KalisteraAccount sign-in
We use Google Sign-In to authenticate. We store your name, email address, and profile picture URL as provided by Google — never your Google password.
Privacy policy
Last updated: November 2026 · עברית
Kalistera is workspace software for gyms and studios (schedule, members, leads, billing) with a companion client app for their members. This page explains what we collect and why, for both the business (CRM) side and the client app.
Signup attribution
For business signups, a first-touch cookie may retain the landing page, referring site, UTM campaign fields, and Google Ads click ID for up to 30 days. If a new business workspace is created, those fields are stored with the organization for acquisition reporting. Referrer query strings and fragments are not retained.
Website contact form
If you leave your details or send a support request on kalistera.com, we store the name, phone number, and any optional details you type (email, business name and type, size, current system, message) so the Kalistera team can call you back or answer you. Demo requests are saved as a lead in Kalistera's own sales workspace, and the team is also notified by email. Support requests are sent by email only. The first-touch attribution described above (landing page, referring site, UTM fields) is attached to a demo request. The form uses no third-party scripts. We use these details only to respond to you and to follow up on your request, and you can ask us to delete them at contact@kalistera.com.
Optional Google Calendar sync
If you connect Google Calendar, we store an encrypted refresh token, your Google account identifier and email, and identifiers of the class or staff-task events we create. With your permission, we add confirmed classes to your primary calendar and update or remove those events when bookings change. Staff can separately opt in from user settings to sync their future assigned tasks from businesses where they have active linked staff access. Task events contain only the task title, business name and times, not descriptions or linked client details. Completion, deletion or reassignment removes the task event. We do not list or copy unrelated calendar events. Parent accounts sync the classes of every linked participant. Disconnecting a sync source stops its updates; stored Google authorization is deleted when no sync source remains enabled; existing Google events remain. You can also revoke access in your Google account settings. Account deletion removes the stored connection and event mappings. Google user data is used only for this feature, is not sold, used for advertising, or used to train AI, and its use is subject to the Google API Services User Data Policy, including its Limited Use requirements.
How we protect your data
We protect personal and sensitive data, including Google user data, with these safeguards. Encryption in transit: all traffic between your device, our servers, our database and Google's APIs uses HTTPS/TLS. Encryption at rest: Google Calendar refresh tokens and other integration credentials are encrypted with AES-256-GCM using a key held in our hosting provider's secret store, separate from the database; short-lived Google access tokens are used only in server memory and are never stored. Our managed database provider also encrypts all stored data at rest. Access control: the server only decrypts your Google authorization to sync your own classes or explicitly authorized staff tasks; studio staff never see your Google credentials or calendar, and access to production systems is limited to authorized Kalistera personnel who need it to operate the service. Data minimization: we request the narrowest calendar permission the feature needs, send Google only the class title, studio, room and time, or the task title, business and time, and only read or change events we created. Retention and deletion: Google user data is kept only while your calendar connection is active; disconnecting the final enabled sync source deletes the stored authorization immediately, and account deletion removes the connection and event records. We do not sell or transfer Google user data to third parties. If a security incident affects your data, we will notify you and the relevant authorities as required by law.
Booking & membership data
If you use the client app, we store the classes you book, your attendance, and your membership/plan details so the business you train with can serve you.
Payments
Payments are processed by the business's own connected payment provider. Kalistera stores payment records (amount, status, description) but never full card numbers.
Push notifications
If you enable push notifications, we store a device token (via Firebase Cloud Messaging) to deliver booking, reminder, and payment-receipt notifications. You can disable this at any time in Settings.
Device & diagnostic data
Standard web server logs (IP address, browser type, timestamps) for security and reliability — not shared with third parties beyond what's needed to operate the service.
Connected Meta Ads data
When an authorized business connects Meta Ads, we store an encrypted authorization token and the selected ad account's identifier, name, currency, and timezone. We read campaign, ad-set, ad, and performance data such as spend, impressions, reach, clicks, and attributed lead counts to display the business's report. This reporting connection does not retrieve lead contact details, create ads, or change campaigns or budgets. Report data is read live and is not retained as historical advertising snapshots. The connection remains until an authorized user disconnects it, deletes the business account, or the authorization expires or is revoked.
Connected Facebook lead forms
If your business enables direct Facebook lead intake and separately authorizes it, we store encrypted Page authorization tokens, the selected Page and form identifiers, and the destination branch. New inquiries from those forms, including names, contact details and mapped answers, become lead records for your business. We retain provider identifiers and processing receipts to prevent duplicate imports, including after a lead card is deleted. Disconnecting lead intake removes its stored tokens and stops new imports; previously received lead records are managed separately. Removing Kalistera in Facebook revokes access for the whole app and may also affect advertising reports.
Your choices
You can request access to or deletion of your data at any time by contacting the business you train with, or contact@kalistera.com directly. Full account-deletion steps are at kalistera.com/account-deletion.
Questions? Email contact@kalistera.com.