details, date of birth, optional photo and emergency contact; sign-in identifiers and session records; studio memberships, bookings, attendance and waitlists; purchases, recurring mandates, payment outcomes, refunds and tax documents; forms and acceptance evidence; messages, posts, reports and privacy preferences; device/push identifiers and limited technical diagnostics. These support the requested service, communication, fraud prevention, security, troubleshooting and legal duties. Only applicable features collect their data; optional fields can be left blank. Without required account, transaction or legally required participation information, the corresponding service may be unavailable.
3. Health information
Declarations, medical-clearance records and injury notes are especially sensitive. Your studio determines what it lawfully needs for participation and is responsible for reviewing eligibility; Makom does not diagnose or approve fitness. A specific notice and permission are requested when applicable health information is entered. Access is limited to authorised staff: managers may access declarations under the health permission; staff teaching your class may see relevant current injury notes. Other members must not receive that information. Do not put health information into public posts or marketing fields. You can correct a current note or withdraw optional permission; legal retention and a restricted claim-preservation obligation may still apply.
4. Payments and identity providers
Full payment-card details are entered with the checkout payment provider. The platform may hold provider tokens, masked card details, mandate and transaction records needed for authorised charges. Your studio identifies the seller and issues the applicable sales documents through its arrangement. Apple, Google or another supported sign-in provider supplies its identifier and permitted profile details; we do not receive that provider’s password. Device-level biometrics, where used to unlock your session, do not give us your fingerprint or face template.
5. Messages, translation and AI
Messages go to the studio or recipient shown in the interface. If automatic translation is enabled, the message text and source/target languages are sent to an external AI service, currently through OpenRouter and the selected model provider, and a translation may be cached. Details you include in the text are included in that processing. Avoid unnecessary sensitive details and consult the original for safety-critical instructions. Studio staff may use AI drafting tools for business content; these do not constitute legal or medical advice. Health records are not a marketing audience attribute or a permission for general AI training.
6. Optional visibility and marketing
Privacy settings govern whether eligible profile and attendance details appear to other members within your studio’s social features. Managed minors are excluded from member social surfaces. Your posts are visible to the audience described by the feature. Marketing choices are separate by purpose and channel where offered; accepting terms does not opt you into marketing. You can opt out in the app or through the message’s unsubscribe method. Essential booking, account, payment and safety messages are sent for their service purpose; promotional material must not be inserted to bypass your choice.
7. Recipients and providers
Information is shared with your studio’s authorised staff and providers needed for hosting, databases, authentication, payments, invoicing, messages, push delivery and diagnostics. Limited profile information may be shared according to your social settings. Cross-studio visits require the specific hosting studio and disclosed data-sharing process; one studio does not get general access to another’s records. Information may also be disclosed where legally required or necessary to establish, exercise or defend a claim, or in a business transfer with applicable protections. We do not sell personal information or grant permission for unrelated advertising use through these terms.
8. Locations and safeguards
Cloud, messaging, identity and AI providers may process information in Israel, the European Union, the United States or other disclosed service locations. An Israeli hosting choice alone does not locate every recipient in Israel. Applicable transfer safeguards and provider agreements must cover the actual processing; you can request information about the recipients and safeguards relevant to your data. We restrict access by role and studio and use technical and organisational security measures. No service guarantees absolute security. We investigate incidents and make notifications required by the law applicable to the incident.
9. Retention and restricted preservation
We keep ordinary account and service data for the service purpose and remove or anonymise it when that purpose ends, subject to applicable obligations. Tax, accounting and transaction evidence may require longer retention. Applicable gym health-declaration and medical-certificate rules may require minimum retention independent of account closure. Specific evidence may be preserved for a legal obligation or an actual or reasonably anticipated claim under a documented, access-restricted hold. Such records are not retained for marketing or ordinary social use. Routine health-data deletion or a retention sweep can remove the ordinary record while a restricted legal copy remains for its separately documented period. Retention is reviewed by purpose; a claim hold is released when its reason ends. Backups expire under their rotation and must not be used to restore erased data to ordinary use.
10. Account deletion and your choices
You can request deletion through Account & Data or the public deletion/support page. The current process offers a seven-day grace period; signing in during it cancels the request. After it, account data is erased or anonymised except records lawfully retained for the reasons above. Where an exception applies, access and use are restricted to that purpose and the reason can be explained. Deletion does not itself cancel a studio membership or recurring mandate. You can also ask to withdraw optional consent, correct data, export available account information or change privacy settings without deleting the account.
11. Rights, children and legal grounds
Israeli law provides rights of inspection and correction and applicable direct-mailing protections. Processing relies on informed permission or another authority available under applicable law; we explain whether a requested field is optional or required and the consequences of refusal. Where GDPR, UK or other privacy law applies to the processing, the corresponding grounds and rights also apply, including contractual necessity for ordinary service data, explicit permission or another lawful condition for health data, security interests where permitted, legal obligations, and rights of access, deletion, restriction, objection or portability where applicable. We do not assume a foreign law applies solely from the language you choose. A guardian must have authority for a managed child profile; report collection without appropriate permission so it can be investigated.
12. Requests, complaints and updates
Write to isaac@getmakom.com or your studio using your registered contact details. Describe the request without sending passwords, one-time codes or full card numbers. We may verify identity proportionately and route studio-controlled requests to the studio. We respond within applicable legal periods and explain a lawful refusal or retention exception. You may complain to the Israeli Privacy Protection Authority or another competent authority. Material changes to this notice will be notified as appropriate; new consent is requested where required. The document version identifies the notice supplied with an acceptance or health-data request.
Operator and contact
WitzLyne Ltd, 517400826, 6 Vilna Street, Tel Aviv-Yafo, Israel.