Gili Privacy Policy

Last updated: 13 October 2026

1. About this policy

Gili is operated by Starmaur Nigeria Limited, incorporated in Nigeria with registration number RC 1804391, at 12B Admiralty Way, Lekki, Lagos, Nigeria. Contact us through Gili’s in-app support or at support@gili.app.

This policy explains how we collect, use, disclose and retain personal information in connection with Gili. Gili provides software for fitness studios, event organisers and independent trainer businesses, referred to here as organisations, to manage their services and member relationships. It covers the features available to you; describing a feature does not promise that it is available to every organisation. Our current market is Nigeria.

The organisation provides the underlying service. Its privacy notice explains its own use of member information and should be read alongside this policy.

2. Our role and the organisation’s role

Starmaur is a data controller for Gili account administration, payment and settlement administration, service communications, support, platform security and our own product analytics. We determine the purposes of those activities and remain responsible for the obligations that apply to us.

Organisations determine the information needed for their member relationships, how they use that information and their lawful retention instructions. Where we process member information on an organisation’s behalf, we act as its processor under our data-processing terms. If either party determines a separate processing purpose, its controller obligations apply to that purpose. Legal responsibilities depend on the actual processing, not solely on the label used in an agreement.

You may have a Gili account and separate member records with one or more organisations. Closing your Gili account does not automatically delete each organisation’s records. You may contact the organisation about those records or ask Gili to assist with your request.

3. Information we handle and its sources

The information handled depends on your use of Gili, the enabled features and the organisation’s requirements.

We receive information from you; organisations and people authorised to act for them; Google when you choose Google sign-in; payment and other service providers; and the operation of the platform. A person supplying information about someone else must have appropriate authority and comply with applicable privacy requirements.

Payment credentials required for checkout are collected by the payment provider. Gili receives the transaction information returned by that provider. Do not send card PINs, bank authorisation codes or other sensitive payment credentials to Gili support.

An organisation may require sensitive information, including health information, for its services. It must establish an appropriate lawful basis, provide the required privacy information and apply the additional safeguards required by law. Health information is not a general requirement for opening a Gili account. Our handling of organisation-controlled information remains subject to our own applicable obligations.

4. Sign in with Google

Google sign-in is optional. When you choose it, Gili requests your name, email address and avatar to create, identify and authenticate your Gili account. This sign-in feature does not request access to Gmail, contacts, Google Calendar, Drive or other Google account content.

Your resulting Gili account email is also used for account and service communications, payment administration and analytics identification as described in this policy. Organisations collect their member information through separate forms. Choosing Google sign-in does not automatically populate an organisation’s member or trainer profile with your Google avatar or other Google profile information.

We handle information received through Google in accordance with the Google API Services User Data Policy, including any Limited Use requirements applicable to the information and permissions involved. Additional Google services would require the relevant separate permissions and disclosures before access.

You can review or revoke the connection through your Google Account permissions. Revoking it is separate from closing your Gili account or requesting deletion of information already held by Gili or an organisation. Contact support@gili.app if you need assistance.

5. Purposes and lawful bases

We use relevant information for the following purposes:

For organisation-controlled member information, the organisation determines and communicates the lawful basis. We act on lawful instructions and assist with applicable obligations. Acknowledging this policy or accepting the Terms is not blanket consent to unrelated processing.

Information requested as necessary for an account, transaction or organisation service may be needed to provide that function. If you do not supply it, the affected function may not be available. Optional processing must not be made a condition of an unrelated service where the law prohibits that condition.

We do not currently send promotional or marketing messages to members. If introduced, those messages require explicit opt-in, which you may withdraw through the method offered or by contacting us. Necessary account, transaction and service communications are separate from marketing.

We do not sell personal information, use it for advertising or use it to train AI models. We may retain and use genuinely anonymised statistics that cannot reasonably identify a person to understand and improve the service.

6. Cookies, analytics and automated functions

Gili uses cookies and similar mechanisms for sign-in, account sessions, security and preferences. Analytics uses identifiers to measure usage and may associate page visits, feature activity and error reports with an account email or identifier. Where configured, identifiers may be used across Gili subdomains.

Optional analytics or other non-essential tracking is subject to the consent required by applicable law. You may withdraw consent or object to relevant processing by contacting in-app support or support@gili.app. Browser settings can also limit cookies, although blocking necessary cookies may prevent sign-in or requested functions from working. Browser controls do not replace any consent mechanism required by law.

Some functions apply predefined rules to payment status, membership validity, access limits or attendance. Organisations remain responsible for their service eligibility policies and decisions. If an automated result materially affects you, you may contact the organisation or Gili support to request an explanation and review, including human intervention where required by law.

7. Disclosures and access

Information may be disclosed, as necessary for the relevant purpose, to:

• The organisation whose services you use and its authorised administrators or trainers.
• Providers of payment collection, bank verification, settlement, refunds and dispute administration.
• Providers of hosting, databases, storage, authentication, security, communications and product analytics.
• Professional advisers, courts, regulators or other entitled recipients where disclosure is necessary and lawful for a legal obligation, claim or protection of rights.
• A successor in a corporate transaction, subject to an appropriate lawful basis, confidentiality, safeguards and any required notice or consent.

Providers acting on our behalf are subject to appropriate data-protection obligations. A recipient acting as an independent controller is responsible for its own processing and privacy notice.

Personnel access must be authorised, limited to what is necessary for the relevant task and subject to appropriate confidentiality and access restrictions. Organisation member administration uses limited identifiers such as email and member codes. Any access to other information must have an authorised service, security or legal purpose. Use of Gili does not give an organisation unrestricted access to your relationships with other organisations.

8. International processing

Our primary production database, backend and file-storage infrastructure are configured in the European Union. Providers supporting payment, authentication, communications, analytics or other functions may process relevant information in Nigeria, the EU or other locations involved in delivering their services.

International processing must meet applicable Nigerian data-protection requirements. Depending on the transfer, the legal basis and safeguards may include adequate protection under applicable law, binding contractual or corporate safeguards, or another transfer ground permitted by law. We apply the requirements relevant to the particular transfer; EU hosting alone is not the basis for every provider’s processing. You may contact us for information about relevant recipients, locations and safeguards.

9. Retention and deletion

We retain personal information for the relevant lawful purpose, taking account of the information’s nature, the service relationship, organisation instructions, applicable legal obligations and the need to resolve a documented dispute or claim.

• Gili account information: following account closure, account information scheduled for deletion is removed within 90 days, subject to necessary legal retention and the separate records described below.
• Organisation-controlled member information: the organisation determines lawful retention instructions. Closing your Gili account does not automatically delete its member records. When the organisation permanently deletes a member through Gili, the information scheduled for deletion is removed within 90 days, subject to lawful retention requirements.
• Business, support and security records: the standard retention period is three years from account deactivation. Necessary records may be kept longer for an applicable legal obligation or the establishment, exercise or defence of a documented claim. Unrelated information is not retained merely because another record requires preservation.
• Tax and accounting records: covered records are retained for the period required by law, including at least six years after the relevant year of assessment under the Nigeria Tax Administration Act where applicable.
• Usage records: identifiable usage information is retained only for the account and product purposes described here and is addressed as part of a relevant account-deletion request. Genuinely anonymised statistics may be retained for longer.

Deletion may take place in stages across active systems and retained copies. Backups follow the applicable retention and deletion requirements for the records they contain. Copies awaiting scheduled deletion or expiry are restricted from ordinary use; if a backup is restored, applicable deletion instructions must be reapplied. Necessary legal preservation is limited to the relevant records and purpose.

A stated operational deletion period does not waive your right to erasure without undue delay where the law requires it. When continued retention is no longer justified, we delete the information or anonymise it so it can no longer reasonably identify you.

10. Security

We apply technical and organisational safeguards appropriate to the information and processing risks. These include appropriate access restrictions, confidentiality measures, protection of account and payment operations, and requirements for providers processing information on our behalf.

No transmission or storage system can be guaranteed completely secure. We remain responsible for the safeguards, incident response and notifications required by law. You should protect your credentials and report suspected misuse through support.

11. Your rights and requests

Subject to the conditions and exceptions in applicable law, you may request access, correction, erasure, restriction or portability of your personal information; object to processing; withdraw consent where processing relies on it; and challenge qualifying automated decisions. Withdrawal does not undo processing lawfully carried out before it.

Use Gili’s in-app support or contact support@gili.app, including if you cannot access your account. Identify the information or organisation concerned and the request you wish to make. We may ask for proportionate information needed to verify your identity or authority before disclosing or changing records.

We will respond within applicable legal requirements and explain a lawful restriction or necessary extension. For organisation-controlled information, we may involve the organisation or direct you to its contact while providing assistance required of Gili. This does not remove your rights or our own responsibilities.

You may complain to the Nigeria Data Protection Commission through ndpc.gov.ng or info@ndpc.gov.ng, without first obtaining our permission or waiving another available remedy.

12. Adults only

Gili is intended for people aged 18 or older. Organisations must not register under-18 members contrary to this rule. Contact support@gili.app if you believe an under-18 person’s information has been provided, so it can be assessed and addressed lawfully.

13. Changes and contact

We may update this policy as the service or applicable requirements change. We will publish the updated version and give appropriate notice of material changes through the platform or registered contact details. Where a new use requires consent or additional authorisation, we must obtain it before that processing. Continued use does not substitute for consent where the law requires consent.

Contact Starmaur Nigeria Limited, RC 1804391, at support@gili.app or 12B Admiralty Way, Lekki, Lagos, Nigeria.