Your trust matters to us. This policy describes the data we handle on behalf of your gym and how we keep it safe.
1. Introduction
Gym Daddy (“we”, “us”, “our”) provides gym-management software to fitness businesses. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our website and to the Gym Daddy application used by gym owners and their staff.
We act as a data processor for the member information that a gym (our customer) stores in Gym Daddy, and as a data controller for the account and billing information of the gym itself.
2. Information we collect
We collect the following categories of information:
- Account information — gym name, owner and staff names, email addresses, phone numbers and login credentials (passwords are stored only as salted hashes).
- Member records you enter — your members’ names, contact details, photos, ID proof, plan and payment history, and check-in activity.
- Biometric attendance data — check-in timestamps and device-generated identifiers. Fingerprint templates stay on your biometric device; where a backup copy is kept on our servers, solely to restore access after renewal, it is held on encrypted infrastructure (in transit and at rest) under strict server-side access controls, and we never use it for any other purpose.
- Billing information — subscription tier, invoices and payment-verification details. Card and UPI details are handled by our payment processor, not stored on our servers.
- Usage and technical data — log data, IP address, browser type and pages visited, used to operate and secure the service.
3. How we use information
- To provide, maintain and improve the service, including members, payments, reporting and biometric access control.
- To send transactional messages such as renewal reminders and receipts on your behalf to your members.
- To process subscriptions, verify payments and issue GST invoices.
- To provide support, respond to enquiries and schedule demos you request.
- To detect, prevent and address fraud, abuse and security incidents.
5. Data security
We protect data with industry-standard measures including encryption in transit, hashed credentials, role-based access controls and per-tenant isolation. Access is enforced server-side with strict controls. No system is perfectly secure, but we work continuously to safeguard your information.
6. Data retention
We retain your data for as long as your account is active. After cancellation we retain data for a limited grace period to allow reactivation and export, after which it may be deleted or anonymised on request, except where longer retention is required by law (for example, tax and invoicing records).
7. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may export your data. For member data held within a gym’s account, requests should be directed to that gym, which controls the data; we will assist the gym in fulfilling such requests.
Gym Daddy is committed to handling personal data responsibly and in accordance with applicable requirements under the Digital Personal Data Protection (DPDP) Act, 2023. We continually review and improve our privacy and data-protection practices to support that commitment.
9. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you within the application.
Questions about this policy?
Contact us at hello@gymdaddy.app or visit our Help Center.