Privacy Policy

SRTDigi (“we”, “our”, “us”) operates the GymPro gym management platform available at srtdigi.inand associated mobile applications (collectively, the “Service”).

This Privacy Policy explains what personal information we collect, why we collect it, how it is stored, who we share it with, and your rights in relation to it. By using the Service, you agree to the collection and use of information in accordance with this policy.

This policy complies with the Information Technology Act, 2000 and its amendments (India), the GDPR (for EU/EEA users), and the DPDP Act, 2023 (Digital Personal Data Protection Act, India).

A. Account & Profile Data

• Full name, email address, and profile picture (via Google or GitHub OAuth, or email/password)
• Business name, address, city, and phone number (for gym owners during onboarding)
• Profile preferences, notification settings, and dashboard configuration

B. Member & Gym Data (uploaded by gym owners)

• Gym member names, contact details, and membership details entered by gym operators
• Attendance records, plan subscriptions, and payment history
• Any notes, tags, or metadata added by the gym operator

C. Usage & Technical Data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and session duration
• Error logs and performance diagnostics (anonymised)

D. Communications

• Emails and support messages sent to us
• In-app feedback, survey responses, and feature requests

Payment Processors We Use:

• Razorpay — for Indian INR transactions (UPI, cards, net banking, wallets). Razorpay's privacy policy applies: razorpay.com/privacy
• Stripe — for international USD/EUR transactions. Stripe's privacy policy applies: stripe.com/privacy

What we do receive from payment processors:

• Transaction ID, payment status (success/failed/pending), and amount
• Masked card last 4 digits (for display in receipts only)
• Billing name and email (to generate invoices)
• Subscription plan details and renewal dates

Gym member payments: When gym owners collect membership fees through GymPro's integrated billing, the same PCI-DSS protections apply. Gym owners are responsible for obtaining member consent to process payments via GymPro.

Authentication for GymPro is powered by Clerk (clerk.com), a SOC 2 Type II certified authentication provider. Clerk handles:

• Secure storage of hashed passwords (we never see your plain-text password)
• Multi-factor authentication (MFA) tokens
• OAuth tokens for Google and GitHub sign-in
• Session tokens stored in secure, HttpOnly cookies

Clerk's privacy policy: clerk.com/privacy

We store your Clerk User ID linked to your gym profile in our own database. We do not store passwords. Session tokens expire after 24 hours of inactivity.

• 🏋️ To provide and operate the GymPro platform and its features
• 💳 To process subscription payments and generate invoices
• 📧 To send transactional emails (receipts, verification codes, password resets)
• 📊 To generate analytics and reports visible only to the gym owner
• 🔐 To detect, prevent, and respond to security incidents
• 🛠️ To improve the Service, fix bugs, and develop new features
• 📜 To comply with applicable laws (GST invoicing, audit requirements)
• 📣 To send you product updates and offers (you may opt out at any time)

We do not sell your personal data to advertisers or data brokers.

We only share data with third parties in the following circumstances:

Where data is stored: Primary data is stored on servers within India (Mumbai region) and replicated to Singapore for disaster recovery. EU user data may be stored in the EU region.

Security measures we implement:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit (HTTPS only)
• Role-based access control (RBAC) — only the gym owner sees their own data
• Regular security audits and vulnerability scans
• SOC 2 Type II certified infrastructure partners
• PCI-DSS Level 1 certified payment processing
• Automatic session expiry and CSRF protection
• Rate limiting and brute-force protection on all authentication endpoints

• Active accounts: Data retained for the duration of your subscription
• Cancelled accounts: Data retained for 90 days after cancellation, then permanently deleted unless required by law
• Payment records: Retained for 7 years as required by Indian GST and Companies Act
• Security logs: Retained for 12 months
• Backup data: Encrypted backups are purged within 30 days of account deletion

You may request early deletion by contacting us at privacy@srtdigi.in, subject to legal retention requirements.

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any right, email privacy@srtdigi.in. We will respond within 30 days.

We use cookies and similar tracking technologies. For full details, see our Cookie Policy.

Essential cookies: Required for authentication, security, and core functionality. Cannot be disabled.

Analytics cookies: Help us understand how users interact with the platform. You may opt out via our cookie banner.

No advertising cookies: We do not use third-party advertising or tracking cookies.

GymPro is intended for business operators aged 18 and above. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal information, please contact us at privacy@srtdigi.in and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Sending an email to your registered address
• Displaying a prominent banner in the GymPro dashboard
• Updating the “Last Updated” date at the top of this page

Continued use of the Service after changes constitutes acceptance of the updated policy.