Privacy Policy

Who this covers

This policy covers the Varzish Mate club console (web and Android) and the Varzish Mate member app.

A gym owner is our customer. The members of that gym are our customer's contacts, and we process their details on the gym's behalf and under its instructions.

What we collect

• Account details of the gym owner or trainer: name, mobile number, email address, and the club's name and location
• Member records entered by the gym: name, mobile number, plan, joining and expiry dates, payments, and attendance
• Fitness data entered in the member app: height, weight, goals, workout logs and meal logs
• Images uploaded by a user, such as a member photo or a club photo
• Technical data: device type, app version, IP address, and crash and error reports

Why we collect it

We do not sell personal information, and we do not use it to serve advertising.

• To run the service you signed up for: recording members, payments and attendance
• To send the messages you ask us to send, including payment reminders and one-time sign-in codes
• To take payment for a subscription and issue the invoice for it
• To diagnose crashes and errors, and to keep the service working

Who we share it with

Only the service providers needed to run the product, and only with what each one needs. Some of them store and process data outside India, including in the European Union and the United States; where that happens we rely on the provider's own contractual safeguards for the transfer.

Each provider, and what it receives:

• Razorpay — payment processing. Card and bank details are entered on Razorpay's own checkout and never reach our servers
• Meta Platforms Ireland — sending WhatsApp messages, including sign-in codes, reminders and billing links
• Resend — sending email
• Google — Sign in with Google, which gives us your email address, name and Google account id
• Expo — delivering push notifications and app updates. It receives the device's push token and the app and device version
• Google Firebase — delivering push notifications on Android (Firebase Cloud Messaging), and storing images uploaded to the member app before they moved to Cloudinary
• Cloudinary — storing and serving uploaded images
• PostHog — product analytics, hosted in the European Union. We send pseudonymous identifiers and usage events only; we do not send your name, email address or phone number, and we do not send any member's personal information
• MongoDB Atlas and Render — database and application hosting
• Sentry — crash and error reporting
• A government authority, where the law requires it

Security

Traffic between the apps and our servers is encrypted in transit with TLS. Access to production data is restricted to the people who operate the service. Passwords are not stored in readable form, and sign-in codes are short-lived.

We do not offer end-to-end encryption. Our servers can read the records you store, because that is what allows the service to send reminders, compute a ledger and produce a receipt. Anyone claiming otherwise about software of this kind is worth a second look.

How long we keep it

• Account and member records are kept while the account is open
• When a gym owner deletes a club, the club is hidden at once and can be restored for 7 days. After that we remove the club, its members, plans, logs and images within 30 days
• When a member deletes their member-app account, we remove their profile, workout and diet logs, and images within 30 days. The gym's own record of that person as a member (dates, plan, payments, attendance) belongs to the gym and stays with it; ask the gym to remove it
• Invoices, payment records and tax records are kept for as long as Indian tax law requires, which is longer than 30 days and applies even after deletion

Your rights, and how to use them

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it.

Gym owners: delete your club from the console at any time, under Club → Settings → Delete club. We email a code to the club's address to confirm it.

Members: delete your account from the member app, under Profile → Settings → Delete Account.

Or write to support@varzishmate.com from the email address on the account, and we will do it for you.

Children

The service is not directed at children under 13, and we do not knowingly collect their information. A gym that records a minor as a member is responsible for having the guardian's consent.

Grievance officer

Under the Digital Personal Data Protection Act, 2023, complaints about how your data is handled go to a named officer:

Ankit Khyalia — support@varzishmate.com

We aim to acknowledge within 48 hours and resolve within 30 days.

Changes

If this policy changes materially we will update the date at the top and, where the change affects you, tell you in the app.