Privacy policy

1. Who is responsible

• Gym member data (people who join a gym that uses GymSetora): the gym decides what to record and why, so the gym is the Data Fiduciary. GymSetora processes this data on the gym’s behalf, under the gym’s instructions.
• Gym owner and staff accounts, billing, and this website: GymSetora is the Data Fiduciary.
• Interactive product demo visitors (“demo leads”): GymSetora is the Data Fiduciary for the contact details and consent you provide when opening an interactive product demo.

If you are a gym member, please contact your gym first; we will help the gym answer your request.

How we process member data for gyms is set out in our data processing agreement.

2. What we collect

• Gym account: owner name, phone, email, gym name and address, GSTIN (if provided), UPI ID and bank details the gym enters for collecting fees.
• Staff logins: name, phone or email, role, password (stored only as a hash) and two-factor authentication settings, plus an audit log of logins and staff actions.
• Member records entered by the gym: name, phone, email, photo, date of birth, gender, emergency contact, medical notes the gym chooses to record, the last four digits of Aadhaar if the gym records it (never the full number), memberships, payments and receipts, check-in history, locker and class bookings.
• Subscription payments: processed by Razorpay or Stripe. We receive payment status and reference details; we do not store full card numbers.
• Interactive demo visitors (demo leads): mobile phone number, gym name, selected plan tier, consent version, and consent timestamp. To prevent automated abuse without tracking your browsing habits, we store a keyed cryptographic hash (HMAC-SHA256) of your IP address rather than raw IP addresses. Any sample branding you test (such as custom colours, demo logo, or custom gym name) remains strictly within your browser session and is never uploaded or stored on our servers.
• This website: no tracking cookies. Only if you accept analytics in the cookie banner, we use Plausible Analytics, which counts visits and clicks in aggregate without cookies and without storing IP addresses or building profiles. If you open a partner's referral link, your browser keeps the referral code, the date you opened it, the link's campaign tags (utm_source, utm_medium, utm_campaign) and the name of the website that sent you (not the page address) for 60 days (local storage, not a cookie) so the code reaches signup; it never leaves your browser until you sign up. If you sign up, we keep them with the referral to check it came through an allowed channel. See our cookie policy.

3. Why we use it

• To run the service: memberships, fee collection, check-in, receipts, GST invoices and reports.
• To log members in to the member app with a one-time code on WhatsApp, and to send renewal reminders the gym switches on.
• To provision a temporary 24-hour demo gym and contact you on the mobile number provided about GymSetora plans, features, and onboarding.
• To bill the gym for its GymSetora plan and issue GST invoices.
• To keep accounts secure, prevent misuse and meet legal, tax and accounting obligations.

We do not sell personal data and do not use member data for advertising.

4. Who we share it with

Only with service providers that help us run GymSetora, under contract and only for that purpose:

• Cloud hosting and database providers: Supabase (database and file storage, in the AWS Mumbai region, India), Render (application servers) and Vercel (this website).
• Meta (WhatsApp Business Platform) for login codes and messages the gym sends.
• Razorpay and Stripe for subscription and autopay payments.
• Error monitoring (Sentry), with personal data scrubbed from error reports, when enabled.
• Plausible Analytics for cookie-less website statistics, only with your consent.

We may also disclose data where Indian law requires it.

5. How long we keep it

• Gym and member data: for as long as the gym’s account is active, then 90 days after the account is closed, after which it is deleted (invoices and tax records are kept for as long as tax law requires).
• Demo leads: for up to 180 days from the date of consent for business communication and onboarding follow-up, after which they are permanently deleted, or until you request erasure earlier under your statutory rights.
• Raw payment-gateway event data is reduced to ledger details after 90 days.
• Invoices and accounting records: for the period tax law requires.

6. Your rights

Under the DPDP Act you can ask to access a summary of your data, correct or update it, have it erased when it is no longer needed, nominate someone to act for you, and raise a grievance. Gym owners can export the gym’s full data from the app and anonymise a member’s record on request. Demo visitors who left a phone number to view a live demo may request immediate erasure of their lead record at any time.

Members under 18: a gym that enrols a child must obtain verifiable consent from a parent or guardian before recording the child’s data.

7. Security

Staff logins support two-factor authentication, passwords are hashed, every gym’s data is scoped and isolated by tenant, and logins and staff actions are recorded in an audit log. If a personal data breach occurs we will inform affected gyms and the Data Protection Board of India as the DPDP Act requires.

8. Grievance Officer

Sahil Afridi, [email protected]. We will acknowledge a grievance and respond within the time the law requires.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Changes

We will post any change here with a new “Last updated” date and tell gym owners in the app before a material change takes effect.