Privacy Policy

1. What we collect

From gym owners and staff:

• Name, mobile number, email address, gym name and city, and your role in the gym.
• Login codes (we keep only a scrambled copy, and it expires after five minutes).
• The plan you choose and the payments you make to us.
• If you take payments from members: your gym's UPI ID and the name on it. If you use a payment-gateway sub-account instead: your business type, the name and number on your PAN, and your bank account details, which we pass to PayU to verify and settle your money. We keep the account number encrypted.

2. What gyms put into Jimwala

A gym owner or staff member can add details about members and visitors. Depending on how the gym uses the software, this can include:

• A member's name, mobile number, email, gender, date of birth, address and photo.
• Blood group, emergency contact and notes. These can be health-related, so a gym should collect them only with the member's clear consent.
• Membership plans, fee dues, invoices, payments, discounts and attendance (QR check-ins).
• Enquiries from people who ask about joining, including anything typed into the gym website's enquiry form.
• Product sales, expenses and pictures and videos for the gym website.

3. Payments

Payments are handled by PayU. Your card, UPI, net banking or wallet details go to PayU on its own secure page and are never seen or stored by us. We receive the result of the payment (paid or not, the amount, the payment reference and the payer's name and phone number).

Only plans and offer message packs are paid to us. When a member pays their gym, they pay the gym's own UPI ID directly, and the money never passes through us; we take no share of it. The member tells the payment page they paid and the gym confirms it, so it can be marked paid and a receipt sent.

4. What we use it for

• To create your account, sign you in and run the features you use.
• To send WhatsApp messages the gym asks us to send, such as fee reminders, receipts, expiry notices and login codes.
• To take payments, keep accounting records and meet legal and tax duties.
• To keep the service secure, stop misuse and fix problems.
• To answer support requests and to tell you about important changes to the service.

We do not sell personal data. We do not show advertising, and we do not use gym members' details to market our own products.

5. WhatsApp messages

Messages are sent from Jimwala's own WhatsApp number. A message is sent only when a gym owner or staff member uses a feature that sends one (for example a fee reminder, a broadcast, or a login code). Each message uses a WhatsApp credit.

Gyms must have the member's permission to message them. If you do not want these messages, tell your gym, or write to us at info@jimwala.com with the number and we will stop messages to it.

6. Facebook and Instagram (social posts)

A gym owner can connect a Facebook Page and its linked Instagram professional account so Jimwala can publish posts the owner writes, at the time the owner chooses. We use Facebook Login and ask only for what posting needs: to list the Pages the owner manages, to read basic Page and Instagram account details, and to publish posts and pictures to those accounts.

We keep the Page and Instagram account names and ids, an access token (stored encrypted, and never shown to anyone), and the posts, captions and pictures the owner makes with their publishing results. We use them only to publish what the owner asks us to publish. We do not read private messages, comments or followers, we do not post anything the owner did not write or approve, and we do not sell or share this data.

The owner can disconnect an account at any time in Social posts. Disconnecting deletes the stored token. You can also remove Jimwala from your Facebook settings under Business Integrations, and we then lose access at once.

7. Who we share data with

We share data only with the companies that help us run the service, and only what they need:

• PayU: to take payments for your Jimwala plan, and to settle online payments for gyms that use a gateway sub-account.
• Cloudflare: to store and serve the pictures and videos gyms upload for their websites.
• Fly.io and Neon: hosting, and our database and message queue.
• Meta (Facebook and Instagram): only the posts and pictures an owner chooses to publish, sent to the accounts the owner connected.
• Google and Anthropic: when an owner uses the AI writing and picture features, the words they typed (and a photo they chose to add to a poster) are sent to write or draw the result. They are not used to market to anyone.
• The authorities, if a court or the law requires it, or to protect people from harm or fraud.
• A company that takes over Jimwala, if the business is ever sold. We would tell you first.

8. Where your data is stored

Our servers and database are in Singapore, so your data is stored and processed outside India. We choose providers that protect data with security controls, and we transfer data only as the Digital Personal Data Protection Act allows.

9. Cookies

We use two small cookies, both to keep you signed in:

• gs_session keeps you signed in on the dashboard. It is essential and is used only on the dashboard address.
• gs_in is a plain flag that tells the home page you are signed in, so we can take you to your dashboard. It holds no personal data.

On our website and the owner dashboard (never on a gym’s own public website or a member’s page) we also use Google Analytics to count visits and see which pages lead to sign-ups. It sets its own cookies, with IP addresses anonymised and advertising features off. We do not send member names, phone numbers or payment details to it. You can block it with your browser’s privacy settings or an extension without losing any feature.

10. How long we keep data

We keep data while your account is active. If you close your account, we delete or anonymise your data, usually within 90 days. We keep invoices, payment records and other accounting records for as long as Indian tax and accounting laws require.

11. How we protect it

• Everything travels over HTTPS.
• Each gym's data is kept apart at the database level, so one gym cannot see another's.
• Sign-in needs a code sent to your WhatsApp number, and staff see only what their role allows.
• We limit who at Jimwala can reach data and we log important actions.

No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.

12. Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or stop using it for a purpose you agreed to. You can also withdraw your consent at any time, and nominate someone to exercise these rights for you.

If you are a gym member, please contact your gym first, because the gym holds your membership record. If you cannot reach the gym, write to us and we will help. We aim to reply within 30 days.

13. Delete your data

To delete your account and data, email info@jimwala.com from the email address or write from the mobile number you registered with, with the subject "Delete my data". To remove only your Facebook or Instagram connection, open Social posts in the app and disconnect the account, or remove Jimwala from your Facebook settings under Business Integrations; either one deletes our stored token. If you tell us a Facebook user's data should be deleted, we delete the tokens, accounts and posts stored for them. We will confirm before we delete, because deleting cannot be undone. Deleting your account does not give you a refund (see our Refund and Cancellation Policy).

14. Children

Jimwala is for gym owners and staff aged 18 and over. Gyms that add members under 18 must get a parent's or guardian's consent first, as the law requires.

15. Grievance Officer

For a complaint about how your data is handled:

• Grievance Officer: Himanshu Thakur
• Email: info@jimwala.com
• Phone: +91 75000 73815
• Address: Vill/Post Pipalshah, Charthawal, Distt. Muzaffarnagar, Uttar Pradesh 247772, India
• Udyam registration: UDYAM-UP-58-0105138

16. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell account owners. Using Jimwala after that means you accept the change.