NDA · Confidential 2026 · Python · AI · FastAPI

CRM for
Sport Club

AI-powered CRM automation layer built on top of an existing booking platform — behavioral segmentation, WhatsApp campaigns, and business analytics. Zero to production in 13 days.

AI Vibecoding Integration Project
01
312
commits, zero existing codebase
02
13
days to full production
03
800+
automated tests (pytest)
04
15+
business metrics, live-calculated
Overview

What was built
in 13 days

A complete AI-driven communication automation layer on top of an existing CRM. The client had hundreds of fitness club members and zero automated outreach. Two weeks later: behavioral segmentation, AI-generated personalized WhatsApp campaigns, a business analytics dashboard, and a BI platform — all running in production.

End-to-end ownership: data pipeline → business logic → REST API → frontend → infrastructure → security audit.

Core Features
01 / Data Pipeline
Full CRM sync with incremental updates
Clients, visits, services, and staff synchronized from the booking platform API. Incremental sync runs every minute (only changed records); full nightly rebuild. Shared rate limiter respects the API's 200 req/min cap. Pagination loop handles datasets beyond 200 records per page.
Incremental sync Rate limiting Pagination Nightly rebuild
02 / Metrics Engine
15+ business metrics, refreshed on schedule
New clients (7d / 30d)
Trial conversion
Weekly / monthly active
Core clients 3+/mo
Early churn cohort
Inactive 60 / 180 days
PT first / repeat / churn
High LTV segmentation
Milestones: 10 / 25 / 50 / 100 / 200 / 500 visits
03 / Behavioral Segmentation
8 named segments, priority-deduplicated
A client appears in exactly one segment at a time — priority-based deduplication prevents double-targeting.
Regular Members 3+ visits per month
At Risk first signs of churn
Going Silent 2 months without visit
Nearly Lost 6 months without visit
Lost Clients no longer active
Trial Drop-offs visited once, never subscribed
PT Cancellations stopped personal training
VIP Members high lifetime value
04 / Campaign Engine
5 automated scenarios, per-segment cooldowns
Birthday
Fires on client's birthday. 29 Feb handled gracefully.
Milestone
Congratulates on 10 / 25 / 50 / 100 / 200 / 500th visit.
Reactivation
Mild nudge for early-churn and 60-day inactive clients.
Last Chance
Urgent tone for 120–180-day inactive clients.
PT Dropout
Personal tone for clients who stopped personal training.
05 / Two-Mode Delivery
Moderation or fully automated — switchable at runtime
Moderation mode
AI generates draft → Telegram preview card → operator approves or rejects per message before it reaches the client.
Notification mode
Fully automated. Drafts generated and sent without human review. Switchable from admin panel, no deploy needed.
06 / WhatsApp via Meta Cloud API
Full WABA integration, 5 languages
Complete WhatsApp Business API integration. Multi-language template support: cs · uk · ru · en · bg. Template variable substitution (name, days, visit count). Language-to-template validation at campaign creation time.
Meta WABA 5 languages Template variables Signature validation
07 / Message Queue
Persistent outbox with retry
Every outbound message goes through a persistent outbox table.
→ queued
→ sending
→ sent / failed / dead
Exponential backoff retry. Dead-letter after N failures — no silent drops.
08 / Telegram Moderation Bot
Per-message approval cards
Sends formatted approval cards: name, segment, message preview. Inline keyboard: Approve / Reject. Whitelist-based access control — fail-closed (unknown user = access denied). Separate Docker container.
Whitelist Fail-closed
09 / Admin Dashboard
Multi-tab analytics panel
Summary metrics with tooltips · First Visits cohorts · Trial conversion funnel · Activity tabs with date range · Churned/inactive with visit history · Personal training metrics · Promo codes with status legend · Copy phone with toast.
10 / BI Platform
Metabase at dedicated subdomain
SQL-queryable access to all production data for non-technical stakeholders. No code required to build custom reports.
Production PostgreSQL
direct connection
Custom dashboards
no-code reports
Dedicated subdomain
traefik ssl
Separate Docker container
isolated service
Build Timeline

13 days.
Zero shortcuts.

Spec-first development with mandatory adversarial review before every implementation. Quality was non-negotiable from day one.

1DAY
Project scaffold, database models, CRM API client
2DAY
Data ingestion: clients, visits, services, staff
3DAY
Metrics engine (15 metrics), behavioral segmentation (7 segments)
4DAY
Campaign engine (5 scenarios), REST API
5DAY
Docker + Traefik — deployed to production
6DAY
WhatsApp sender, Telegram approval bot, outbox message queue
7DAY
Message history page, admin analytics panel
8–10DAY
Dashboard tabs, analytics, data mapping fixes
11–12DAY
Promo codes, multi-language (5 langs), campaign UX polish
13DAY
Full security audit + 6 hardening tasks (red-team scan)
Infrastructure & Stack

No bloat. Every tool earns its place.

APScheduler runs in-process inside FastAPI — no Celery, no Redis, no extra infrastructure. Traefik handles SSL. Alembic handles migrations. Everything else is plain Python.

Python
FastAPI
PostgreSQL
WhatsApp Cloud API
Claude API
Telegram Bot API
Docker
Traefik
Metabase
Alembic
Security & Testing
SEC
Session-cookie auth with HMAC signing (itsdangerous). 7-day expiry. Rate limiting on login: 5 attempts/IP/min via Traefik-controlled X-Forwarded-For — spoof-resistant.
SEC
WhatsApp webhook HMAC-SHA256 signature verification. Fail-closed — rejects if secret not configured. SQL injection protection on all LIKE queries.
SEC
Strong SECRET_KEY enforced at startup in production: minimum 32 chars, known weak values rejected. All internal API routes protected by auth dependency.
SEC
Telegram bot whitelist: fail-closed — denies all callbacks if TELEGRAM_ALLOWED_USER_IDS is not set. Unauthorized user = access denied, logged.
800+
Automated tests (pytest)
Unit: metrics, segmentation, campaign logic.
Integration: API routes, webhook handler, full auth flow.
Edge cases: empty DB, single-client cohorts, NaN protection, boundary dates.
Security: unsigned webhooks → 403, tampered cookies → 302, rate limit enforcement.
Unit Integration Edge cases Security Auth flow
All projects
Oleksandr Semishan · semishan.pro