Privacy Policy

This Privacy Policy describes how VectorWay Technologies (OPC) Private Limited ("Company", "we", "us", or "our"), operating under the brand name ManageYourGym, collects, uses, stores, shares, and protects your personal information when you access or use our website at manageyourgym.com, our web application, mobile applications, APIs, and any related services (collectively, the "Platform").

By accessing or using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this policy, please do not access or use our Platform.

1. Information We Collect

1.1 Information You Provide Directly

• Account & Registration Data: Name, email address, phone number, business name, gym name, address, and password when you create an account.
• Gym Member Data: Names, contact details, membership plan details, attendance records, payment histories, health or fitness notes, photographs, and emergency contact information of gym members that you (as a gym owner/admin) enter into the Platform.
• Trainer Data: Trainer names, qualifications, schedules, contact information, and assignment records.
• Payment & Billing Information: Subscription plan details, invoices, transaction IDs, and payment method information. We do not directly store your full credit/debit card numbers; payment processing is handled by third-party payment gateways.
• Communications: Messages you send to us via the contact form, email, support tickets, or any other communication channel.

1.2 Information Collected Automatically

• Device & Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, features used, click patterns, session duration, referring URLs, and navigation paths within the Platform.
• Cookies & Similar Technologies: We use cookies, local storage, and similar tracking technologies to maintain sessions, remember preferences, and analyze usage. See Section 8 (Cookies) for more details.
• Log Data: Server access logs including timestamps, request methods, response codes, and error logs for debugging and security purposes.

1.3 Information from Third Parties

• Payment confirmation and transaction status from payment gateway providers.
• Analytics data from third-party analytics services (e.g., Google Analytics).

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, operate, maintain, and improve the Platform, including member management, attendance tracking, payment processing, trainer management, reporting, and analytics features.
• Account Management: To create and manage your account, authenticate your identity, and process subscription billing.
• Communication: To send you transactional emails (e.g., account verification, password resets, payment receipts), service updates, security alerts, and support responses.
• Analytics & Improvement: To understand how users interact with our Platform, identify trends, measure feature effectiveness, and improve user experience.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Marketing (with consent): To send promotional materials about new features, offers, or services, only where you have opted in to receive such communications.

3. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contractual Necessity: Processing necessary for the performance of our contract with you (i.e., providing the Platform services you signed up for).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Platform, preventing fraud, and ensuring security, provided these interests are not overridden by your rights.
• Consent: Where you have given explicit consent, such as for marketing communications or non-essential cookies.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following limited circumstances:

• Service Providers: We share data with trusted third-party vendors who assist us in operating the Platform, including cloud hosting providers, payment gateways, email delivery services, and analytics providers. These providers are contractually obligated to protect your data and use it only for the services they provide to us.
• Gym Owner Access: If you are a gym member whose data has been entered into the Platform by a gym owner/admin, that gym owner/admin and their authorized staff will have access to your data within the Platform for the purpose of managing gym operations.
• Legal Requirements: We may disclose your data if required by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of the transaction. We will notify you via email and/or a prominent notice on our Platform of any change in ownership or uses of your personal data.
• Aggregated/Anonymized Data: We may share aggregated or de-identified data that cannot reasonably be used to identify you, for industry analysis, benchmarking, and research purposes.

5. Data Storage and Security

5.1 Storage

Your data is stored on secure servers provided by reputable cloud infrastructure providers. Data may be stored and processed in India and other jurisdictions where our service providers maintain facilities. By using the Platform, you consent to the transfer of your data to these locations.

5.2 Security Measures

We implement industry-standard security measures to protect your personal data, including:

• Encryption of data in transit using TLS/SSL protocols.
• Encryption of sensitive data at rest.
• Secure password hashing using bcrypt.
• Role-based access controls and multi-tenant data isolation ensuring each gym's data is segregated.
• Regular security assessments and vulnerability monitoring.
• Rate limiting and throttling to prevent abuse.
• JWT-based authentication with secure token handling.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained for the duration of your active account. Upon account deletion request, we will delete or anonymize your data within 90 days, except where retention is required for legal or regulatory purposes.
• Gym Member Data: Retained as long as the associated gym account is active. Gym owners are responsible for managing the retention and deletion of their members' data within the Platform.
• Transaction Records: Retained for a minimum of 7 years to comply with financial and tax regulations in India.
• Log Data: Server and access logs are retained for up to 12 months for security and debugging purposes.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Restriction: Request restriction of processing of your personal data in certain circumstances.
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at privacy@manageyourgym.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

You can control cookies through your browser settings. Disabling essential cookies may impact the functionality of the Platform. Most modern browsers allow you to block or delete cookies — refer to your browser's help documentation for instructions.

9. Third-Party Services

The Platform may integrate with or contain links to third-party services. These third-party services have their own privacy policies and we are not responsible for their practices. Third-party services we may use include:

• Cloud Hosting: For server infrastructure and data storage.
• Payment Gateways: For processing subscription payments securely.
• Email Services: For sending transactional and marketing emails.
• Analytics Providers: For website usage analytics and performance monitoring.

We encourage you to review the privacy policies of any third-party service before providing your information to them.

10. Data Processing for Gym Owners (Data Controller & Processor Relationship)

When gym owners use the Platform to manage their gym members' data:

• The gym owner acts as the Data Controller and is responsible for obtaining appropriate consent from their gym members for data collection and processing.
• VectorWay Technologies (OPC) Private Limited acts as a Data Processor, processing gym member data on behalf of the gym owner as per the service agreement.
• Gym owners are responsible for ensuring they have a lawful basis for collecting and processing their members' data and for responding to their members' data rights requests.
• We provide tools within the Platform for gym owners to manage, export, and delete member data to help them fulfill their obligations.

11. AI Assistants (Built-in Assistant, Claude and ChatGPT Connectors)

A gym owner, admin, or staff member can choose to connect the Platform to an AI assistant. Today these are Claude, provided by Anthropic, and ChatGPT, provided by OpenAI. The connection is optional, read-only unless the gym chooses otherwise, and does not exist until a person at the gym signs in to ManageYourGym and approves it. Sections 11.1 to 11.7 explain what it involves. Section 11.8 covers the assistant built into ManageYourGym itself.

11.1 Purpose and How It Works

When the person who connected the assistant asks it a question about their gym, the assistant sends a request to our connector. We process that request on our servers, check the person's role and the gym's plan, and return the answer text to the assistant provider the gym chose. We use this data only to answer the gym's own question.

By default the connector only looks things up. It can make changes only where we have switched changes on for the gym and the person connecting it ticks "Allow changes" when approving the connection. It can then book, move, cancel, or record the outcome of personal-training sessions; create classes or cancel class sessions; and create, assign, or edit training programs and diet plans. For every change it shows a preview first, and nothing changes until the person confirms it. The same role permissions as the ManageYourGym app apply. The connector cannot record payments, edit member records, or send messages.

11.2 What May Be Shared, and Only on Request

Data is returned only when it is needed to answer a question, and each person sees only what their role sees in the ManageYourGym app. Depending on the question, this can include:

• Member names and member numbers (such as #GYM1001), and trainer names and numbers (such as #TR1003). Members and trainers are identified by these numbers, never by internal identifiers.
• Membership status, plan and end dates, and dues.
• Payments and revenue, according to role. A staff member sees money figures only if their permissions in the app allow it.
• Attendance and check-in information, and class and personal-training schedules and bookings.
• Leads and their follow-ups, including the name of the staff member a lead is assigned to.
• Trainer details and activity: employment status, specialities, years of experience, how many members are assigned to them, and their session and client counts for a period. For people who may see revenue in the app, this also includes the revenue, pay cost and margin attributed to each trainer.
• Phone numbers. In lists, phone numbers are always masked. When an assistant looks up one member by member number, the full number is returned only if a gym owner or admin has switched on "Share full phone numbers with AI assistants" in Settings. That setting is on by default. Lead phone numbers are always masked.

Each response is limited to 50 rows.

11.3 What Is Never Shared

The connector never shares member email addresses, notes, photographs, health, assessment and nutrition data, or invoices.

When a change would assign or edit a training program or diet plan, we check it against the client's health information on our servers. The assistant is told only that the client has health information on file and which proposed item conflicts with it, never the health information itself.

11.4 Roles and Legal Basis

As described in Section 10, the gym owner is the Data Controller for its members' data and we act as Data Processor. Connecting an assistant is the gym's own decision and instruction, and we run the connector on the gym's behalf. Our legal basis for doing so is contractual necessity: providing the feature the gym has asked for. The gym remains responsible for having a lawful basis for using its members' data in this way and for informing its members where the law requires.

11.5 Recipients

The answer text is delivered to the provider the gym chose: Anthropic for Claude, or OpenAI for ChatGPT. Once delivered, the provider handles it as an independent party under its own terms and privacy policy, and it may process it in countries other than your own (see Section 13). We do not control how the provider uses it. We do not send data to a provider the gym has not connected.

11.6 Retention

• Questions and answers: We do not store the questions you ask your assistant or the answers it gives.
• Connection record: We keep which assistant was connected, by whom, for which gym, when it was connected, last used, and disconnected, and one-way hashes of its current and immediately previous renewal tokens. The renewal token itself is held only for a few seconds while it is being issued, never stored. The record is linked to the gym and to the person who approved it, and is deleted with them.
• Tokens: Access tokens last 1 hour and are not stored by us. A renewal token is replaced each time it is used, and a connection whose renewal token has not been used for 30 days can no longer be renewed and must be approved again. Temporary approval codes are valid for 60 seconds and their hashed records are purged within a day. A pending approval request lasts 10 minutes.
• Tool-call logs: For each request we log the connection and gym identifiers, the name of the tool used, how long it took, how many results it returned, and the outcome. Each confirmed change is logged the same way, with the tool and its outcome but not the content of the change. These logs contain no member data and no question or answer text. They are kept as server logs for up to 12 months (see Section 6).
• Pending changes: A change waiting for confirmation is held for up to 5 minutes, then discarded.
• Activity feed: Connecting and disconnecting an assistant is recorded in the gym's activity feed and kept with the gym's other activity-feed records. Each confirmed change is recorded in the gym's activity feed with who made it and which assistant was used.

11.7 Your Controls

• Anyone who connected an assistant can disconnect it at any time in Settings → Connected apps. Gym owners and admins can disconnect any connection for their gym; staff can disconnect their own. A disconnected assistant can no longer request data.
• Changes stop straight away if we switch changes off for the gym or the person who connected the assistant loses access. To keep an assistant read-only, reconnect it without ticking "Allow changes".
• Gym owners and admins can switch off sharing of full phone numbers in the same place.
• Role limits always apply: an assistant can never see more than the person who connected it can see in the app.
• Disconnecting stops future requests. It does not remove what the provider has already received; use the provider's own controls for that.

11.8 The Built-in ManageYourGym Assistant

Gym owners and admins, and staff if the owner allows it, can ask questions about their gym in the assistant built into the ManageYourGym web app. It is read-only: it cannot create, change, or delete anything. To answer, we send the question and the gym data needed to answer it to an AI model provider.

• What the provider receives: Member and trainer names are replaced with reference numbers (such as #GYM1001) before anything leaves our servers, and the question is checked for names that match your members and trainers, which are replaced with reference numbers too. The provider receives those reference numbers, amounts, dates, counts, and plan, class and branch names. It never receives member or trainer names, phone numbers, email addresses, notes, photographs, or any health, assessment or nutrition record. A name typed with a spelling that does not match our records may not be recognised and could reach the provider as typed.
• Providers: Questions are answered by models from Google (Gemini models) and Anthropic (Claude models), one as the main model and the other as a backup. The providers in use at any time are shown in Settings → AI assistant. They process this data on our behalf as our sub-processors, and may do so in countries other than your own (see Section 13).
• Legal basis: The same roles and legal basis apply as for the connectors (see Section 11.4).
• Conversations: Each conversation is visible only to the person who asked. We store the questions, the answers and the result cards shown, and they are deleted after 30 days. Anyone can clear their own history sooner in Settings → AI assistant.
• Usage records: For each question we record the gym, the person who asked, the model used, its size and cost, how long it took, the outcome, and which data tools were used, but not what they asked or the answer. These records are kept for billing and cost history. Gym owners and admins can see how many questions each person asked, but not what they asked.

12. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children under 18. If a gym owner enters data of a minor gym member, the gym owner is responsible for obtaining the necessary parental or guardian consent. If we become aware that we have collected personal data from a child without proper consent, we will take steps to delete that information.

13. International Data Transfers

Your data may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that differ from those in your jurisdiction. When we transfer data internationally, we take appropriate safeguards to ensure your personal data remains protected in accordance with this Privacy Policy and applicable law, including using standard contractual clauses or other approved transfer mechanisms where required.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or through a notice on the Platform. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

15. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the name and contact details of the Grievance Officer are provided below:

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: