Privacy Policy

Gymsly is a gym-management platform built by Akstuudio ("Gymsly", "we", "us"). This policy explains what personal data we collect through the Gymsly web app, the Gymsly Admin app, and the Gymsly Member app (together, the "Service"), why, and what rights you have over it.

Gymsly wears two hats. For a gym owner's own account, billing, and usage of the Service, Gymsly is the data controller. For the personal data of a gym's members, staff, and leads, the gym itself is the controller and Gymsly acts as its data processor: the gym decides what member data to collect and how to use it; Gymsly stores and processes it on the gym's instructions. Product analytics run through PostHog (page views, feature use, and masked session replay) only after you accept analytics cookies. You can refuse them, and deleting your account also deletes the matching PostHog person. If you are a gym member with a question about your data, please contact your gym first; see our Data Processing Addendum for how Gymsly supports gyms in responding to you.

Data we collect

Gym owners & staff (Gymsly account holders)

• Identity & contact: name, email, phone, gym legal name and tax ID
• Authentication data via Firebase Authentication (email/password, or Google sign-in profile)
• Billing data: Stripe/Razorpay/Apple customer and subscription identifiers (we never store full card numbers)
• Usage data: pages viewed, feature usage, and device/browser info via Firebase Analytics and PostHog (only after you accept analytics cookies; see our Cookie Policy)

Gym members (processed on behalf of the gym)

• Identity & contact: name, email, phone, photo, date of birth/anniversary, social links
• Membership & billing: plan, invoices, payment method labels, membership history
• Attendance: check-in/out timestamps, and, only if the gym enables it, a biometric or RFID device identifier
• Health-related data (special category): body stats (weight, height, BMI, body fat), fitness goals, workout logs, and assigned diet plans, where the gym or member chooses to record them
• Communications: broadcast/reminder emails, SMS, and WhatsApp messages, and channel opt-out status
• Community content: posts, comments, and class reviews the member chooses to post in the member portal

Staff (employed by a gym)

• Identity, contact, emergency contact, and bank details for payroll
• Clock-in/out timestamps and, if the gym enables it, GPS coordinates at clock-in/out

Leads & website visitors

• Name, email, phone, and message submitted through a gym's public website enquiry form or public class registration page

Legal bases for processing

Who we share data with

Gymsly uses the following subprocessors to run the Service. None of them are permitted to use your data for their own purposes.

We do not sell personal data.

International transfers

Our subprocessors may process data outside your country, including in the United States. Where required, we rely on the subprocessor's own transfer safeguards (such as Standard Contractual Clauses); see each provider's own privacy documentation for details.

Retention

We keep account and member data for as long as the gym's account is active, plus a reasonable period after closure to comply with legal, tax, and dispute-resolution obligations. Leads are retained for up to 24 months from last contact unless deleted sooner. You can request earlier deletion; see "Your rights" below.

Your rights

Depending on where you live (including under the EU/UK GDPR and India's DPDP Act), you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Withdraw consent (e.g. unsubscribe from marketing, or turn off analytics cookies)
• Object to or restrict certain processing
• Lodge a complaint with your local data protection authority

Gym owners: use Settings, then Privacy, in the Gymsly web or admin app to export or delete your account. Gym members: use the Privacy section of the member portal or member app to export your data or request account deletion, or ask your gym directly. You can also email support@gymsly.fit.

Children

The Service is intended for gym owners, staff, and adult members. Where a gym registers a minor as a member, the gym is responsible for obtaining any consent required from a parent or guardian.

Security

We use industry-standard safeguards (encryption in transit, access controls, per-tenant data isolation via Firestore security rules) to protect personal data. No system is 100% secure; contact us immediately if you believe your account has been compromised.

Changes to this policy

We will post updates here and, for material changes, ask you to re-confirm your consent where required.

Contact

Questions or requests: support@gymsly.fit.