Privacy Policy
Pocketly Tech LLP · Effective 31 July 2026
Draft pending legal review
This document reflects how the product actually works and is awaiting review by qualified counsel. Highlighted items are facts still to be confirmed.
01Who we are
GymKeeping is software operated by POCKETLY TECH LLP, a limited liability partnership registered in India. GymKeeping is the product’s name; the entity responsible for your data is Pocketly Tech LLP.
| Registered office | First Floor, B/7, 102, Plot No. 13, Orchids, Bhawani Nagar, Marol Naka, Mumbai, Maharashtra 400059 |
| GSTIN | 27ABJFP3768J1ZM |
| Privacy contact | pocketlytech@gmail.com |
| Grievance Officer | See the Contact page |
02If you are a gym owner or staff member
You are our customer, and for your own account data we are the Data Fiduciary.
| Category | Examples | Why |
|---|---|---|
| Account and identity | Name, email, authentication identifiers held via Clerk | To create and secure your account |
| Gym profile | Gym name, logo, branches, city, currency, tax settings, theme | To run the Service for you |
| Role and access | Your role, and which branch you are scoped to | To enforce permissions |
| Billing | Plan, payment status, invoice history, billing email, GSTIN | To bill you and issue GST invoices |
| Usage and technical | Log data, IP address, browser and device information, errors | Security, debugging, abuse prevention |
| Support | Messages you send us | To answer you |
We never see your card details
Card data is collected and stored by Razorpay. It does not pass through our systems.
We rely on performing our contract with you, complying with tax and other legal obligations, and our legitimate interest in securing and improving the Service. Where we rely on consent — product marketing email, for instance — you can withdraw it at any time.
We use no advertising or cross-site tracking cookies. Only these:
| Cookie | Purpose | Type |
|---|---|---|
| Clerk session | Keeps you signed in and protects the session | Strictly necessary |
| gk_theme | Remembers your gym’s colour theme so pages do not flash the wrong one | Preference — no identifier |
| Active branch | Remembers which branch you last worked in | Preference |
03If you are a gym member
You are probably here because you got a message about your membership
Your gym uses GymKeeping to manage memberships and send reminders before one expires. Your gym decided to hold your details and to message you. Under the DPDP Act your gym is the Data Fiduciary; we act only as its Data Processor, on its instructions. We do not sell your data, use it for advertising, or use it for any purpose of our own.
What your gym holds about you in the Service: name; phone; email; your membership and plan history; payments your gym recorded; invoices issued to you; class bookings and attendance; and whether you consented to messages, with a record of what was sent and whether it was delivered.
Why the message came from a number you do not recognise
Reminders are delivered through WhatsApp, SMS and email accounts operated by Pocketly Tech LLP on your gym's behalf, rather than from your gym's own number. The message names your gym so you can tell whose membership it concerns, and it was sent because your gym asked us to send it.
To stop receiving messages: reply STOP to any WhatsApp or SMS, use the unsubscribe link in an email, or ask your gym. We record opt-outs centrally and stop sending regardless of your gym’s settings.
To see, correct or delete your data, please contact your gym — they control it and can act on it directly. If you contact us we will acknowledge you and refer you to them; we are not permitted to change a gym’s records on our own initiative. If your gym does not respond, our Grievance Officer will follow it up with them.
04Who we share data with
Only what each provider needs, and only to run the Service. We do not sell personal data and do not share it for anyone else’s marketing.
| Recipient | What for |
|---|---|
| Clerk | Authentication and session management |
| Twilio | WhatsApp, SMS and transactional email delivery |
| SendGrid (a Twilio company) | Fallback transactional email |
| Razorpay | Subscription payment processing |
| Railway | Application hosting |
| Managed Postgres provider | Database hosting |
We also share with professional advisers and auditors under a duty of confidence, and with authorities where the law requires it, to the extent it requires.
Some providers process data outside India. Where they do, we rely on the transfer mechanisms permitted by the DPDP Act and rules made under it.
05How long we keep data
| Data | Retention |
|---|---|
| Gym account and member data | Your Subscription, then 90 days after termination, then deleted or irreversibly anonymised |
| Invoices, payment and tax records | 8 years |
| Opt-out records | Kept indefinitely — an opt-out we cannot evidence is worse than no record |
06How we protect data
Role-based access control, with staff access scoped to a single branch where you configure it; encryption in transit; credentials held as environment configuration and never committed to source control; signature verification on inbound payment and messaging webhooks; and authenticated scheduled jobs.
No system is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires.
07Your rights
Subject to applicable law you may ask us to confirm what we hold about you and give you access, correct or complete inaccurate data, erase data we no longer need, withdraw a consent you gave, or raise a grievance.
Write to pocketlytech@gmail.com and we will respond within 30 days. We may need to verify your identity first. Members: your route is through your gym — see the section above.
The Service is not intended for children. If you record a member under 18, you are responsible for obtaining verifiable consent from a parent or guardian as the DPDP Act requires.
08Changes, and how to complain
We may update this policy, and will notify material changes by email or in the Service. The “last updated” date above always reflects the current version.
Our Grievance Officer is named with full contact details on the Contact page. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.