Privacy Policy

Account information you give us. Your gym's name and location, your name, email address, mobile number, sign-in credentials (stored only as a secure hash), your chosen subscription plan and your billing details.

Member records you enter. Whatever your gym chooses to store about its members — name, photo, contact number, address, membership plan, joining and expiry dates, registration ID, payments and outstanding balances, attendance history, weight and height (if recorded), and any notes you add.

Health and fitness data. If a gym records a member's weight (kg) and height (cm), the app calculates the member's BMI and BMI category from them. See section 7.

Member app sign-in details. Members sign in to the app with their Member ID, phone number and a PIN they create on first login. See section 6.

Biometric data (only if you enable it). Where your gym uses fingerprint attendance or door access, the connected device generates a mathematical template from a fingerprint and links it to a member record. See section 8 for how this is treated.

Payment information. Subscription payments are processed by third-party payment gateways. We receive confirmation of the transaction — amount, status, timestamp, a reference ID and the last few digits of the instrument. We never receive or store your full card number, CVV, UPI PIN or net-banking credentials.

Technical and usage information. IP address, browser and device type, pages viewed, dates and times of access, and diagnostic logs. We use this to keep the Service secure, debug problems and understand which features are used.

Device information (mobile app). When you sign in to the app, it sends us a random device ID generated by the app, a push notification token, your platform (Android or iOS), phone manufacturer and model, operating system version and app version. See section 9.

Analytics and app links (mobile app). We use AppsFlyer to measure app installs and to make shared Smarto Gym links open the right screen in the app. AppsFlyer receives device identifiers (including the Android advertising ID), basic device information and app usage events such as app opens. See section 9.

Communications. Emails, WhatsApp messages and support conversations you have with us, including any attachments you send.

We use the information above to:

• Create and run your gym's workspace and provide the features you subscribed to;
• Process subscription payments, issue receipts and manage renewals;
• Send service messages — renewal reminders, expiry warnings, security alerts and important changes;
• Send push notifications to gym owners, staff and members, and show users which devices are signed in to their account;
• Let members sign in to the app and view their own membership, attendance, payments, dues, BMI and gym contact details;
• Measure how people find and install the app, and open shared Smarto Gym links on the right screen in the app;
• Provide support when you contact us and investigate issues you report;
• Keep the platform secure — detect fraud, abuse, unauthorised access and technical faults;
• Improve the product, using aggregated and de-identified statistics wherever possible;
• Meet our legal, tax and accounting obligations.

We do not sell your data or your members' data. We do not share it with other gyms, and we do not use member records for our own marketing.

We rely on the following grounds, as applicable under Indian data protection law:

• Performance of a contract — we need your account and billing information to deliver the Service you have paid for, and we need sign-in and device information to let you use the app and deliver its notifications.
• Consent — for optional things such as marketing emails, and for the biometric enrolment your gym carries out with each member, and for push notifications where your phone asks for permission (Android 13 and later).
• Legitimate business interests — securing the platform, preventing abuse, measuring app installs, making shared links open in the app, and improving the product, balanced against your privacy.
• Legal obligation — retaining invoices and transaction records for the periods tax law requires.

Where you have given consent, you can withdraw it at any time by writing to support@smartogym.in. Withdrawal does not affect processing carried out before it.

Your members' records belong to your gym. We act on your instructions, and we will not access, disclose or use them for anything other than running the Service, supporting you, or complying with the law.

As the gym, you are responsible for:

• Telling your members what you collect and why, through your own privacy notice;
• Having a lawful basis or consent for the records you enter;
• Keeping the records accurate and up to date;
• Responding to members who ask to access, correct or delete their information;
• Any weight and height details you record, and making sure members know you are recording them.

We will help you action any of those requests inside the dashboard, and we will pass on to you any request a member sends us directly.

Gym members can sign in to the Smarto Gym app themselves to see the records their gym holds about them.

• Signing in. Members sign in with their Member ID, phone number and a PIN they create the first time they log in.
• Forgotten PIN. Members cannot reset their own PIN. The gym resets it, and the member creates a new PIN at their next login.
• What members can see. Their membership and plan, expiry date, attendance history, payments, outstanding dues, BMI, and their gym's contact details.
• Members cannot edit this data. It is entered and managed by their gym. To correct anything, members should contact their gym.

The member app does not change who controls member data. The gym is responsible for the member data it enters, and Smarto Gym processes it on the gym's behalf, as described in section 5.

Gyms may record a member's weight (kg) and height (cm). From these, the app calculates the member's BMI and a BMI category (Underweight, Normal, Overweight or Obese) and shows it to the member in the app.

• This data is used only to show the member their own BMI.
• It is never sold, and never used for advertising.
• Like other member records, it is entered and managed by the gym, which is responsible for it. We process it on the gym's behalf.

Fingerprint data is sensitive, and we treat it differently from ordinary member details:

• Enrolment happens on the biometric device at your gym. The device stores a mathematical template, not a photograph of the fingerprint, and the original fingerprint image cannot be reconstructed from it.
• Smarto Gym uses the template only to match a check-in to a member record and, where enabled, to allow door access. It is never used for any other purpose.
• Biometric templates are never sold, shared with other gyms, or used to train any product of ours.
• Your gym must obtain each member's clear, specific consent before enrolment, and must offer an alternative check-in method to anyone who declines.
• When a member is deleted, or when your gym stops using the biometric add-on, the associated templates are deleted from the platform, and you should also clear them from the device.

Push notifications. The app sends push notifications to gym owners, staff and members — for example when a payment is received, a plan is about to expire, a payment is due, a PIN has been reset, or a new member has registered or renewed.

• On Android 13 and later, the app asks for your permission before sending notifications.
• You can turn notifications off at any time in your phone's settings.

Device information. When you sign in to the app, it sends the following to our servers so notifications reach the right phone and so you can see which devices are signed in to your account:

• A random device ID generated by the app. This is not your phone's hardware ID, IMEI or advertising ID.
• A Firebase Cloud Messaging push token;
• Your platform (Android or iOS), phone manufacturer and model, operating system version and app version.

Device records are deleted when you log out of the app. See section 13.

Analytics and app links. We use AppsFlyer to measure app installs and to make shared Smarto Gym links open the right screen in the app. When you install or open the app, AppsFlyer receives:

• Device identifiers, including the Android advertising ID and an ID that AppsFlyer generates for the app install;
• Basic device information — IP address, phone model, operating system version, app version and language;
• App usage events, such as the app being installed or opened, and the Smarto Gym link that opened it.

AppsFlyer does not receive your name, phone number, member records, health data or biometric data.

You can reset or delete your advertising ID at any time in your device's Google settings (Settings → Google → Ads, or Settings → Privacy → Ads, depending on your phone). After you delete it, apps receive a blank ID in its place.

We do not sell device information, and we do not use it to show you ads. Apart from the install measurement described above, we do not track you across other apps or websites.

We share information only where it is needed to run the Service:

• Hosting and infrastructure providers that store and serve the application and its backups.
• Payment gateways that collect subscription fees and handle refunds. They process your payment details under their own privacy policies.
• Messaging providers, including WhatsApp and email/SMS services, which deliver the notifications you and your gym send.
• Firebase Cloud Messaging, provided by Google LLC, which delivers the app's push notifications. Google processes the push token and the notification content in order to deliver them. See Google's Privacy Policy.
• AppsFlyer, which measures app installs and opens shared Smarto Gym links in the app. It receives the device identifiers, device information and app usage events described in section 9. See AppsFlyer's Privacy Policy.
• Professional advisers such as accountants and auditors, bound by confidentiality.
• Authorities, where we are legally required to disclose information — for example a valid court order or a lawful request from a government agency.
• A successor entity, if Smarto Gym is ever involved in a merger, acquisition or transfer of business. We will notify you before your data becomes subject to a different privacy policy.

Service providers act on our instructions and are not permitted to use your data for their own purposes.

This marketing website is a static site and does not use advertising or cross-site tracking cookies. Fonts and assets are served with the page.

The dashboard at app.smartogym.in uses strictly necessary cookies to keep you signed in, to remember your preferences, and to protect forms against cross-site request forgery. These cannot be switched off without breaking sign-in. If we introduce optional analytics on the website or dashboard, we will ask for your consent first and update this section.

The mobile app uses AppsFlyer for install measurement and app links, as described in section 9.

We apply security measures appropriate to the sensitivity of the data we hold, including:

• Encryption in transit over HTTPS/TLS for all traffic to the website and dashboard, and for all data sent between the mobile app and our servers;
• Passwords stored only as salted, one-way hashes — never in plain text;
• A separate, private workspace per gym, so one gym can never read another's records;
• Role-based access controls, so staff only see what their role requires;
• Regular backups, and restricted internal access on a need-to-know basis;
• Monitoring and logging to detect unusual activity.

No system can be guaranteed completely secure. If a breach affects your data, we will notify you and the relevant authority without undue delay, and tell you what happened and what to do.

While your subscription is active, we keep your data so the Service works. After a subscription expires or is cancelled, we retain your workspace in an inactive state for 90 days so you can renew without losing anything. After that window we may permanently delete it.

You can ask us to delete your workspace sooner, through the Smarto Gym app or our website — see section 14, Account and data deletion.

Device records (device ID, push token and device details) are kept only while you are signed in. They are deleted when you log out of the app, and when your account is deleted.

AppsFlyer keeps the data it collects under its own retention terms. If you ask us to delete your data, we will also ask AppsFlyer to delete the data linked to your device.

We keep invoices, payment records and tax documents for as long as tax and accounting law requires, even after deletion of the workspace. Backups are rotated on a fixed schedule, so deleted data may persist in encrypted backups for a short period before being overwritten.

Export your data before you cancel. Reports and member data can be exported from the dashboard at any time while your account is active.

You can request deletion of your account and associated data at any time, through the Smarto Gym app or our website. After a request is received, we process it and permanently delete the data from our systems within 30 days.

Gym owners can request deletion of their gym's workspace and their account in any of these ways:

• From the Settings screen in the Smarto Gym app;
• Through our website, by confirming your login email and password;
• By writing to support@smartogym.in from your registered email address. We may ask you to verify your identity.

After you send a request from the app, you are signed out. You can still sign in again until we complete the deletion. Once it is complete, the account can no longer be used to sign in, and all of the gym's data listed below is erased.

To cancel a request, contact us at support@smartogym.in before the deletion is complete.

Gym members can request deletion of their data in either of two ways:

• Through their gym, which controls their records; or
• By emailing support@smartogym.in with their Member ID and gym name.

What is deleted:

• The account, including the owner login and sign-in details;
• Branches, membership plans, payments and balances, and attendance logs;
• Member records, including weight, height and BMI;
• Biometric device settings;
• Device registrations and push tokens.

What we keep longer: nothing from your gym's workspace. The only exception is the invoices we issued for your Smarto Gym subscription and related tax documents, which we keep for as long as tax and accounting law requires. Deleted data may also persist in encrypted backups for a short period before they are overwritten.

Subject to applicable law, you can ask us to:

• Confirm what personal information we hold about you and give you a copy;
• Correct information that is inaccurate, incomplete or out of date;
• Delete information we no longer need to keep;
• Stop sending you marketing messages;
• Withdraw a consent you previously gave;
• Nominate someone to exercise these rights on your behalf if you are unable to.

Write to support@smartogym.in from your registered email address. We may ask you to verify your identity before acting, and we will respond within 30 days.

If you are a gym member rather than a gym owner, send your request to your gym — they control your records, and you cannot edit them in the app yourself. If you contact us instead, include your Member ID and gym name, and we will forward your request to them.

Smarto Gym is a business tool and is not directed at children. Gym owner and staff accounts may only be created by adults. If your gym enrols members under 18, you must obtain verifiable consent from a parent or guardian before entering their details — including weight and height — and you must not enrol a child's biometric data without that consent.

We aim to store and process data on infrastructure located in India. Some service providers — for example messaging, email delivery, push notification delivery through Firebase Cloud Messaging, or install measurement and app links through AppsFlyer — may process limited data outside India. Where that happens, we take steps to ensure the data continues to receive an appropriate level of protection and is transferred only to jurisdictions permitted under Indian law.

We may update this Privacy Policy as the product and the law evolve. The "Last updated" date at the top always reflects the current version. If a change materially affects how we handle your information, we will notify you by email, in the dashboard or in the app before it takes effect.

For any privacy question, request or complaint, contact our grievance officer:

• Email: support@smartogym.in
• Phone / WhatsApp: +91 80865 54006 (Monday – Saturday, 9:00 AM – 7:00 PM IST)
• Postal address: Malappuram, Kerala, India

We acknowledge privacy complaints within 1 business day and aim to resolve them within 30 days. If you are not satisfied with our response, you may escalate the matter to the appropriate data protection authority in India.