Last updated: October 1, 2026

Privacy Policy

This Privacy Policy describes how Thagorus PBC ("Thagorus," "we," "us," or "our") collects, uses, and shares information in connection with your use of Turnout (the "Service"), our website at turnout.thagorus.com, and any related services. By using Turnout, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Information you provide directly

When you create an account or contact us, we may collect:

• Account information — your name, email address, phone number, and password.
• Studio information — studio name, location, franchise affiliation, and business details you provide during onboarding.
• Payment information — billing details processed by our third-party payment processor. We do not store full credit card numbers on our servers.
• Communications — information you provide when you contact our support team, respond to surveys, or otherwise communicate with us.

Information from Meta (Facebook/Instagram)

When you connect your Meta Business account to Turnout, we access and process data from your Meta ad account through the Meta Marketing API, including:

• Ad account data — campaign structures, ad sets, ads, ad creative, targeting parameters, budgets, and scheduling.
• Performance data — impressions, clicks, leads, conversions, cost metrics, and audience insights.
• Lead form data — form submissions generated by your ad campaigns, including the name, email, and phone number of leads who opted in through your ads.
• Page data — basic information about connected Facebook Pages and Instagram accounts necessary to run ads.

We access this data solely to provide and improve the Service. We do not access your personal Facebook or Instagram profile, private messages, or data unrelated to advertising.

Information collected automatically

• Usage data — pages viewed, features used, and actions taken within the Service, collected through Google Analytics and Microsoft Clarity (see section 5).
• Device and browser information — IP address, browser type, operating system, and device identifiers.
• Log data — server logs including access times, referring URLs, and error reports.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — create and manage your ad campaigns, optimize targeting and bidding, generate ad creative, and deliver performance reports.
• Improve our machine learning models — train and refine our algorithms using aggregated, de-identified performance patterns across the Turnout network. This allows every connected studio to benefit from collective learnings about what works in fitness studio advertising.
• Communicate with you — send account notifications, performance summaries, product updates, and respond to support requests.
• Ensure security — detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations — meet regulatory requirements and respond to lawful requests.

3. How We Share Your Information

We do not sell your personal information. We do not rent, trade, or otherwise make your individual data available to third parties for their own marketing purposes. We share information only in the following circumstances:

Service providers

We share information with third-party vendors who help us operate the Service. They process it on our behalf under their business terms. Our current service providers are:

• Supabase — database, authentication and file storage.
• Fly.io and Vercel — application hosting.
• Microsoft Azure OpenAI — AI models that we use to read and sort studio owners' emails, summarize our calls with studios, and draft ad copy and analysis. Before an owner email or call transcript is sent to these models, email addresses and phone numbers in it are replaced with placeholders.
• Google — Gmail, Drive and Calendar for our communications and meetings with studios, and Google Analytics for website usage.
• Microsoft Clarity — website usage analytics and session replay.
• Stripe — payment processing for studio owners.
• Resend — email delivery to studio owners.
• Sentry — error monitoring. Error reports can include details of the request or data being processed when the error happened.
• Twilio and CallRail — call tracking for calls placed to studios.
• Cloudflare R2 — backup storage.

Studio management systems

When someone submits a form on a studio's ad, we deliver their name, email address and phone number to that studio's membership management system (ClubReady), so the studio can respond. We mark the lead as agreeing to receive promotional text messages only when the person gave an exact affirmative answer (such as "yes" or "I agree") to a question on the form that we recognise as a text-message consent question, or submitted a form that Meta confirms showed a text-message consent disclosure. Any refusal or unclear answer means the lead is not marked as agreeing. Turnout does not text, call or email leads. Any messages come from the studio, and a person who no longer wants them can follow the opt-out instructions in the message (for example, replying STOP to a text) or contact the studio.

Meta Platforms

To manage your ad campaigns, we transmit data to and from Meta through their official APIs. This includes ad creative, targeting parameters, and budget information necessary to run your campaigns. Our use of Meta data complies with the Meta Platform Terms and Developer Policies.

We send Meta information about ad results through Meta's Conversions API, to measure and improve the ads. This covers leads from our own landing pages, and leads who later book a class or become members of the studio. For these events we send one-way hashes of the person's email address and phone number, and may also send the studio's member ID or Meta's lead ID. For actions on our own web pages, Meta also receives the browser's IP address, browser type and Meta click identifiers. Under California law this may be considered "sharing" of personal information for advertising. You can opt out as described in section 8.

Aggregate network insights

We share aggregated, de-identified performance insights across the Turnout network. For example, we may report that "fitness studios in the Northeast see 23% lower cost-per-lead when using video creative in Q1." These insights never identify individual studios, specific ad accounts, or individual users. Studios cannot see other studios' accounts or campaigns in the Service. Separately, with a studio's consent, we may publish that studio's own results, for example on our website.

Legal requirements

We may disclose your information if required by law, subpoena, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

If Thagorus is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your information becomes subject to a different privacy policy.

4. Meta Platform Data Compliance

Our handling of data obtained through Meta's APIs complies with the Meta Platform Terms, including:

• We only request permissions necessary to provide the Service (ads management, page management, leads access).
• We do not use Meta data to build or augment user profiles for advertising purposes outside of your campaigns.
• We do not transfer Meta data to data brokers, ad networks, or other advertising services unrelated to the Service.
• You can remove our access in your Meta Business settings at any time. You can also request deletion of the Meta data we hold about your account; we handle verified Meta data deletion requests within 30 days.
• We implement appropriate technical and organizational security measures to protect Meta data.

5. Cookies and Tracking Technologies

We use a minimal set of cookies and similar technologies:

We do not use advertising cookies or the Meta Pixel on our website. You can block analytics cookies through your browser settings or a browser extension; disabling essential cookies may prevent you from using certain features of the Service.

6. Data Retention

We retain your information while your account is active and as needed to provide the Service. We do not yet delete data automatically when an account closes. Instead:

• Deletion on request — you, or a lead whose information we hold, can ask us to delete personal information. We respond to each request, delete what we can locate and are not required to keep, and tell you if anything has to be kept, such as records we must retain or append-only business logs.
• Meta access — you can remove Turnout's access at any time in your Meta Business settings, which ends our access. You can also request deletion of the Meta access tokens we store; we handle verified Meta data deletion requests within 30 days.
• Aggregated/de-identified data — may be retained indefinitely as it cannot be used to identify you or your studio.
• Legal/compliance records — retained as required by applicable law (typically 3-7 years for financial records).

You may request deletion of your data at any time by contacting us at nate@schmiedehaus.com.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

• Encrypted (HTTPS) connections to our website and the Service.
• Access controls and authentication for internal systems.
• Security reviews and error monitoring.
• Meta access tokens granted through Meta Business Login kept in an encrypted vault; tokens for some older connections are still held in our server configuration.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you in accordance with applicable law.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

For all users

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information, subject to certain legal exceptions.
• Disconnect Meta — revoke Turnout's access to your Meta ad account at any time through your Meta Business settings or by contacting us.
• Data export — request a machine-readable copy of your data.

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including:

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt out of the sale or sharing of personal information. We do not sell personal information. To opt out of sharing for advertising measurement (section 3), email us with the email address and phone number you used. We add them, as one-way hashes, to an exclusion list, and we stop sending Meta any event that matches them, including the browser details attached to such an event. Visits to our web pages where you did not give an email address or phone number cannot be matched to your request.
• The right to non-discrimination for exercising your privacy rights.

To exercise any of the rights in this section, including access, correction, deletion, export, restriction and objection, contact us at nate@schmiedehaus.com. We will respond to verifiable requests within 45 days, tell you what we did, and explain anything we could not do and why. For Meta data deletion, we handle verified requests within 30 days.

European Economic Area, UK, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation, including the rights listed above as well as:

• The right to restrict processing of your personal information.
• The right to object to processing based on legitimate interests.
• The right to data portability.
• The right to lodge a complaint with a supervisory authority.

Our legal bases for processing are: performance of our contract with you (to provide the Service), our legitimate interests (to improve the Service and protect our business), and your consent (where applicable).

9. Children's Privacy

Turnout is a business-to-business service designed for fitness studio operators. It is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at nate@schmiedehaus.com and we will act promptly as described in section 8.

10. International Data Transfers

Turnout is operated from the United States. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States. We take appropriate safeguards to ensure your information is protected in accordance with this Privacy Policy and applicable law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we change it, we update the date at the top of this page. If a change materially affects how we use your information, we will also email studio account holders about it.

12. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

• Email: nate@schmiedehaus.com
• Company: Thagorus PBC
• Company: Thagorus PBC, a Delaware company operating from Austin, Texas.
• Website: turnout.thagorus.com