Privacy policy

GymKaro is gym management software run by Smart Office Automations, Amritsar, Punjab, India (“GymKaro”, “we”). This policy explains what personal data is handled in GymKaro, why, and your rights under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Who is responsible

• Gym members: your gym decides what it records about you and why. Under the DPDP Act your gym is the Data Fiduciary. GymKaro is its Data Processor and handles your data only to run the gym's software.
• Gym owners and staff who sign up to GymKaro: for your account details, GymKaro is the Data Fiduciary.

2. What data is stored

• Members (entered by the gym): name, phone number, photo, date of birth, gender, address, emergency contact, membership plans, payments and dues, attendance / check-in times, fingerprint templates if the gym uses a biometric machine, diet and workout plans given by the trainer, and notes the gym adds.
• Gym owners and staff: name, phone, email, password (stored only as a secure hash), Telegram chat ID if connected, and a log of important actions (for example, cancelled payments).
• Technical: login cookies needed to keep you signed in, and server logs used to fix errors. We do not use advertising or tracking cookies.

3. Why it is used

Only to run the gym: admissions, renewals, receipts, reminders, attendance, reports and summaries for the owner, and member pages with their plan and pay link. We do not sell personal data, show ads, or use members' data for our own marketing.

4. Consent

The gym collects members' data with their consent at admission, for the purposes above. For members under 18, the gym must take consent from a parent or guardian. Consent can be withdrawn by asking the gym; the gym may still keep records it must keep by law (for example, payment receipts).

5. Who else processes it (sub-processors)

• Vercel Inc.: hosting of the app.
• Turso (ChiselStrike Inc.): database storage.
• Resend: summary emails to gym owners.
• Telegram: alerts and summaries to gym owners and staff who connect it.
• Meta (WhatsApp): reminder messages the gym sends to members.

Some of these providers may store data outside India. They process it only to provide their service to us.

6. Payments

Member payments made through pay links go directly from the member's UPI app to the gym's UPI ID. GymKaro does not receive, hold or see bank or card details.

7. How long it is kept

Data is kept while the gym uses GymKaro. A gym can delete a member at any time. If a gym stops using GymKaro, it can download its data, and we delete the gym's data within 90 days of a written request or after 12 months of the account being closed, except where the law requires us to keep it.

8. Security

Data is sent over HTTPS, each gym can see only its own data, passwords are hashed, and owner-only actions are logged. If a personal data breach happens, we will inform the affected gyms and the Data Protection Board of India as the DPDP Act requires.

9. Your rights

You can ask to see a summary of your data, correct it, have it erased, or nominate someone to act for you. Members should first contact their gym. If the gym does not respond, or for anything else, write to our grievance contact below. We aim to reply within 7 days and resolve within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

10. Contact and grievance officer

Smart Office Automations, Amritsar, Punjab, India. Email: support@gymkaro.in

11. Changes

If this policy changes, the new version will be posted here with a new date. Important changes will also be shown to gym owners in the app.