Skip to content
Clubstance
Start free
Sign in Get started
Legal

Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how Clubstance ("Clubstance", "we", "us") collects, uses, shares, and protects personal data when you use our gym management platform at app.clubstance.com or visit clubstance.com. It is written to meet the notice requirements of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and to be transparent with everyone whose data touches our platform — gym owners, their staff, and their members.

Clubstance is currently operated as a remote-first product business based in Hosur, Tamil Nadu 635109, India. Formal company incorporation is in progress; this policy will be updated with the registered entity name, registered office, and CIN/GSTIN when available ([LEGAL ENTITY NAME — pending incorporation]). Until then, correspondence for privacy matters may be sent to the contact details below or via [email protected].

1. Who is responsible for your data

The DPDP Act distinguishes between a Data Fiduciary (who decides why and how personal data is processed) and a Data Processor (who processes it on the fiduciary's behalf). On Clubstance, both roles exist:

  • For gym owner and staff account data (your name, email, phone, gym details, billing records): Clubstance is the Data Fiduciary. We decide how this data is processed and are directly responsible to you.
  • For gym member data (the records a gym uploads or collects about its members): the gym is the Data Fiduciary and Clubstance is a Data Processor acting on the gym's documented instructions. Members should direct requests about their data to their gym first; we support gyms in fulfilling them. Our Data Processing Terms govern this relationship.

2. What we collect

Account data (gym owners & staff)

  • Name, email address, phone number, and password (stored hashed).
  • Gym name, branch details, address, and business information you provide.
  • Subscription and billing records (plan, invoices, payment status).
  • Google account identifiers if you sign in with Google.

Member data (uploaded or collected by gyms)

  • Identity and contact details: full name, phone, alternate phone, email, date of birth, address, and emergency contact.
  • Member photographs, if the gym uploads them.
  • Membership plans, attendance and check-in history, payments and dues, workout and nutrition assignments, loyalty points, and lead/enquiry records.

Biometric check-in data — processed locally, not in our cloud

Gyms that use fingerprint or face check-in run a small "biometric bridge" on their own premises, connected to their biometric device. Fingerprint and face templates are stored on the device/bridge inside the gym's local network and are never transmitted to or stored on Clubstance's cloud servers. Our servers receive only a device-user mapping and check-in events (who checked in, when, by which method). Enrolment and deletion of biometric templates happen at the gym, under the gym's control and consent process.

Technical and usage data

  • Device and browser metadata, IP address, and pages/features used.
  • Error and performance telemetry via Sentry, including session replay on the app: a sample of sessions (currently ~10%, and sessions where an error occurs) is recorded to help us fix bugs. All text you type into form fields is masked before it leaves your browser.

3. Why we process it (purposes & lawful basis)

  • To provide the service you signed up for — membership management, billing, attendance, messaging, reports (consent given at signup / performance of our agreement with you).
  • To send transactional communications: renewal reminders, receipts, alerts.
  • To provide support and respond to your requests.
  • To secure the platform, prevent abuse, and debug errors.
  • To comply with law — tax, accounting, and lawful requests from authorities.

We do not sell personal data, and we do not use member data for advertising.

4. Who we share data with

We share personal data only with service providers ("sub-processors") that help us run Clubstance, and only to the extent needed for the feature you use. The current list, with purposes and locations, is on our Sub-processors page. In summary:

  • Supabase — database, authentication, and file storage (our primary data store).
  • Cloudflare — hosting and content delivery.
  • Razorpay — payment processing. Card/UPI details are collected by Razorpay directly; we store payment records, not card numbers.
  • Meta (WhatsApp Cloud API) — when a gym sends WhatsApp messages, member phone numbers and message content are shared with Meta to deliver them.
  • Resend — transactional email delivery.
  • Sentry — error monitoring and sampled session replay (EU-hosted).
  • Google — optional "Sign in with Google".

We may also disclose data where required by law or to protect the rights, safety, or property of Clubstance, our customers, or the public.

5. Where your data lives

Our production database and file storage are hosted on managed cloud infrastructure; some sub-processors (for example Sentry, hosted in the EU, and Meta) process data outside India. The DPDP Act permits cross-border transfers except to countries restricted by the Central Government; we monitor those notifications and will adjust our sub-processors if required.

6. How long we keep it (retention & deletion)

  • Active accounts: we retain account and member data for as long as your subscription is active.
  • After cancellation: your workspace data remains exportable for 12 months, after which it is deleted from production systems unless law requires longer retention (e.g. tax records on invoices).
  • On deletion request: when you delete your account, or a gym instructs us to delete member records, we remove the data from production systems within 30 days and from backups on their rotation cycle (up to 35 additional days).
  • Telemetry: Sentry error events and session replays are retained for 90 days.
  • Biometric templates: stored only on the gym's premises; deletion is performed at the gym's device/bridge and takes effect immediately.

7. Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the right to:

  • Access — a summary of the personal data we process about you and the processing activities.
  • Correction and erasure — have inaccurate data corrected and data that is no longer necessary erased.
  • Grievance redressal — a readily available way to complain, answered within the timelines on our Grievance Redressal page.
  • Nomination — nominate a person to exercise your rights in the event of death or incapacity.
  • Withdraw consent — at any time, as easily as it was given; we then stop the related processing unless another lawful ground applies.

Gym owners can exercise most of these directly in the app (export, correction, account deletion). For anything else, email [email protected]. If you are a gym member, contact your gym first (it is the Data Fiduciary for your records); we will support the request. If you are unsatisfied with our response, you may escalate to our Grievance Officer and thereafter complain to the Data Protection Board of India.

8. Children's data

Clubstance accounts may only be created by adults (18+). Gyms may maintain records of members under 18; under Section 9 of the DPDP Act this requires verifiable consent of a parent or lawful guardian, which is the gym's responsibility to obtain before entering a minor's details. We do not use any child's data for tracking, behavioural monitoring, or advertising.

9. Security & breach notification

We protect personal data with encryption in transit (TLS 1.2+) and at rest, row-level tenant isolation in our database, role-based access controls, and audited, time-bound internal access. Details are on our Security page. In the event of a personal data breach, we will notify affected Data Fiduciaries/users and the Data Protection Board of India as required by the DPDP Act and its rules.

10. Cookies & local storage

Our websites use no advertising or cross-site tracking cookies. We use browser local storage for functional preferences (like your theme) and session tokens, and Sentry for error monitoring. Details are in our Cookie Policy.

11. International users (GDPR note)

Clubstance is built for the Indian market. If we onboard customers in the EU/EEA or UK, the GDPR/UK GDPR will apply to their data: the rights above broadly map to GDPR rights (access, rectification, erasure, restriction, portability, objection), our Data Processing Terms follow an Article 28-compatible structure, and we will put standard contractual clauses in place for transfers where needed. EU/EEA users may lodge complaints with their local supervisory authority.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act:

  • Grievance Officer: [NAME — to be appointed on incorporation] (founding team until then)
  • Email: [email protected]
  • Correspondence address: Hosur, Tamil Nadu 635109, India (remote-first; registered office to be added on incorporation)

See our Grievance Redressal page for timelines and escalation.

13. Changes to this policy

We will post updates on this page and revise the "Last updated" date. For material changes, we will notify gym owners by email or in-app notice before they take effect.

14. Contact

Questions about this policy or your data? Write to [email protected].