Privacy Policy

1. Who this policy covers

GYMORA ("we", "us") makes gym management software, with its office at Pak Arab Housing Society, Lahore, Pakistan. This policy covers three groups of people:

• Gym owners and staff who use GYMORA. We are responsible for your account details.
• Members of a gym that uses GYMORA. Your gym decides what it records about you and is responsible for it. We keep and process it for your gym, following its instructions and this policy.
• Visitors to this website, gymora.live.

2. What we collect

Gym owners and staff

• Name, email address (used to sign in), photo if you add one, and your role at the gym.
• Your password, stored only as a scrambled code that cannot be turned back into the password.
• Pay and payroll records, if your gym uses GYMORA for payroll.
• A door card number or fingerprint, if your gym uses them for staff entry.
• Sign-in records: the device you used (such as "Chrome on Windows" or your phone's model), when, and the internet (IP) address for important actions and failed sign-ins.

Members (entered by the gym)

• Name, phone number, email, date of birth, gender, CNIC, address and photo. The gym chooses which of these to fill in.
• Membership details: plan, start and end dates, freezes and notes.
• Payments, receipts and what you still owe. We never store card numbers or bank logins.
• Check-ins, and the details the gym's door device uses to let you in: your number on the device, a card number or a PIN.
• Fingerprints, only if your gym uses fingerprint entry with certain door devices. We keep the fingerprint template, a code the device makes from your fingerprint, so your gym can add you to its doors. It is not a picture of your fingerprint. We delete it when you leave the gym's records.
• Payment screenshots you upload in the member portal. These can show your bank name, account title and balance, so feel free to crop anything the gym does not need to see.
• Messages the gym sends you, and your replies on WhatsApp.

Trainers: name, photo, date of birth, gender, CNIC, phone, address, speciality and pay.

We do not collect health, fitness or body measurements. Some door devices can take face photos; we do not keep them.

Website visitors: see Cookies.

3. How we use it

• To run GYMORA for the gym: memberships, payments, attendance, receipts and reports.
• To keep accounts safe: sign-in codes, spotting break-in attempts, and the gym's activity log.
• To send the messages the gym sets up (see the next section).
• To bill the gym for its GYMORA plan and send it plan reminders.
• To give support, and to find and fix faults.

We do not sell personal data, show adverts, build marketing profiles, or use your data to train AI.

4. Messages to members

GYMORA sends messages to members by email, and on the Pro plan by WhatsApp. For a new gym these are switched on: a welcome message, reminders before and after a membership ends, payment receipts, a birthday greeting, and a "we miss you" message after 14 days without a visit. The gym can switch each one off. Staff can also send messages themselves, such as a payment reminder or a notice that the gym is closed.

Offers on WhatsApp are only sent if the gym turns them on. To stop them, tap Stop promotions or reply STOP. Reminders and receipts still arrive, because they are about your membership. To stop offer emails, ask your gym, or email us and we will stop them.

5. Who helps us run GYMORA

These companies help us run GYMORA. Each one receives only what it needs for its job, and may not use it for anything else:

The gym's own door devices (ZKTeco) send check-ins to GYMORA. Some of these companies store or process data outside Pakistan. We choose providers who protect it, and they are bound to use it only for us.

We share data with others only if the law requires it, for example a court order, and only what is required. If GYMORA is ever sold or merged, this policy would continue to protect your data, and we would tell gyms first.

6. How long we keep it

A gym's data stays for as long as the gym uses GYMORA. If its plan ends, the data is kept so the gym can come back. It is deleted when the gym asks us to delete it. Some records are cleared sooner:

When a gym asks us to delete its data, we remove it from GYMORA within 30 days. It is erased from backups as they expire, within 6 months.

7. How we protect it

• Everything travels encrypted (HTTPS), and browsers are told never to connect without it.
• Passwords are stored with Argon2, a strong one-way scrambling method.
• Signing in on a new device needs a code sent by email. Repeated wrong passwords are blocked for an hour, and passwords found in known data leaks are refused.
• Each person can be signed in on one browser and one phone at a time.
• Every request is checked against the gym and branch it belongs to, so one gym can never see another gym's data.
• Backups are made every 6 hours, and the copies kept away from our servers are encrypted.

No system is perfectly secure. If we find that someone has got into personal data, we will tell the affected gyms without delay, and within 72 hours of confirming it, with what happened and what we are doing about it.

8. Your choices and rights

You can ask to see the data held about you, correct it, get a copy, or have it deleted. You can also ask us to stop sending you offers.

• Members: please ask your gym first, as it controls your record. You can see your own details any time in your gym's member portal. If your gym does not help, email us and we will work with them.
• Gym owners and staff: change your email and phone, or delete your account, yourself in My account. How to delete your account. You can also email us.

We reply within 30 days at the latest, usually much sooner. We may ask you to confirm who you are first. A gym may keep payment records it must keep by law even after a deletion request.

9. Children

GYMORA is made for adults. It is not meant for anyone under 18, and gyms agree to get a parent's or guardian's permission before adding anyone younger.

10. Cookies

In the GYMORA web app and member portal, we use only the cookies needed to make it work. There are no advertising or tracking cookies.

On this website, Vercel Web Analytics and Speed Insights count visits without cookies and without identifying you. We also use Google Analytics, which sets cookies (named _ga) to count visits and see which pages and buttons are used, such as the button that opens WhatsApp. It gets the page, the button, and general device and location details, never your name, number or messages. You can block these cookies in your browser settings, or use Google's opt-out add-on.

11. Changes to this policy

If we change this policy, we will update this page and its date. For important changes, such as a new kind of data or a new company that helps us, we will email gym owners before the change applies.

12. Contact us

Questions or requests about your data: email support@gymora.live, WhatsApp +92 370 9062024, or write to us at Pak Arab Housing Society, Lahore, Pakistan.