Privacy policy

• Gym owners and staff accounts: we decide how this data is used, so we are the data fiduciary.
• Gym members' records (added by a gym, or sent through a gym's QR join form): the gym decides what it collects and why, so the gym is the data fiduciary and we process the data on its behalf. Members should contact their gym first about their data; we will help the gym respond.

• Account details: name, email, mobile number, password (stored only as a one-way hash), role.
• Gym details: gym name, address, city, phone, logo, GST number, UPI ID, opening hours and invoice settings.
• Member records a gym enters: name, mobile number, email, date of birth, emergency contact, membership plan, payments, invoices, attendance and messages from the gym.
• Enquiries a gym records about prospective members.
• Technical data: IP address and timestamps, used to keep accounts secure (for example to block repeated wrong passwords).

We do not collect payment card or bank details. Payments to Kettlehive are made by UPI through your own bank app.

• To run the service: sign-in, memberships, invoices, attendance, messages and the member app.
• To send service emails such as password resets, trial reminders and billing notices.
• To keep the service secure and prevent abuse.
• To meet legal obligations, such as tax records for our own invoices.

We do not sell personal data, show advertising, or use gym or member data to train AI models.

We use one essential cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Only the service providers we need to run Kettlehive, each bound to protect the data:

• Supabase (database hosting)
• Vercel (website hosting)
• Resend (sending emails)

We may disclose data if Indian law or a valid order from a court or authority requires it.

Each gym's data is kept separate. Staff of one gym can never see another gym's members.

We keep a gym's data while its account is open. After an account is closed we delete it within 90 days, except records we must keep by law (such as our own billing records). Gyms can export their members, payments and attendance as CSV at any time from Gym Setup → Account & Data.

Data is encrypted in transit (HTTPS). Passwords are hashed, never stored in plain text. Access inside a gym is limited by role (owner, front desk, trainer, member). No system is perfectly secure; if a breach affects your data we will tell you and the Data Protection Board of India as the law requires.

You can ask to see, correct or delete your personal data, withdraw consent, or name someone to act for you. Gym members should usually ask their gym; gym owners and staff can write to mesaqibsq@gmail.com. We respond within 30 days.

Members under 18 must be added by their gym only with a parent or guardian's consent. Kettlehive does not track or target children with advertising.

We will post any change here and update the date above. For significant changes we will tell gym owners by email. Questions or complaints: see our contact page and grievance officer.