Privacy Policy

1. Who we are

SnowFit is gym management software for fitness businesses in India. It is provided by [SnowFit Technologies Private Limited], a company registered in India with its office at [registered address, city, PIN] ("SnowFit", "we", "us").

This policy covers our website www.thesnowfit.com, the SnowFit web and mobile apps, and our WhatsApp, SMS and email messages (together, the "Service"). It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), its Rules, and the Information Technology Act, 2000.

2. Our role: gyms decide, we process

• For gym members' data, the gym is in charge. A gym that uses SnowFit (our "Customer") decides why and how its members' data is used. Under the DPDP Act the gym is the Data Fiduciary and SnowFit is its Data Processor. We act only on the gym's instructions and our agreement with it.
• For everything else, SnowFit is in charge. For gym owners' and staff accounts, website visitors, enquiries and our own marketing, SnowFit is the Data Fiduciary.

If you are a gym member and want to use your rights over the data your gym holds, please contact your gym first. We will help your gym respond.

3. Data we collect

From gyms (owners and staff)

• Name, mobile number, email, role and login details.
• Business details: gym name, address, GSTIN, plans and prices.
• Billing details for your SnowFit subscription. Card and UPI details are handled by our payment partner, not stored by us.

About gym members (added by the gym)

• Name, mobile number, email, gender, date of birth and photo.
• Membership, plan, payments, dues and invoices.
• Attendance and check-in times, and class and workshop bookings.
• Fitness goals, body measurements or notes the gym chooses to record.
• Biometric data: if the gym uses fingerprint check-in, the reader stores an encrypted template of the fingerprint, not a fingerprint image. It is used only to mark attendance.

From visitors and automatically

• Details you give us in forms, such as your email when you sign up or ask for a demo.
• Technical data: IP address, device and browser type, pages visited and error logs, kept to run, secure and improve the Service.

4. How we use data

• To provide the Service: member records, attendance, billing, reminders and reports.
• To send the messages a gym sets up, such as renewal, payment and class reminders on WhatsApp, SMS or email.
• To bill our Customers, provide support and keep accounts secure, including fraud and abuse prevention.
• To improve SnowFit using aggregated, de-identified usage data. We do not train AI models on a gym's member data for other customers.
• To tell you about product updates. You can unsubscribe from marketing at any time.
• To meet legal duties, such as tax records, or requests from authorities that are lawful.

We process personal data on the basis of consent, or for legitimate uses the DPDP Act allows, such as providing a service you asked for or meeting a legal duty. You can withdraw consent at any time (see Your rights). That doesn't affect anything done before you withdrew it.

5. Who we share data with

We share personal data only with service providers who help us run SnowFit, under contracts that require them to protect it:

• Hosting and database: Supabase and Vercel.
• Messaging: Meta (WhatsApp Business Platform) and our SMS and email providers [names].
• Payments: [Razorpay / Cashfree], for subscription and member payments.
• Fonts and performance: Google Fonts, which receives your IP address when pages load.

We may also disclose data if the law requires it, to protect people's safety, or as part of a merger or sale of our business, with notice to you. We never sell personal data.

6. Where data is stored

Data is stored on secure cloud servers in [India (Mumbai) / Singapore]. Where data is processed outside India, we do so only in countries the Government of India has not restricted under the DPDP Act, and with protections in our contracts.

7. How long we keep data

• Gym and member data: for as long as the gym's account is active. When a gym leaves, it can export its data. We delete it within [90] days, unless the law requires us to keep it longer.
• Biometric templates: deleted when the member is removed or the gym turns off fingerprint check-in.
• Invoices and tax records: for 8 years, as Indian tax law requires.
• Technical logs: up to 180 days.

8. How we protect data

We use encryption in transit (HTTPS) and at rest, role-based access so staff see only what they need, row-level security in our database, regular backups and monitoring. If a personal data breach happens, we will inform affected gyms, the Data Protection Board of India and, where required, the people affected, as the law requires.

9. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you and how we use it.
• Correction and update: fix data that is wrong or incomplete.
• Erasure: ask us to delete data we no longer need.
• Withdraw consent: as easily as you gave it.
• Nominate someone to use these rights for you if you die or can't act yourself.
• Grievance redressal: complain to us, and then to the Data Protection Board of India if you're not satisfied.

To use a right, email [privacy@thesnowfit.com] from the email or mobile number linked to your account. Gym members should contact their gym first (see Our role). We may ask you to confirm your identity.

10. Children

SnowFit is a business tool for adults. Gyms that add members under 18 must get verifiable consent from a parent or guardian before adding them, and must not use their data for tracking or targeted advertising.

11. Cookies and local storage

Our website does not use advertising or cross-site tracking cookies. We use only:

• Essential storage: to keep you signed in to the SnowFit app and admin areas.
• Session storage: to count a blog article's views once per visit. It holds no personal data, and it's cleared when you close the tab.

If we ever add analytics or marketing cookies, we will ask for your consent first and update this section.

12. Changes to this policy

We may update this policy as SnowFit or the law changes. The date at the top shows the latest version. If a change matters, we'll tell our Customers by email or in the app before it takes effect.

13. Contact and Grievance Officer

For any question, request or complaint about privacy, contact our Grievance Officer:

[Name], Grievance Officer [SnowFit Technologies Private Limited] [registered address, city, PIN] Email: [privacy@thesnowfit.com]

We acknowledge complaints within 48 hours and aim to resolve them within 7 days. If you're not satisfied, you may complain to the Data Protection Board of India.