Privacy Policy

01Who we are

Gyms Cloud is a gym management service provided by Cybex Innovation, Unit 101, Oxford Towers, 139, HAL Old Airport Road, Kodihalli, Bangalore - 560008, Karnataka, India (“Cybex Innovation”, “we”, “us”). GSTIN 29CQJPM7492R1ZI.

This policy explains how we handle personal data when you visit our website, sign up for Gyms Cloud, use the Gyms Cloud web app, member app or API, or contact us. If you have any question about it, write to info@cybexinnovation.com.

02Our role: controller and processor

Gyms Cloud holds two different kinds of personal data, and our responsibility is different for each:

• Customer account data — information about gyms that subscribe to Gyms Cloud and the people who sign up and pay for it (for example the owner’s name, email, phone and billing details). For this data, Cybex Innovation is the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).
• Gym data — information a gym puts into Gyms Cloud about its own members, staff and trainers (for example member profiles, memberships, payments, invoices and attendance). For this data, the gym is the controller (data fiduciary) and Cybex Innovation is a processor that handles it only on the gym’s behalf and on its instructions.

03What we collect

From gyms and their staff (customer account data)

• Account details: gym name, country, state or region, city, owner name, email address, phone number and password (stored only as a one-way hash).
• Business details the gym adds in settings: address, tax registration number (such as GSTIN, VAT or TRN), logo, invoice preferences and time zone.
• Staff accounts: name, email, phone, role and password hash for each staff member the gym invites.
• Subscription and billing: the Gyms Cloud plan, billing history and the invoices we issue to the gym.
• Payment gateway settings: if a gym connects Razorpay, its Razorpay key ID and an encrypted copy of its key secret and webhook secret.

About gym members (gym data, processed for the gym)

• Profile: name, phone number, email, gender, date of birth, address, photo, emergency contact and notes the gym records.
• Membership and training: plans bought, start and end dates, freezes, personal-training packages and sessions, and the assigned trainer.
• Money: invoices, payments, receipts, dues, and the member’s tax number where the gym issues a business invoice.
• Attendance: check-in and check-out times and how the member checked in (desk, QR code, member app or device).
• Member app access: a password hash if the gym gives the member app access, and the time of the last sign-in.

Automatically

• Security and activity logs: IP address, sign-in times, the device name an app reports, and an audit trail of important actions (for example a sale, a void or a settings change) with who did it and when.
• Technical data: browser type and error logs needed to keep the service working.

When you contact us

The name, email, phone, gym name, country and message you send through our contact form, together with your IP address (used to prevent spam).

We do not knowingly collect special categories of personal data beyond what a gym chooses to record about its members, and we ask gyms not to store health or medical details in free-text notes unless they have a lawful basis to do so.

04Biometric data

Gyms can connect fingerprint and face recognition devices (such as eSSL / ZKTeco fingerprint terminals and AiFace face panels) to Gyms Cloud to control entry.

Gyms Cloud uses the device PIN to tell a device whether a member’s access is on or off (for example when a membership starts, ends or is renewed) and to record attendance when the device reports a check-in.

Because biometric data is sensitive, the gym is responsible for telling its members that it uses biometric entry, for obtaining their explicit consent where the law requires it, for offering an alternative way in (such as the desk or a QR code) to members who do not consent, and for deleting templates from its devices when they are no longer needed.

05How we use personal data

We use customer account data to:

• create and run your Gyms Cloud account, sign you in and keep it secure;
• provide the features you use, provide support and respond to your requests;
• bill you for your subscription and keep the records the law requires;
• send you service messages — for example about your trial, billing, security or important changes;
• understand, in aggregate, how Gyms Cloud is used so we can improve it;
• prevent fraud and abuse, and comply with the law.

We use gym data only to provide Gyms Cloud to that gym: to store and display it, calculate memberships, invoices and taxes, sync access to the gym’s devices, process online renewals the gym enables, and produce the gym’s reports. We do not use gym data for our own marketing, we do not sell it, and we do not use it to build advertising profiles.

Legal bases

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you; our legitimate interests in running, securing and improving Gyms Cloud (balanced against your rights); compliance with legal obligations such as tax record-keeping; and consent where we ask for it. Under India’s DPDP Act we process customer account data for the specified purposes above, with your consent given at sign-up and for legitimate uses permitted by the Act.

06Payments

When a gym turns on online renewals, members pay through Razorpay, a regulated payment gateway. The payment is made directly to the gym’s own Razorpay account. Gyms Cloud never sees or stores card numbers, UPI PINs, CVVs or bank passwords. We receive from Razorpay only what is needed to record the payment — such as the order and payment IDs, the amount, the status and the time.

Razorpay processes payment data under its own privacy policy as an independent controller. Payments that a gym records at its desk (cash, card machine, UPI or bank transfer) are recorded in Gyms Cloud only as an amount, method and optional reference.

07Who we share data with

We share personal data only as needed to run Gyms Cloud:

• Infrastructure providers who host our servers, databases and backups under contracts that require them to protect the data and use it only for us.
• Payment providers (Razorpay) when a gym uses online payments, as described above.
• The gym’s own connected services — for example the gym’s biometric devices, or a mobile app the gym builds with the Gyms Cloud API using a token the gym issues.
• Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
• Authorities when we are legally required to, after checking that the request is lawful; where allowed, we tell the affected gym first.
• A successor business if Cybex Innovation is involved in a merger or sale, which must keep honouring this policy.

Our website loads fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them. We do not use advertising networks, social media trackers or third-party analytics cookies.

08Cookies and local storage

That is all. We use no advertising or tracking cookies, so we do not show a cookie consent banner. Mobile apps that use the API store a sign-in token on the device instead of a cookie.

09How long we keep data

• Gym data is kept for as long as the gym’s account is active. Gyms can delete members and records at any time. After a gym cancels, its data remains available for export for 30 days and is then deleted from our live systems; copies in encrypted backups are overwritten within a further 90 days.
• Customer account and billing records that we must keep by law — such as the invoices we issue to gyms — are kept for at least six years, or longer where tax law requires.
• Security and audit logs are kept for the life of the account so a gym can see who did what; failed sign-in counters are kept for 15 minutes.
• Contact form messages are kept for up to 24 months, then deleted unless they became part of a customer relationship.

10How we protect data

• All traffic to Gyms Cloud uses HTTPS (TLS). Passwords are stored only as strong one-way hashes.
• Each gym’s data is isolated: every request is scoped to the signed-in user’s gym, and access within a gym is limited by role and permission.
• Payment gateway secrets are encrypted at rest with AES-256-GCM, and are never returned by the API.
• Sign-in attempts are rate-limited, sessions expire, and app tokens can be revoked at any time.
• Production access is restricted to authorised Cybex Innovation staff, and platform support actions are recorded in the audit log.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify the affected gym and, where required, the relevant authorities and individuals without undue delay. Read more on our security page.

11International transfers

Gyms Cloud serves gyms in many countries. Your data is processed on servers operated by our infrastructure providers and may be accessed by our team in India to provide support. When personal data of people in the European Economic Area, the United Kingdom or another country with transfer rules is transferred to a country without an adequacy decision, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK addendum), and we will provide a copy on request. Transfers out of India are made in line with the DPDP Act and any restrictions notified under it.

12Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate or incomplete data and update it;
• erase your data when it is no longer needed or you withdraw consent (see data deletion);
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability — receive your data in a common, machine-readable format (gyms can export CSV files at any time);
• withdraw consent at any time, without affecting processing that already took place;
• under India’s DPDP Act, grievance redressal and to nominate another person to exercise your rights in the event of death or incapacity;
• complain to a data protection authority — for example the Data Protection Board of India, or your local supervisory authority in the EU or UK.

To exercise a right over customer account data, email info@cybexinnovation.com. For gym data (for example, if you are a member), please contact your gym; we will assist the gym in responding. We may need to verify your identity before acting, and we respond within one month (or sooner where the law requires).

13Children

Gyms Cloud is a business tool and is not directed at children. Gyms may record members under 18; where they do, the gym is responsible for obtaining verifiable consent from a parent or lawful guardian as the law requires, and for not using such data for tracking, behavioural monitoring or targeted advertising.

14Changes to this policy

We will update this policy when our practices change. If a change is material, we will tell gym owners by email or in the app at least 15 days before it takes effect. The effective date at the top always shows the current version.

15Contact and grievance officer

Cybex Innovation
Unit 101, Oxford Towers, 139, HAL Old Airport Road, Kodihalli, Bangalore - 560008, Karnataka, India
Email: info@cybexinnovation.com · Phone: +91 80 6217 8236

Grievance Officer (India — DPDP Act 2023 and the Information Technology Act, 2000): Grievance Officer, Cybex Innovation, at the address above, email info@cybexinnovation.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

For the GDPR, Cybex Innovation is established in India; you may contact us directly at info@cybexinnovation.com on any data protection matter.