Privacy Policy
Last updated: 11 October 2026
This policy explains how Krivyom ("Krivyom", "we", "us") collects, uses and protects personal data in our products, including GymDesk (mobile and web app), the gym websites and campaign pages we host for our customers, and this website. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
1. Who is responsible
For data about gym owners and staff who use GymDesk, Krivyom decides how it is used. For data about gym members and website enquiries, the gym is responsible (the "data fiduciary") and Krivyomprocesses it on the gym's behalf, only to provide the service the gym uses.
2. What we collect
| Whose data | What | Why |
|---|---|---|
| Gym owners & staff | Mobile number (for OTP sign-in), name, gym name, address, plans, settings | Account, sign-in, running the app |
| Gym members (entered by the gym) | Name, mobile / WhatsApp number, membership plan and dates, attendance check-ins, payments and dues | Membership management, renewal reminders, receipts |
| Website & campaign visitors | Name, mobile number and fitness goal when they submit the enquiry form; anonymous visit counts | Passing the enquiry to the gym; showing the gym how many people visited |
| Devices | Push notification token, basic device and browser information, error logs | Delivering alerts, keeping the app working |
| Payments | Payment status, amount, reference IDs | Recording renewals. Card, UPI and bank details are handled by Razorpay and never reach us. |
We do not sell personal data, and we do not use member data for our own advertising.
3. Services we use
- Google Firebase / Google Cloud — hosting, database, sign-in, notifications (primarily in Mumbai, India).
- Meta WhatsApp Business Platform — sending reminders, receipts and offers the gym has switched on.
- Razorpay — online payments from members to their gym.
- Google Vertex AI (Gemini) — generating banners, website text and captions when an owner asks for it. Prompts contain business content, not member data.
- Google Play — GymDesk subscription billing.
- Google Analytics — anonymous statistics about visits to our websites and gym websites (pages viewed, device type, approximate city). It uses cookies; you can block them in your browser.
Each provider processes data under its own security and privacy terms and only for the purpose above.
4. WhatsApp messages
Gyms choose whether to send automatic WhatsApp messages. Members can stop them at any time by tapping "Stop reminders" or "Stop offers" in the message, or by replying STOP. Promotional offers are sent only to members of that gym and at most once every 30 days.
5. How long we keep data
We keep account and membership data while the gym's account is active. When a gym deletes its account, its data is deleted within 30 days, except records we must keep by law (for example tax and payment records, usually up to 8 years). Enquiry-form spam protection data is kept for a few hours.
6. Security
Data is encrypted in transit (HTTPS) and at rest. Access is restricted by account; each gym can see only its own data. Secret keys are stored in Google Secret Manager, and payment webhooks are verified by signature.
7. Your rights
You can ask to access, correct or delete your personal data, withdraw consent, or nominate someone to act for you. Gym members should contact their gym first; you can also write to us and we will help. See Data deletion. We respond within 30 days.
8. Children
Our products are for businesses. Data about members under 18 should be entered only with a parent's or guardian's consent.
9. Changes
We will post any changes here and update the date above. Significant changes will be notified in the app.
10. Grievance Officer & contact
Krivyom
At - Sukhupara, VTC: Sukhuapara, PO: Kuliana, Sub District: Koliana, District: Mayurbhanj, Odisha - 757030
Email: krivyom@gmail.com
Phone: +91 63711 85514