Last updated: April 9, 2026

Privacy Policy

This Privacy Policy describes how Thagorus PBC ("Thagorus," "we," "us," or "our") collects, uses, and shares information in connection with your use of Turnout (the "Service"), our website at turnout.thagorus.com, and any related services. By using Turnout, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Information you provide directly

When you create an account or contact us, we may collect:

• Account information — your name, email address, phone number, and password.
• Studio information — studio name, location, franchise affiliation, and business details you provide during onboarding.
• Payment information — billing details processed by our third-party payment processor. We do not store full credit card numbers on our servers.
• Communications — information you provide when you contact our support team, respond to surveys, or otherwise communicate with us.

Information from Meta (Facebook/Instagram)

When you connect your Meta Business account to Turnout, we access and process data from your Meta ad account through the Meta Marketing API, including:

• Ad account data — campaign structures, ad sets, ads, ad creative, targeting parameters, budgets, and scheduling.
• Performance data — impressions, clicks, leads, conversions, cost metrics, and audience insights.
• Lead form data — form submissions generated by your ad campaigns, including the name, email, and phone number of leads who opted in through your ads.
• Page data — basic information about connected Facebook Pages and Instagram accounts necessary to run ads.

We access this data solely to provide and improve the Service. We do not access your personal Facebook or Instagram profile, private messages, or data unrelated to advertising.

Information collected automatically

• Usage data — pages viewed, features used, and actions taken within the Service.
• Device and browser information — IP address, browser type, operating system, and device identifiers.
• Log data — server logs including access times, referring URLs, and error reports.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — create and manage your ad campaigns, optimize targeting and bidding, generate ad creative, and deliver performance reports.
• Improve our machine learning models — train and refine our algorithms using aggregated, de-identified performance patterns across the Turnout network. This allows every connected studio to benefit from collective learnings about what works in fitness studio advertising.
• Communicate with you — send account notifications, performance summaries, product updates, and respond to support requests.
• Ensure security — detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations — meet regulatory requirements and respond to lawful requests.

3. How We Share Your Information

We do not sell your personal information. We do not rent, trade, or otherwise make your individual data available to third parties for their own marketing purposes. We share information only in the following circumstances:

Service providers

We share information with third-party vendors who help us operate the Service, including cloud hosting providers, payment processors, analytics services, and email delivery services. These providers are bound by contractual obligations to keep your information confidential and use it only to provide services to us.

Meta Platforms

To manage your ad campaigns, we transmit data to and from Meta through their official APIs. This includes ad creative, targeting parameters, and budget information necessary to run your campaigns. Our use of Meta data complies with the Meta Platform Terms and Developer Policies.

Aggregate network insights

We share aggregated, de-identified performance insights across the Turnout network. For example, we may report that "fitness studios in the Northeast see 23% lower cost-per-lead when using video creative in Q1." These insights never identify individual studios, specific ad accounts, or individual users. No studio can see another studio's specific data, campaigns, or performance metrics.

Legal requirements

We may disclose your information if required by law, subpoena, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

If Thagorus is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your information becomes subject to a different privacy policy.

4. Meta Platform Data Compliance

Our handling of data obtained through Meta's APIs complies with the Meta Platform Terms, including:

• We only request permissions necessary to provide the Service (ads management, page management, leads access).
• We do not use Meta data to build or augment user profiles for advertising purposes outside of your campaigns.
• We do not transfer Meta data to data brokers, ad networks, or other advertising services unrelated to the Service.
• We delete Meta data associated with your account when you disconnect your Meta account or request deletion.
• We implement appropriate technical and organizational security measures to protect Meta data.

5. Cookies and Tracking Technologies

We use a minimal set of cookies and similar technologies:

We do not use third-party advertising cookies or tracking pixels on our website. You can control cookies through your browser settings, though disabling essential cookies may prevent you from using certain features of the Service.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service. Specifically:

• Account data — retained while your account is active and for up to 90 days after account closure to allow for reactivation.
• Ad performance data — retained while your account is active to provide historical reporting and improve our models. Deleted within 90 days of account closure.
• Lead data — retained while your account is active. Deleted within 30 days of account closure or upon request.
• Aggregated/de-identified data — may be retained indefinitely as it cannot be used to identify you or your studio.
• Legal/compliance records — retained as required by applicable law (typically 3-7 years for financial records).

You may request deletion of your data at any time by contacting us at nate@thagorus.com.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Access controls and authentication for internal systems.
• Regular security assessments and monitoring.
• Secure credential storage for Meta API tokens using industry-standard encryption.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you in accordance with applicable law.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

For all users

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information, subject to certain legal exceptions.
• Disconnect Meta — revoke Turnout's access to your Meta ad account at any time through your Meta Business settings or by contacting us.
• Data export — request a machine-readable copy of your data.

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including:

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt out of the sale or sharing of personal information. (We do not sell personal information.)
• The right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at nate@thagorus.com. We will respond to verifiable requests within 45 days.

European Economic Area, UK, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation, including the rights listed above as well as:

• The right to restrict processing of your personal information.
• The right to object to processing based on legitimate interests.
• The right to data portability.
• The right to lodge a complaint with a supervisory authority.

Our legal bases for processing are: performance of our contract with you (to provide the Service), our legitimate interests (to improve the Service and protect our business), and your consent (where applicable).

9. Children's Privacy

Turnout is a business-to-business service designed for fitness studio operators. It is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at nate@thagorus.com and we will promptly delete it.

10. International Data Transfers

Turnout is operated from the United States. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States. We take appropriate safeguards to ensure your information is protected in accordance with this Privacy Policy and applicable law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

• Email: nate@thagorus.com
• Company: Thagorus PBC
• Address: Westford, MA
• Website: turnout.thagorus.com