Privacy Policy

This policy explains what personal data Optishake collects, why, and the rights you have over it. It covers this website, the drink machines in our partner gyms, and Optishake Backstage, the app the staff of those gyms use to look after a machine. We’ve aimed to keep it plain and readable — if anything is unclear, just email us.

Who we are (data controller)

Who this applies to

This policy covers people who:

• contact us by email or through this website;
• have an Optishake membership, or buy drinks from a machine;
• look after a machine at a partner gym, using Optishake Backstage;
• work for, or apply to work at, Optishake;
• have agreed to receive marketing from us.

What we collect

What we hold depends on how you meet us, so it is easiest to take the three cases separately.

If you use this website

• Contact details — name, email, phone and address where relevant (e.g. when you submit a form);
• Technical data — device type, browser, IP address and similar, collected via cookies and analytics. Analytics cookies are only set if you accept them; see our Cookie Policy;
• Anything you choose to send us — e.g. feedback or messages.

If you use an Optishake machine

• Account details — your name, email, phone number and language, together with a customer reference from Stripe if you have a membership or have bought drinks;
• Payment data — handled entirely by Stripe. Optishake does not see or store your card details;
• Your shaker — every Optishake shaker carries a small contactless (NFC) tag with a unique id. Tapping it on a machine is how the machine knows which account to serve. We store that tag id, when it was registered, and when it was last used;
• Drinks taken — which drink, when, and at which machine;
• Feedback you leave on the machine — the text you type, and the drink it was about.

You can walk up to a machine and read it without giving us anything, and there is no audio or video monitoring. Buying a drink or taking out a membership does create an account, because the machine has to know what you are entitled to and payment has to be attributed to someone.

If you look after a machine (Optishake Backstage)

• Who you are — your name and email, the gym or gyms whose machines you look after, and your language and region;
• How you sign in — an email sign-in link, a Google account on the web, or a tap of your own shaker. Backstage has no password;
• Your devices — if you turn notifications on, we store a notification token for each phone or tablet you have signed in on, so alerts about your machines can reach you;
• What you file — maintenance reports, stock counts, notes to your team and messages to us, recorded against your name.

Why we process it

• to provide the membership and serve the drinks you have paid for;
• to run and maintain the service, including the machines and the stock in them;
• to provide customer service and answer what you ask us;
• to tell the people responsible for a machine when it needs attention;
• for analytics and statistics;
• to process payments via Stripe;
• to manage our relationship with you and send necessary, service-related messages.

Legal basis

• Performance of a contract — providing your membership, selling drinks, and giving gym staff the access their work requires;
• Legal obligation — accounting and tax records;
• Legitimate interest — running, securing and improving the service, and keeping partner gyms informed about their own machines — except where your rights and interests override that interest;
• Consent — marketing messages and analytics cookies, which you can withdraw at any time.

Where the data comes from

• information you give us directly (forms, email, sign-up, the app);
• your interaction with an Optishake machine, including your shaker;
• cookies and similar technologies (see our Cookie Policy);
• partner gyms, who tell us which of their staff should be able to look after their machine.

Website forms are processed through our messaging platform, Customer.io.

How long we keep it

We keep personal data only as long as it’s needed for the purpose it was collected for, then delete it securely. We review this regularly. Specifically:

• Job applicants: up to six (6) months after the recruitment process, with consent;
• User account data: up to five (5) years from the last time the account was used;
• Machine service records: maintenance reports and stock counts stay with the machine for as long as it is in service. They carry the name of whoever filed them, because that record is the gym’s proof the machine has been looked after.

Who we share it with

We use a small number of service providers to run Optishake. They process data on our instructions and may not use it for their own purposes.

Who	What for
Google (Firebase, Google Cloud)	Hosting, databases and sign-in for the machines and the app
Stripe	Payments and card details
Customer.io	Email to members and gym staff, and this website’s forms
Expo	Delivering notifications to phones and tablets
Slack	Messages sent to us through Backstage arrive in our internal customer-service channel
Google Analytics	Website statistics — only if you accept analytics cookies

We also share personal data with:

• partner gyms — the staff who look after a machine can see what has been done to it and what has been served by it, and any feedback left on that machine is shown to them together with the first name on the account it came from;
• audit and accounting service providers;
• third parties who help us meet legal obligations.

We do not sell your personal data.

Transfers outside the EU/EEA

Some of our service providers may process data outside the EU or EEA. Where that happens, we rely on safeguards required by applicable data protection law (such as EU Standard Contractual Clauses).

Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you. The machines and the app apply rules you can see — what your membership entitles you to, and when a task on a machine is due.

Your rights

You have the right to access your data and to request that we correct or delete it. You can also restrict or object to processing, ask for your data to be ported, and withdraw consent at any time. To exercise any of these, email joonas.kiminki@optishake.fi.

To close an Optishake Backstage account, email hello@optishake.info from the address you sign in with. We remove your access, the devices you registered and your notification settings. The maintenance and stock records you filed stay with the machine, for the reason given above.

You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman — in the country where you live or work, or where you believe an issue occurred.

Business transfers

If Optishake’s business is merged, sold or transferred in whole or part, personal data may pass to the new owner and its partners, who would be bound by confidentiality obligations covering any such transfer.

How we protect your data

We use reasonable physical, technical and administrative measures to protect personal data from unauthorised access and misuse. Traffic between the machines, the app and our systems is encrypted, and access is limited to the people who need it for their work. Please note that no method of transmission over the internet is completely secure.

Changes to this policy

We may update this policy as the service and the tools we use evolve. The “last updated” date above always reflects the current version.