Privacy Policy

Who handles your information

MyFitDesk (“we”, “us”) provides management software for gyms and fitness centres. We use account, platform billing, security and support information to operate our service. Privacy and grievance contact: support@myfitdesk.app.

For member, lead and gym operational records, the gym decides what information to collect and how to use it; MyFitDesk processes it on the gym's behalf. This includes information about team members entered by the gym. Members and prospective members should contact their gym first about these records. You can also contact us if you cannot reach the gym, or your request concerns information we use for our own account, billing or support purposes.

Account and business information

• Owner, staff and trainer names, email addresses, phone numbers, usernames, account identifiers, invitations, roles, branch assignments and access status.
• Authentication information needed for passwords and sign-in codes, including WhatsApp verification where used. Passwords are managed by our authentication provider and are not stored by MyFitDesk in readable form.
• Gym and branch names, addresses, contact details, logos, business or tax identifiers, membership and tax settings, and notification preferences.
• MyFitDesk trial and subscription records, selected plans, payment and invoice references, WhatsApp credit purchases and balances, and AutoPay mandate status, billing dates and cancellation or authorisation history.
• Personal display preferences, such as page size, message preferences and recorded WhatsApp opt-out settings, and information you provide when asking for support.

Information recorded by gyms

• Members: names, contact details, gender, member identifiers, branch, joining and membership dates, status, assigned trainers, and optional profile photos or identity documents uploaded as images or PDFs.
• Membership and transaction history: plans, renewals, freezes, dues, payments, payment methods and references, approvals, rejections, refunds, product purchases, invoices and receipts.
• Leads: names, contact details, optional age and gender, enquiry source, interests, trial or follow-up dates, assigned staff, notes, activity history and conversion status.
• Business operations: inventory and purchase records, supplier information, expenses, recurring expenses, uploaded receipts, tax information and reports. These records may contain personal information supplied by the gym.
• Communications: chosen recipients, campaign content and schedules, message content or template values, receipt images, sending history and delivery information.

Gyms should collect only information needed for their operations and explain their own practices to the people concerned. Identity documents are optional; avoid uploading unnecessary sensitive information. Business branding such as a gym logo may be publicly accessible when used on receipts or other shared materials. Downloaded exports and copies shared outside MyFitDesk are controlled by the person or gym that downloads or shares them.

WhatsApp and other communications

Messaging can use a gym's connected WhatsApp Business number or a MyFitDesk-managed number. To connect a gym's account through Meta, we receive business and account identifiers, phone-number details, connection status and an access token. The token is encrypted before storage and is used to provide the connection and send authorised messages.

• Sending messages shares the recipient's phone number and message content with Meta, including relevant names, membership dates, payment details or receipt images. Email and SMS delivery similarly shares the recipient details and message with the relevant provider.
• We store outgoing message records, campaign details, credit charges and returns, and delivery information such as sent, delivered, read or failed status, timestamps and delivery references.
• For incoming messages to a gym's own connected number, the gym messaging flow records the sender's phone number, message reference and time rather than the reply text.
• For incoming messages to the shared MyFitDesk-managed number, our platform inbox can also store message text, message type and the sender's WhatsApp profile name, phone number and time. Authorised platform personnel can use this inbox to handle and route communications or support enquiries. Non-text messages may have only a type description rather than their media content.
• Owners may receive WhatsApp sign-in codes, business summaries, operational alerts and MyFitDesk subscription receipts according to the feature and settings used. These messages can contain gym activity or financial information; keep the receiving number secure.

We use WhatsApp and Meta information to provide messaging, connection management, delivery tracking and support. We do not sell it or use it for our own advertising. Disconnecting a gym's own number removes the stored connection details and token when the disconnect succeeds; it does not erase historical messages or necessarily disable MyFitDesk-managed messaging. Review automations and scheduled campaigns separately. WhatsApp also handles information under its Privacy Policy.

How we use information

• Provide accounts and role-based gym access, manage members and leads, process operational records, and generate receipts, exports and reports.
• Deliver messages requested by the gym, run enabled automations and scheduled campaigns, and provide account verification, owner alerts and support.
• Verify payments, issue platform and credit-purchase invoices, manage subscriptions and optional AutoPay, and resolve payment or credit discrepancies.
• Maintain change histories, investigate errors or misuse, monitor service performance, protect access and comply with applicable legal obligations.

We do not sell personal information or use gym member and lead records for MyFitDesk's own marketing. The gym is responsible for the permissions required for its communications, including promotional campaigns, and for honouring requests to stop.

Cookies, local storage and technical information

The website uses authentication cookies and a workspace-selection cookie to keep you signed in and open the correct gym. Browser local or session storage can remember whether a credit reminder has already appeared. Some preferences are saved to your account so they work across devices. Clearing cookies or blocking this storage may sign you out or affect these features.

We record operational information such as request routes, response status, timings, gym identifiers and error details to maintain the service. Our application performance monitor is designed to exclude request bodies, authentication tokens and direct personal identifiers, and to redact sensitive error values. Hosting and delivery providers may also process connection information, such as IP addresses and browser or device information, under their own service and security practices.

Who can access information and service providers

Authorised gym users can access records according to their roles and branch permissions. Authorised MyFitDesk personnel may access information to administer the platform, provide support, resolve billing issues and protect the service. We share the information needed by providers that operate relevant features:

• Supabase — database hosting, authentication and, where configured, file storage.
• Vercel — application hosting and operational services.
• Cloudflare R2 — storage of uploaded images and documents where configured.
• Resend — email delivery; MSG91 — SMS delivery where enabled.
• Meta (WhatsApp Business Platform) — connected and managed WhatsApp messaging, sign-in codes and delivery information.
• Razorpay — MyFitDesk subscription payments, AutoPay and WhatsApp credit purchases, and gym payments where connected; PhonePe — gym payments where connected.

Payment credentials are entered with the payment provider. MyFitDesk does not store full card numbers, CVVs or bank login credentials. We do retain payment references, method and status information needed for receipts, verification and billing. Connected gym gateway secrets are encrypted before storage.

Providers may process information in India or other countries depending on their infrastructure and the service configuration. We do not promise that all data stays in India. Transfers are subject to applicable law. We may also disclose information when legally required or necessary to protect users' rights and safety.

Security

We use encrypted connections, database access rules that scope gym records, role and branch permissions, protected file access and encryption for stored integration secrets. No system can guarantee complete security. Keep account credentials, receiving phones, exported files and shared links secure, and contact support promptly about suspected unauthorised access.

Retention, archiving and deletion

We keep gym records while needed to provide the account and its features. A subscription lapse alone does not delete them. Archiving a member retains their history and associated uploads for possible restoration; it is not permanent erasure. Staff or trainer account deactivation likewise does not erase the gym's business or audit records.

An owner's gym deletion request immediately restricts access and normally has a seven-day recovery period. An administrator-arranged request can have a three-to-seven-day period. The deadline shown for that request governs. After the deadline, automatic cleanup of the gym's database records and uploads begins. It may take time to finish across services. Some billing, legal, security or deletion records may need to be retained for applicable obligations or disputes. Backup copies and provider-held records may remain until their applicable retention periods expire.

Retention varies by record type and service. See our data deletion instructions for requesting permanent erasure, removing a connection or checking a request's status.

Your choices, requests and grievances

You can update editable account details, manage available notification preferences, disconnect your own WhatsApp or payment connection, and request account deletion. Owners can download the available member CSV and report exports; these do not include every record held by the service.

Contact your gym about access to, correction or erasure of gym-controlled information and to stop gym communications. Contact support@myfitdesk.app about MyFitDesk account information, support messages, privacy requests or grievances. Include the gym name and enough information to identify the relevant account. We may verify your identity and authority before disclosing or deleting information. Do not send passwords, sign-in codes or full payment credentials.

Applicable law may provide rights to access, correction, erasure, consent withdrawal and grievance redressal. Rights under India's Digital Personal Data Protection Act, 2023 and related rules apply as their relevant provisions come into force. Requests remain subject to legal retention requirements and the rights of others. Withdrawing permission needed for a feature may prevent us or the gym from providing it.

Children

MyFitDesk accounts are intended for gym businesses and their authorised users. Where a gym records a child as a member or lead, it is responsible for obtaining required parent or guardian consent and complying with applicable protections for children's information. A parent or guardian can contact the gym or MyFitDesk about the child's data.

Changes and contact

We may update this policy as features or data practices change. The date above identifies this version. We will notify gym owners of significant changes and obtain any additional consent required by law. Privacy requests and questions: support@myfitdesk.app.