Privacy Policy: SweatByte Owner app

1. Who is responsible for what

The Owner app is provided by SweatByte ("we", "us"). There are two kinds of personal data in it, and our role is different for each:

• Your own data (you, the owner or staff member): your account, sign-in, role and activity. For this we are the Data Fiduciary under the DPDP Act.
• Your members', leads' and staff's data that you enter or collect through the app (profiles, memberships, attendance, payments, health forms, plans). For this you are the Data Fiduciary and we are your Data Processor: we store and handle it only on your instructions, to run the service. Your duties are in section 8 and in our Owner Terms.

2. Data we handle in the Owner app

About you:

• name, email address, phone number, and your password (stored only as a one-way hash);
• if you use Google sign-in: your Google account identifier, email, name and picture (scopes openid, email, profile only; nothing else from Google, and no Google data is used for advertising or to train any model);
• your role and the workspaces (gyms or trainer businesses) you manage, and a record of important actions you take (the activity log);
• your nominee's name, relation and contact, and your consent choices, if you set them under Privacy and data;
• device and technical information needed to keep you signed in and secure: app version, IP address, error information.

About your business and your people, entered by you or your staff:

• members: name, phone, email, date of birth, gender, address, member code, emergency contact, guardian details for people under 18, health notes, membership plans, freezes and cancellations;
• attendance and check-ins, including door or biometric device IDs. We store the numeric ID that your door device reports; the fingerprint or face template itself stays on your device and is not sent to us;
• invoices, payments, refunds, GST details, expenses, staff salaries and commission, shop sales;
• waiver and health-form answers and signatures, measurements and body data, workout and nutrition plans, food logs you can see for your members;
• leads and enquiries, notices, reviews, and the messages you send to members by app notification, email, SMS or WhatsApp;
• images you upload (logo, ad pictures).

Health and biometric-related details are sensitive. Collect them only where you truly need them, tell people clearly why, and get their consent (section 8).

3. Why we use it

• to sign you in, secure your account and show only what your role allows;
• to run the features you use: members, billing, attendance, programs, communication, reports and settings;
• to take payments and issue invoices through your payment settings, and to keep tax records;
• to send you service messages (receipts, security alerts, plan and trial reminders);
• to prevent fraud and abuse, fix bugs and improve the product using aggregated or de-identified data.

We process your own data with your consent or for another purpose the DPDP Act allows, such as providing the service you asked for or meeting a legal duty. You agree to the Owner Terms and this policy by ticking the box or continuing at sign-in, where the notice is shown. We keep a record of what you agreed to, when and under which version. If we change either document in a way that matters, the app asks you to read and agree again before you continue.

We do not sell personal data, we show no third-party advertising in the Owner app, and we do not profile you for marketing.

4. Device permissions and what stays on your phone

• Camera / photos: only if you choose to take or pick a picture, for example a logo or an ad image. We do not read your gallery.
• Internet: the app works online; it talks to our servers over encrypted connections (HTTPS).
• The app does not use your location, contacts, microphone, call log or SMS, and contains no advertising or third-party analytics code.

Your sign-in token is kept in the Android secure keystore. A small cache of your profile and settings is stored in the app's private storage so it opens fast; signing out clears the token. Android backup of the app is switched off. Screens may show members' personal data, so please use your phone's screen lock.

5. Who we share data with

We share data only as follows:

• Your workspace. Owners, admins, managers, trainers and front desk see what their role permits, set by you.
• Service providers (processors) under written terms: cloud hosting and database; file storage (Amazon Web Services, Asia-Pacific); email delivery; the payment gateway you turn on (Cashfree or Razorpay); Google sign-in; message providers when you send SMS or WhatsApp broadcasts; and the AI provider (OpenAI) only for the Sweatbyte Nutritionist, with a member's consent and without name, phone or email. Some of these process data outside India, which the DPDP Act allows unless the Government restricts a country.
• Authorities, when required by law or a court order.
• A buyer or successor, if the business is sold or merged, with the same protections.

6. How long we keep data

• Your account and workspace data: until you delete them.
• Invoices, payments and credit notes: up to 8 years, as tax and accounting law requires. If a person's account is deleted, the gym keeps these with a name snapshot and no link to the person.
• Consent records: with the account, removed when it is deleted. Grievances: kept after resolution.
• Server and access logs: about one year, for security. Backups are overwritten on the normal cycle.

You can delete your account in the app (Account, Delete account; not possible while you are the only owner of a workspace) and delete a workspace you own (Settings, Workspace). When you delete a workspace its member records are deleted, except what the law makes us keep. Suspend a workspace first if it might come back.

7. Your rights

Under the DPDP Act you may ask for a summary of the personal data we hold about you and who it is shared with, ask us to correct or update it, ask us to erase it and withdraw consent, nominate someone to act for you if you die or cannot, and have your grievance addressed. In the Owner app go to More, Your account, Privacy and data to:

• see what you agreed to and change optional choices;
• download a copy of your data;
• name a nominee;
• write to the Grievance Officer and track the reply;
• read these documents and delete your account.

Your members, leads and staff exercise their rights against you as their Data Fiduciary. If one of them asks you to access, correct or erase their data, you can do it in the app (edit the member, remove them, or delete the workspace) and we will help you on request at hello@sweatbyte.com. We reply to your own requests within 30 days, and sooner for simple ones.

8. Your duties for your members' data

Because you decide why and how you use your members' data, you must:

• tell members clearly what you keep and why, and get their consent where the law needs it. Ask for health, medical and biometric details only if needed, and keep that data to the staff who need it;
• add a person under 18 only with the recorded consent of a parent or legal guardian (the app asks for guardian details when the date of birth is under 18), and never use a child's data for tracking or advertising;
• keep data accurate, delete what you no longer need, and answer your members' requests;
• give each staff member only the role they need, remove people who leave, and never share logins;
• use messaging and promotions only for members who can receive them, and honour opt-outs;
• tell us at once if you suspect a breach so we can help you meet your duty to inform the Data Protection Board of India and the people affected.

9. Security

We use encrypted connections, hashed passwords, role-based access checks on every request, signed file uploads, request throttling, activity logs and encrypted storage of sensitive credentials such as payment gateway keys. No system is perfectly secure. If a breach affects personal data we will tell the affected people and you plainly and without delay: what happened, what data, what we are doing and what you can do, and we will report to the Data Protection Board of India as the law requires.

10. Children

You must be 18 or older to have your own Owner app account. Members under 18 can be added by a gym only as described in section 8. We do not show advertising to anyone whose date of birth shows they are under 18.

11. Changes to this policy

We may update this policy when the product or the law changes. The new version is posted here with a new date, and the app asks you to agree again if the change is significant.

12. Grievance Officer and contact

For any question, complaint or request about your data, contact our Grievance Officer, at hello@sweatbyte.com. You can also write from the app (Privacy and data) and get a reference number. We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is operational and after you have raised the matter with us.

See also: Owner Terms and Conditions, Privacy Policy (member app and website).