Privacy Policy

THE CULT CLIENT is operated by [company name — to be published], [registered address — to be published] (“we”, “us”).

• Gym owner and staff accounts. When a gym signs up and adds staff, we decide why and how that account data is used. For it, we are the Data Fiduciary.
• Gym members. Member records are entered and controlled by the gym. The gym is the Data Fiduciary for its members and decides what it collects. We process that data only on the gym’s instructions, to provide the service. We are the gym’s Data Processor. If you are a member, the gym you joined is your first point of contact for your data, and we will help it answer you.

• Account data: name, email, phone number, password (stored only as a one-way hash), role, and multi-factor authentication settings.
• Member records a gym keeps: name, contact details, date of birth, gender, address, emergency contact, photo and documents the gym uploads, memberships, payments, attendance and check-in credentials, workout and nutrition plans, body measurements and goals.
• Health information: answers to a gym’s health screening questionnaire, injuries, allergies and medical notes, where the gym records them. This is sensitive. A gym should collect it only with the member’s consent and only to train them safely.
• Technical data: IP address, device and browser type, sign-in times, push-notification tokens, and security and audit logs of actions taken in the software.

• To provide the service: sign-in, running the gym’s records, reminders and notifications.
• To keep it secure: detecting abuse, rate-limiting sign-in attempts, keeping audit trails.
• To bill gyms for their subscription and meet tax and accounting obligations.
• To support you when you contact us, and to fix faults.

We do not sell personal data, and we do not use member data for advertising.

We use trusted providers to run the service. Each receives only what its task needs:

• Cloud hosting, database and file storage, for running the application and storing records.
• MSG91, for SMS sign-in codes.
• Email delivery, for account, password-reset and gym messages.
• Meta (WhatsApp Business), for WhatsApp messages a gym chooses to send.
• Google Firebase Cloud Messaging, for push notifications to devices you have turned them on for.
• Razorpay and Stripe, for payments. We do not store card numbers.
• OpenRouter and the AI model providers it routes to, for AI features a gym uses. A request carries only the data that feature needs.
• Sentry, for error reports that help us fix faults.

We may also disclose data where the law requires it, for example to comply with a valid order from a court or government authority.

We keep data while the gym’s account is active. When a gym closes its account, we delete or anonymise its data within a reasonable period, unless the law requires us to keep it longer, for example tax and invoice records. A gym decides how long it keeps an individual member’s record while its account is active.

Data is encrypted in transit. Passwords are hashed. Each gym’s data is kept separate from every other gym’s, and access inside a gym is limited by staff role. Owners can require multi-factor authentication, and sensitive actions are recorded in an audit log.

Under the DPDP Act you can ask to:

• know what personal data is held about you and how it is used;
• have inaccurate or incomplete data corrected, and out-of-date data updated;
• have your data erased once it is no longer needed, unless the law requires it to be kept;
• withdraw consent you gave, which does not affect anything done before you withdrew it;
• nominate someone to exercise these rights for you if you die or become unable to;
• have a grievance addressed, and escalate it to the Data Protection Board of India if it is not.

Members should contact their gym first. You can also write to our Grievance Officer below, and we will respond within the time the law requires.

The service is not meant for use by anyone under 18 on their own. Where a gym registers a member under 18, the gym must obtain verifiable consent from a parent or lawful guardian before recording their data, as the DPDP Act requires.

[Grievance Officer name — to be published]
Email: [Grievance Officer email — to be published]
Address: [registered address — to be published]

We will update the effective date above when this policy changes, and tell gym owners in the app or by email before a significant change takes effect.