Privacy Policy

1. Who We Are

The GymShark ("we", "us", "our") is a gym management SaaS platform accessible at thegymshark.com. We act as a data processor for gym owners (data controllers) who use our platform to manage their members.

Contact: support@thegymshark.com

2. Information We Collect

2.1 Account Information (Gym Owners & Staff)

• Name, email address, phone number
• Business name, address, and type
• Billing information (processed securely via Paddle)
• Login credentials (password stored as encrypted hash)

2.2 Gym Member Data (Collected on behalf of gym owners)

• Full name, phone number, email address
• Member ID, date of birth, gender
• Emergency contact information
• Membership packages and payment history
• Attendance and check-in records
• Progress data (weight, measurements) — entered voluntarily by members
• Profile photos (optional)

2.3 Usage Data

• IP address, browser type, device information
• Pages visited, features used, time spent
• Error logs and performance data
• Push notification tokens (for member app)

3. How We Use Your Information

4. Data Sharing

We do not sell your personal data. We share data only with:

• Paddle — Payment processing (paddle.com)
• Railway — Cloud infrastructure and database hosting
• Vercel — Website and dashboard hosting
• Expo/Google/Apple — Push notification delivery
• Twilio — WhatsApp and SMS notifications (when configured)
• Law enforcement — When legally required

All third-party processors are bound by data processing agreements and industry-standard security practices.

5. Data Security

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Bcrypt hashing for all passwords and PINs
• Regular security audits and vulnerability assessments
• Role-based access controls for staff
• Automatic session expiry and token rotation

6. Data Retention

We retain your data for as long as your account is active. After account termination:

• You may export all your data within 30 days of cancellation
• Account data is deleted within 90 days of termination
• Backup copies are purged within 180 days
• Some data may be retained longer if required by law

7. Your Rights

Depending on your location, you may have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your data
• Portability — Export your data in a common format
• Objection — Object to certain data processing
• Restriction — Limit how we process your data

To exercise these rights, contact us at support@thegymshark.com. We will respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management. We use analytics cookies (with your consent) to improve our platform. You can control cookie preferences in your browser settings.

9. Children's Privacy

The GymShark is not directed to children under 16. If a gym owner collects data from minors, they are responsible for obtaining appropriate parental consent as required by local law.

10. International Data Transfers

Your data may be processed in countries outside your own, including the United States. We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We will notify you of material changes to this policy via email or in-app notification at least 30 days in advance. Continued use of the service after changes constitutes acceptance.

12. Contact & Data Protection

For privacy concerns or data requests, contact us at:

• Email: support@thegymshark.com
• Website: thegymshark.com