Privacy Policy

Last updated: 25 October 2026

1. Introduction

GymFlow ("we", "our", or "us") is gym management software for independent gyms in India. This Privacy Policy explains what information we collect, why, who we share it with, and the choices you have. It covers our website at app.gymflow.sbs, the owner console and member app at admin.gymflow.sbs, and the GymFlow admin mobile app.

We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. Our role depends on whose data it is:

• Gym owner account data (your login, your gym's details, your subscription): GymFlow decides how this is used, so we are the Data Fiduciary.
• Member data (the people who train at a gym): the gym owner decides what is collected and why, so the gym is the Data Fiduciary and GymFlow is its Data Processor. We handle member data only on the gym's behalf, to run the service.

2. Information We Collect

From gym owners

• Account information — your name, email address, password and mobile number. The mobile number is required when you sign up. We do not verify it with a code. We keep it in GymFlow's own contact list so we can reach you about GymFlow, and we send you updates and offers on WhatsApp only if you ticked the box to agree to them.
• Google sign-in — if you sign in with Google, the name and email address on your Google account.
• Gym details — gym name, type, address, city, opening year, and the gym phone number and number of branches if you add them on the Account page. Also the membership plans and prices you set.
• UPI details — your gym's UPI ID and payee name, so the app can generate a UPI QR code and payment link. We do not store card numbers or bank credentials, and we do not process or hold any money: members pay your UPI account directly, and you record the payment in GymFlow.
• Subscription payments to GymFlow — the payment proof file, UPI transaction reference and any note you submit, which we check by hand.
• Support messages — the subject and message you send from the app, and what you email to us.

About members (entered or uploaded by the gym)

• Name, mobile number, gender, age, date of birth and area, as the gym chooses to record them.
• Membership plan, category, start and end dates, amounts paid and due, payment mode (cash, UPI or card), and attendance (date, morning or evening session, and check-out time).
• Records the gym brings in by uploading an Excel or CSV file. The gym must have the right to upload that data.
• For members who activate the member app: the login created for them, and the activity shown in the app (see Member app & leaderboards).

Collected automatically

• Technical and usage data such as device and browser type, pages used, and error and performance logs.
• Session replays inside the owner console and member app (see Analytics, cookies & error tracking).

3. How We Use Your Information

• Provide, maintain and improve the service, including membership, attendance, dues, reports and the member app.
• Verify your identity and secure your account, including one-time codes sent to your email to confirm sensitive actions such as deleting data.
• Contact you about GymFlow, including updates and offers on WhatsApp where you have agreed to receive them.
• Check your subscription payments and manage your plan.
• Send WhatsApp messages and emails to members and owners as described in this policy.
• Answer support requests. We use an AI tool to draft replies to support emails, which our team reviews before anything is sent.
• Find and fix faults, keep the service running, and prevent fraud and abuse.
• Meet legal obligations.

We do not sell personal information and we do not use it for advertising.

4. WhatsApp Messaging

GymFlow sends WhatsApp messages through the WhatsApp Business Cloud API provided by Meta, using one shared GymFlow number. The messages include welcome messages, membership renewal reminders, payment confirmations and, where a gym uses the member app, engagement messages such as streak and prize notices. Gyms on the free forever plan send these only while the paid WhatsApp add-on is active.

Meta limits how many different people one number may message in 24 hours. When that limit is full, a reminder may be delayed and sent later rather than dropped.

The gym enters the member's number, so the gym is responsible for having the member's consent to be messaged on WhatsApp and for following Meta's WhatsApp Business Messaging Policy. A member who does not want these messages can ask their gym to stop them, or block the number in WhatsApp. Meta handles message delivery under its own privacy terms.

5. Member Data & Your Role as a Gym Owner

Member data belongs to the gym that entered it. As a gym owner you decide what to collect and how it is used. You are responsible for having a lawful basis, which in most cases means the member's consent, for the information you record or upload. You must also keep it accurate and respond to your members' requests to access, correct or erase their data.

GymFlow processes member data only to provide the service to you, and never uses one gym's member data for another gym. Each gym's data is separated from every other gym's. If your account ends, member data is handled as set out in Data retention.

6. Member App & Leaderboards

Members join the member app through an activation link sent on WhatsApp by their gym. The app shows a member their own membership, attendance, streak, points (XP), badges. These are worked out from the member's attendance and membership records; they are not a separate profile.

• Gyms can show leaderboards. Other members see a shortened name (for example "Akhil P."), never a phone number.
• A member can opt out of leaderboards at any time from their profile in the app.
• A gym owner can award prizes and run challenges to members.
• The member app is not available to gyms on the free forever plan.

7. Data Sharing

We do not sell personal information. We share it only with the service providers that help us run GymFlow, and only as much as each one needs:

• Supabase — database, sign-in and file storage (the payment proofs you upload).
• Vercel — hosting of the owner console and member app.
• Cloudflare — hosting of our marketing website.
• Meta (WhatsApp Business Cloud API) — delivering WhatsApp messages.
• Upstash — Redis for rate limiting and short-lived caching, and QStash for queuing outgoing WhatsApp messages.
• Resend — sending transactional email such as verification and security notices.
• Sentry — error tracking, performance data, logs and session replays (see Analytics, cookies & error tracking).
• Groq — drafting replies to emails sent to our support inbox. It receives the sender's name, the gym name on their account and the text of their message. Nothing is sent automatically, and member records are not sent.
• Google Maps Platform — address and city suggestions when you type your gym's address.
• Firebase Cloud Messaging (Google) — push notifications to the GymFlow admin mobile app.
• Telegram and Better Stack — internal failure alerts and uptime checks for the GymFlow team. Alert text has phone numbers, email addresses and access tokens removed before it is sent, and may mention a gym's internal ID and counts, but never member contact details.
• Microsoft Clarity and Google Analytics — on the marketing website only, and only if you allow them (see Analytics, cookies & error tracking).

These providers act on our instructions and under their own security and privacy terms.

We may also disclose information:

• To authorities — when required by law, legal process or an enforceable government request.
• In a business transfer — in a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.

8. Transfers Outside India

Several of the providers above run servers outside India, so your information may be processed in other countries. The DPDP Act allows this except to countries the Government of India restricts. We choose providers with published security and privacy commitments and share only what each service needs.

9. Analytics, Cookies & Error Tracking

Owner console and member app. We use Sentry to capture errors, performance traces, logs and session replays (a recording of how a page looked and what was tapped or typed, used to reproduce a fault). Replays are not masked: they can show names, phone numbers, membership and payment details and text typed into the app. Password fields and one-time-code fields are masked and never recorded. Error reports have IP addresses, cookies and request bodies removed. A replay is kept every time an error happens, and for about 5% of ordinary sessions.

Only GymFlow staff use these recordings, to fix faults. They are not sold or used for advertising, and Sentry keeps them for a limited period under its own settings. If you do not want your sessions recorded, contact us and we will exclude you where we reasonably can.

Cookies. The owner console and member app use first-party cookies that keep you signed in; they are needed for the service to work. A theme choice is remembered only for your current visit.

Marketing website. www.gymflow.sbs shows a cookie choice on your first visit. Nothing below is switched on unless you accept it, and you can change your choice later from "Cookie settings" in the site footer.

• Google Analytics counts visits and traffic sources. It sets no cookies until you allow visit counting. See how Google uses data from sites that use its services, and Google's opt-out add-on.
• Microsoft Clarity records heatmaps and anonymised sessions to show how visitors use the page. It is loaded only if you allow it, and is not used in the owner console or member app. See Microsoft's privacy statement.

We do not use advertising cookies or sell your data.

10. Data Security

We take reasonable technical and organisational steps to protect your data. Data travels over encrypted HTTPS connections. Browsers and apps never connect to our database directly; every request goes through our servers, and row-level access rules in the database keep each gym's data visible only to that gym's authorised users. Our database provider keeps its own backups under its terms; we do not offer customer-initiated restore.

No system is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will tell you and the authorities as the law requires.

11. Data Retention

We keep your information while your account exists and as needed to run the service. When a trial or paid plan ends, we do not delete anything automatically: your gym and member data stay in the account, and you can continue on the free forever plan (see our Terms) or renew. Data is removed when you delete it, as described in the next section, or when you ask us to. We may keep records we are legally required to keep, such as payment records. Provider backups and logs expire on the provider's own schedule.

12. Exporting and Deleting Your Data

• Export — owners can export members, attendance and payments to Excel, and reports to PDF, from the app. We do not offer a single full-account export; if you need more, write to support@gymflow.sbs and we will try to help.
• Delete all members — owners can delete every member record, with their memberships, attendance, payments and member logins, while keeping the gym account. A one-time code sent to your email confirms the request.
• Delete the whole gym — owners can permanently delete the gym, all of its data, every member's login and the owner login, confirmed by a one-time code sent to your email. This cannot be undone.
• Members — ask your gym first. You can also write to support@gymflow.sbs.

13. Your Rights

Under the DPDP Act you have the right to:

• get a summary of the personal data held about you and how it is used;
• have inaccurate data corrected and incomplete data completed;
• have data erased once it is no longer needed, subject to legal requirements;
• have a grievance addressed (see below); and
• nominate another person to exercise these rights if you die or cannot act for yourself.

You can also withdraw consent to a use that depends on it, for example by opting out of leaderboards or asking a gym to stop WhatsApp messages. To use any right, write to support@gymflow.sbs. If you are a gym member, please contact your gym first, because it holds your records; we will help it act on your request. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India once it is operating.

14. Children's Privacy

GymFlow is for gym owners and their operations and is not directed at children. We do not knowingly collect data from anyone under 18 ourselves. A gym that adds a member under 18 must first get verifiable consent from that person's parent or guardian, because the DPDP Act requires it. We will remove a minor's data if we learn it was added without that consent.

15. Changes to This Policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, tell you in the app or by email. Continuing to use GymFlow after a change takes effect means you accept the updated policy.

16. Contact Us

For questions, requests or grievances about this Privacy Policy, contact us at: