Privacy Policy

1. Our Role

• For your own account (gym owner), GymLedger decides how your data is used.
• For member and staff data you enter, your gym decides why it is collected (the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023). GymLedger only stores and processes it on your behalf to run the Service (a "Data Processor").

2. Information We Collect

Gym Owner Account Data:

• Name, email address, and phone number provided at registration
• Gym name, address, and business details
• Login credentials (passwords are handled by AWS Cognito and never stored in plain text)

Member & Staff Data (entered by gym owners):

• Member names, phone numbers, photos, signed membership forms, notes, membership, attendance and payment details
• For members under 18: the parent's or guardian's name and phone, and when and by whom their consent was recorded
• Staff names, phone numbers, roles, salary, documents the gym uploads, and attendance. When staff clock in by GPS, their location is checked against the gym's to confirm they are there; the coordinates are not stored
• Payment records, session logs, and expenses

AI Assistant Data:

• Questions you ask the assistant, its answers, and the gym records it reads to answer them

WhatsApp Messaging Data:

• Phone numbers, message content and delivery status for notifications sent through Meta's WhatsApp Business API
• Replies members send back, and opt-out requests

Usage and Error Data:

• Pages visited on our public website and guides (Google Analytics). Google Analytics is not used inside the owner, staff or member apps
• Technical error reports, including browser and device type (Sentry). These identify a user by an internal id only, never a phone number or email
• A record of who opened or changed which records, and when, kept for one year for security

3. How We Use Your Information

• To provide and operate the GymLedger service
• To send WhatsApp notifications to gym members, only when the gym owner has turned them on
• To answer questions in the AI assistant
• To process subscription payments via Razorpay
• To send service emails (receipts, renewal reminders, account and security alerts)
• To find and fix errors, and improve the product using aggregated usage data
• To comply with legal obligations under Indian law

We do not sell personal data, and we do not use member data to advertise to anyone.

What we keep, why, and for how long:

4. Who We Share Data With

We share data only with these service providers ("sub-processors"), and only what each needs:

• Amazon Web Services (AWS) — hosting, database, storage and email (Amazon SES). Data is stored in the ap-south-1 (Mumbai) region.
• Microsoft Azure (Azure OpenAI) — runs the AI assistant and checks announcements for spam. Your question and the relevant gym records (which can include member notes and staff pay) are sent to it; Microsoft does not use them to train its models. It may run in any Azure region, outside India, and Microsoft may keep prompts for up to 30 days to detect abuse.
• Meta Platforms (WhatsApp Business API) — delivers WhatsApp messages, under its Business Data Transfer Addendum. This may take place outside India.
• Razorpay — processes subscription payments. Card and UPI details are handled only by Razorpay and never stored by us.
• Google — usage statistics for our public website (Google Analytics), and the fonts our pages load (Google Fonts, which sees your IP address). Outside India.
• Sentry — error reports so we can fix bugs, stored in Germany.
• Hostinger — our support mailbox.

GymLedger's own team opens a gym's records only to give that gym support or to fix a problem, and every such access is logged.

We may disclose data if required by law or by a valid order of an Indian court or authority.

5. Data Security

• All data is encrypted in transit (HTTPS/TLS) and at rest (AWS encryption)
• Each gym's data is kept separate; staff and members only see what their role allows
• Secrets (API keys, tokens) are stored encrypted in AWS Systems Manager Parameter Store
• Databases are backed up continuously, with 35 days of point-in-time recovery; offline copies are encrypted
• Access to records is logged, and our cloud account is monitored for threats
• If a breach affects your data, we will tell you within 72 hours of finding it, and notify authorities where the law requires

6. Data Retention

• We keep your data while your account exists, including after a trial or plan ends, so you can come back to it.
• When you ask us to delete your account, we delete your gym's data within 30 days — see Data Deletion.
• Records of payments you made to GymLedger are kept as long as Indian tax law requires.
• Deleted data disappears from backups within 35 days.

7. Children

Gym owners and staff must be 18 or older. Gyms may enter members under 18; in that case the gym is responsible for getting verifiable consent from the member's parent or guardian before adding or messaging them.

8. Your Rights

You have the right to:

• Access — get a summary of the data we hold about you and who we shared it with
• Correction — fix inaccurate or incomplete data
• Deletion — have your data erased (see instructions)
• Withdraw consent — as easily as you gave it: turn off WhatsApp reminders and receipts in Messages settings, stop using the assistant (nothing is sent to it unless you ask it something), or ask us to delete your account. Withdrawing does not undo what was lawfully done before, and features stop working without the data they need
• Nominate — name someone to exercise these rights if you die or cannot act: email us their name and contact details from your account email
• Grievance — complain to our Grievance Officer (below). If you are not satisfied with the answer, you can complain to the Data Protection Board of India
• Opt out — members can reply "STOP" to any WhatsApp message, and "START" to resume

How: email support@gymledger.in from your account email, saying which right you are using. We may ask you to confirm it is you. We reply within 30 days.

Gym members and staff: your gym controls your data. Please contact your gym first; if you cannot reach them, email us with your gym's name and your phone number and we will pass your request on.

This policy is in English. Write to us if you need it in Hindi or another language listed in the Eighth Schedule to the Constitution.

For Gym Members and Staff

If your gym uses GymLedger, this is what happens to your data:

• Your gym is in charge of it. The gym decides what to record about you (name, phone, photo, membership, payments, attendance, PT sessions) and why. GymLedger stores it for the gym and uses it for nothing else.
• How long: until your gym deletes it, or two years after your membership ends, when it is deleted automatically.
• Where it is kept: on Amazon Web Services in Mumbai. If the gym owner uses the AI assistant, the records it needs to answer are sent to Microsoft Azure, which may be outside India.
• WhatsApp: the gym's reminders and receipts come from GymLedger's WhatsApp Business number on the gym's behalf. Reply STOP to stop them and START to resume.
• Under 18: the gym records a parent's or guardian's name, phone and consent.
• Your rights: to see, correct or delete your data, or to complain, ask your gym first. If you cannot reach them, email support@gymledger.in with your gym's name and your phone number and we will pass it on. You can also complain to the Data Protection Board of India.

9. WhatsApp Messaging

By turning on WhatsApp features, the gym owner confirms that:

• Each member has agreed to receive WhatsApp messages from the gym
• For members under 18, a parent or guardian has agreed

The gym owner, not GymLedger, is responsible for getting this consent. Members can opt out at any time by replying "STOP".

10. Cookies

Our public website and guides use Google Analytics cookies to measure traffic. The owner, staff and member apps use no analytics cookies; they keep your login session in your browser. You can clear or block cookies in your browser settings.

11. Changes to This Policy

We will post changes here and update the date above. For significant changes, we will email gym owners.

12. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Any disputes are subject to the jurisdiction of courts in Guwahati, Assam, India.

13. Contact & Grievance Officer

• Grievance Officer: Deep Murari. We acknowledge a grievance within 5 working days and resolve it within 30 days
• Email: support@gymledger.in
• Business: GymLedger (UDYAM-AS-03-0094021)
• Location: Guwahati, Assam, India