Privacy Policy

RepDesk is software that gyms use to run their business. That means we hold personal data about two very different groups of people: the gym owners who sign in, and the gym members whose records their gym keeps here. Our responsibilities are different for each, and this policy explains both — in detail, and without rounding anything off.

1. Who we are

RepDesk is operated by REPDESK, a sole proprietorship registered in India, proprietor Khursheed Alam, with its registered place of business at C-189, Abrar Nagar, Madina Masjid Road, Kalyanpur, Sadar, Lucknow, Uttar Pradesh 226022, India. Udyam registration UDYAM-UP-50-0309577. Our turnover is below the threshold at which GST registration is required, so we are not registered for GST and charge none.

In this policy, “RepDesk”, “we” and “us” mean that business. “You” means whoever is reading — most often a gym owner, sometimes a sales partner, sometimes a visitor to this website, and sometimes a member of a gym that uses RepDesk.

You can reach us at hi@repdesk.co.in for anything, or at privacy@repdesk.co.in for questions about this policy and your rights.

2. The short version

This section is a summary for orientation. It is not a substitute for the rest of the policy, and where the two differ, the detailed sections govern.

• We collect what a gym needs to run: who you are, what your gym is, and what your members pay. Nothing beyond that.
• We store no dates of birth, no photographs, no biometrics, no health or medical information, no emergency contacts and no government identity numbers. There are no columns for them.
• We never see or touch the money that passes between a gym and its members. We only record that a payment happened.
• For your gym's member data, your gym decides and we execute. If a member asks us to erase their record, we send them to their gym, because it is not ours to erase.
• Your gym's production database sits in Mumbai. Some of the services we rely on — sign-in, email, WhatsApp, analytics, hosting — are outside India, and section 9 lists every one of them.
• We sell nothing to anyone. There is no advertising in RepDesk and no advertising network receives your data.

3. The law this policy follows

India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, are the law this policy is written to. Most of the substantive obligations under them commence on 13 May 2027.

We have not waited for that date. This policy is written to the standard that applies from 13 May 2027, and we intend to meet it now. In the meantime, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply to us, and we comply with those too.

4. Our two roles, and why the difference matters

The DPDP Act distinguishes a Data Fiduciary, who decides why and how personal data is processed, from a Data Processor, who processes it only on a Data Fiduciary's instructions under a contract. RepDesk is one in some situations and the other in others.

If you are a member of a gym that uses RepDesk, your gym — not RepDesk — is the Data Fiduciary for your information. Your gym decided to collect it, decided what to record, and decides when it goes. We hold it for them and act on their instructions. Section 13 explains how to exercise your rights.

5. What personal data we collect

The DPDP Rules require this to be itemised rather than summarised, so the lists below name the actual fields rather than categories like “contact information”.

5.1 If you are a gym owner

When you sign in with Google and set up your gym, we record: your email address, first name, last name, full name, profile picture URL and mobile number; and about your gym, its name, street address, city, state, postal code, phone number, WhatsApp number and time zone. If a partner introduced you, we also record the invitation code you used.

5.2 If you are a sales partner

We record your name, email address, mobile number, profile picture URL and UPI ID, together with the gyms attributed to you, the invitations you have issued, and the commission earned on each first purchase.

5.3 Gym member records, which we hold for the gym

A gym using RepDesk may record the following about its members. We process all of it on the gym's instructions and for no purpose of our own.

• Identity and contact: full name, mobile number (required), email address and postal address (both optional).
• Membership: package name, start and expiry dates, total fee, amount paid, outstanding balance, subscription status, freeze periods, and renewal history.
• Personal training: whether the member is enrolled, the assigned trainer, the training type, the plan name, the fee, and sessions completed out of sessions booked.
• Attendance: the date, the status, the check-in time, any note, and who marked it.
• Payments: the amount, the date, how the member paid the gym (cash, UPI, card, bank transfer or other), and any note. See section 17 — we record these, we do not process them.
• Cancellations and refunds: the amount, the method, the percentage, the stated reason and any notes.
• WhatsApp messages: the recipient's name and phone number, the message text, and when it was sent, delivered, read or failed. See section 15.

5.4 If you are visiting this website or using the app

• Your IP address and browser user agent, received through Cloudflare, which sits in front of our servers, and written to our request logs.
• One cookie, repdesk_consent, recording the answer you gave to the cookie banner. Described in the Cookie Policy.
• Product analytics, but only if you accept analytics cookies. Covered in section 14.

5.5 What we do not collect

We think it is as useful to tell you what is absent as what is present. RepDesk has no field anywhere for any of the following, and so cannot hold them:

• Dates of birth, ages or gender.
• Photographs of members, or any image of a member.
• Biometric data of any kind — no fingerprints, no face recognition, no iris scans.
• Health, medical, fitness-measurement, injury or allergy information.
• Emergency contacts or next-of-kin details.
• Government identity numbers — no Aadhaar, PAN, passport or driving licence.
• Card numbers, CVVs, bank account numbers or any other payment instrument details. The sole exception is a sales partner's own UPI ID, which they enter so that we can pay them.

Because RepDesk holds no date of birth, we have no way of knowing whether any given gym member is an adult or a child. That matters, and section 16 explains how it is handled.

6. Why we process it

7. Consent, and taking it back

Where we rely on your consent, you gave it by a clear affirmative action — ticking a box, choosing “Accept” on the cookie banner, or completing signup after being shown what we collect. We never treat silence, a pre-ticked box, or your continued use of the site as consent.

You can withdraw consent at any time, and withdrawing must be as easy as giving it was. For analytics, use “Cookie settings” in the footer of this site or in Settings inside the app — one click, no email required. For anything else, write to privacy@repdesk.co.in.

Withdrawing consent does not undo processing that already happened lawfully, and it does not affect data we are required by law to keep. Once you withdraw, we stop the processing that relied on that consent within a reasonable time, and we direct our processors to stop as well.

8. Who else sees it

We do not sell personal data. We do not share it for anyone else's advertising. We do not hand it to data brokers. The only third parties who touch it are the service providers we need to run RepDesk, each of whom processes it on our instructions and under contract.

The full list — who they are, what they do, what they receive and where they are — is on the Sub-processors page, which we keep current. In summary, they handle sign-in, our database, transactional email, WhatsApp delivery, analytics, hosting and network protection.

We may also disclose personal data where the law requires it — to a court, a regulator, or a government agency acting under lawful authority. Where we are permitted to tell you about such a request, we will.

If the business is ever sold or reorganised, personal data may transfer with it. You would be told before that happened, and the new operator would be bound by a policy no weaker than this one.

9. Where it is stored

The DPDP Act permits personal data to be transferred outside India, subject to any restrictions the Central Government may notify for particular countries. No localisation requirement currently applies to RepDesk.

Your gym's operational records — the data that actually matters — never leave India in the ordinary course. What crosses a border is the narrower set each service needs: an email address to sign you in, an email address to deliver a receipt, a phone number to deliver a WhatsApp message.

10. How long we keep it

We keep personal data for as long as it is needed for the purpose it was collected for, and then we remove it — subject to one floor set by law. The DPDP Rules require every Data Fiduciary to retain personal data, traffic data and logs for at least one year from processing. We cannot delete below that line, and neither can anyone else.

The three-year inactivity erasure rule in the DPDP Rules applies only to very large e-commerce, online gaming and social media platforms. RepDesk is none of those, so it does not apply to us.

What happens when you delete your account

You can delete your account from Settings. When you do, we delete your gym's workspace and everything cascading from it — members, payments, attendance, finances, inventory, equipment — and we delete your user record and your sign-in identity. That is a real deletion, not a hidden flag; there is no “deleted” column anywhere in RepDesk that quietly keeps a row alive.

Two things deliberately survive, and we would rather tell you than let you discover it:

• Our sales ledger. The record that a purchase happened is kept for our accounts and for tax, but it is stripped of you: your name is replaced with “Deleted customer” and your email address is removed.
• One closure record in our audit log. When a workspace is deleted we write a single entry noting that it closed, which includes the owner's name, email, phone, city and state. We keep it to understand why gyms leave. It is covered by the one-year retention floor above, and you can ask us about it at privacy@repdesk.co.in.

Deleting an individual member removes that member's record in full, and also scrubs their name and phone number from any WhatsApp message we had sent on the gym's behalf. If any part of that fails, we do not delete the member at all, so a partial erasure cannot occur. One thing is kept on purpose: if a member has told us to stop messaging them, we keep their number on the do-not-message list, because forgetting that would mean messaging them again.

WhatsApp message content is cleared automatically on a rolling 90-day window. Delivery status is retained.

11. How we protect it

We apply the safeguards the DPDP Rules require: encryption in transit, access control on every system holding personal data, logging and monitoring of access, backups to preserve availability and integrity, and retention of logs for a year so an incident can be reconstructed.

Every workspace is isolated from every other at the database level. Our API is not exposed to the open internet; it is reachable only through an outbound tunnel, with Cloudflare in front of it. Secrets, tokens and passwords are stripped from our logs automatically before they are written.

Two things you should know

• Email addresses appear in our server logs. We automatically redact passwords, tokens, API keys and phone numbers before any log line is written, but we deliberately leave email addresses readable, because our support team needs them to trace an account when something breaks. Those logs are access-controlled and retained for a year.
• Member records are cached on the devices you sign in from. RepDesk works offline, and to do that it stores a copy of your member list — names, phone numbers, email addresses and addresses — in the browser's local storage on every device you use, including a shared front-desk computer. Signing out and deleting the account clears it. If you use RepDesk on a machine other people can reach, this is the thing to think about.

If a personal data breach occurs, we will tell every affected person without delay, describing what happened, its likely consequences and what we are doing about it, and we will report it to the Data Protection Board of India within 72 hours. Where RepDesk is the processor and a gym is the Data Fiduciary, we notify the gym without delay so that it can meet its own obligations.

12. Your rights

Under the DPDP Act you have the right to:

• Obtain a summary of the personal data we hold about you and how we are processing it.
• Have inaccurate or incomplete data corrected, completed or updated.
• Have your personal data erased, where we are not required to keep it.
• Nominate one or more people to exercise these rights for you if you die or become unable to act.
• Have your grievance heard by us, and escalate to the Data Protection Board of India if our answer does not satisfy you.

How to make a request

Write to privacy@repdesk.co.in from the email address registered on your account, and tell us what you want. That registered address is the only identifier we ask for. We will not ask you to send a copy of a government ID, a selfie or a utility bill — collecting those would create a pile of sensitive documents we have no business holding.

If you cannot write from your registered address, say so and we will verify you another way, such as a one-time code to the mobile number on your account.

We respond within 30 days. The law permits up to ninety; we publish thirty because it is what we can actually meet. If a request is complex enough to need longer, we will tell you before the thirty days are up, and why.

Exercising these rights costs nothing. We will not restrict your account or charge you for asking.

13. If you are a member of a gym that uses RepDesk

Your gym holds your information and decides what happens to it. We hold it for them. So if you want to see your record, correct it, or have it deleted, ask your gym. They can do all three themselves, immediately, from inside RepDesk.

If you write to us instead, we will not quietly act on it — changing or deleting a gym's records without the gym's instruction is not ours to do, and it could destroy a business record they are required to keep. What we will do is tell you so, promptly, and point you to your gym.

If your gym will not respond, you have a remedy: your gym is the Data Fiduciary, and you may complain about them to the Data Protection Board of India. If we can properly help — for example by confirming that a gym uses RepDesk — we will. And if your complaint is about something we did rather than something your gym did, write to privacy@repdesk.co.in and we will deal with it ourselves.

Separately, you can always stop WhatsApp messages from reaching you by replying STOP. That works immediately and does not need your gym's involvement.

14. Analytics and cookies

We use Mixpanel to understand how RepDesk is used — which pages people visit, which buttons they press, how long things take. It loads only after you accept analytics cookies. Before you answer the banner, no analytics request leaves your browser at all.

What we send is deliberately narrow: counts, enumerated values, booleans and an opaque identifier. We never send names, phone numbers, email addresses, amounts, notes, plan names or invitation codes. Analytics data is held in the European Union. There is no session recording and no automatic capture of everything you click.

We honour Global Privacy Control, and we never track or prompt automated browsers. Deleting your account also deletes your analytics profile.

Full detail is in the Cookie Policy.

15. WhatsApp messages

RepDesk can send reminders, receipts and announcements to a gym's members over WhatsApp. One thing about this is worth being clear on: those messages go out from RepDesk's own WhatsApp Business number, not the gym's. Gyms do not connect their own number. This means a member's phone number and the message content reach Meta, which operates WhatsApp, under our account with them.

A gym decides who is messaged and what is said, and warrants to us that it has each member's permission to message them. Any member can reply STOP at any time, which adds their number to a do-not-message list that applies across all of RepDesk, not just the gym that sent it. Messages are also subject to quiet hours and a daily cap.

16. Children

Under the DPDP Act, anyone under eighteen is a child. A Data Fiduciary must obtain verifiable consent from a parent or legal guardian before processing a child's personal data, and must not track them, monitor their behaviour or direct advertising at them.

RepDesk is sold to gym businesses, not to individuals, and you must be eighteen to hold an account with us. We do not knowingly process any child's personal data for our own purposes.

Where a gym records a member under eighteen, the gym is the Data Fiduciary and the obligation to obtain verifiable parental consent is the gym's. Our terms require gyms to have obtained it. Because RepDesk holds no date of birth, we have no way of identifying which members are minors — only the gym knows that.

We do not profile members, monitor their behaviour, or direct advertising at anyone, child or adult. There is no advertising in RepDesk.

17. Money

RepDesk is not a payment processor, a payment aggregator or a money transmitter. When a member pays a gym, that payment happens in the real world — cash across a counter, a UPI transfer, a card machine — and RepDesk records that it happened. Choosing “UPI” in RepDesk initiates nothing; it is a label on a bookkeeping entry.

We never hold, route or settle money between a gym and its members, and we store no card numbers, bank account numbers or payment credentials.

18. Our own access to your data

We would rather state this plainly than leave you to assume. We operate an internal admin tool, and it runs with database credentials that can technically reach anything in the production database. It runs only on the operator's own machine, is not reachable from the internet, is protected by a token, and every change it makes is written to an append-only audit log.

What that tool is actually built to read is narrow: gyms and their owners, how a gym found us, what it purchased, and what commission a partner earned. It has no screen and no route that reads member records, member payments, attendance or a gym's finances.

Beyond that, we access a gym's data only when you ask us to — for support, or an import you have requested — or where we must to investigate a security incident or comply with the law.

19. Anonymised and aggregated information

We may irreversibly anonymise and aggregate data held in RepDesk, and use the result to improve the product, to produce industry benchmarks, and to develop and train models that power features inside RepDesk.

Anonymised means anonymised. Once data has been through that process it can no longer be linked back to a gym or a person, and at that point it is no longer personal data at all. We bind ourselves to the following, and these limits also appear in our contract with every gym:

• We will not attempt to re-identify anonymised data, and we will not permit anyone else to.
• No output will single out an individual gym or an individual person. Nothing is published or shown unless it is drawn from at least 20 gyms.
• Your gym's raw member records are never used this way, and are never shared with another gym.
• We do not sell this information, anonymised or otherwise.

20. Changes to this policy

When we change this policy we update the version and date at the top. If a change materially affects your rights or what we do with your data, we will tell you — by email to the address on your account, or a notice inside RepDesk — before it takes effect, and we will ask you to accept it again where the law requires that.

Earlier versions are available on request.

21. Complaints and the Grievance Officer

If something here concerns you, raise it with us first — we would rather fix it than have you escalate.

Grievance Officer: Khursheed Alam, Proprietor Email: privacy@repdesk.co.in Address: C-189, Abrar Nagar, Madina Masjid Road, Kalyanpur, Sadar, Lucknow, Uttar Pradesh 226022, India

We acknowledge every grievance on receipt and answer within 30 days.

If our answer does not satisfy you, you may complain to the Data Protection Board of India. You do not need our permission, and you do not have to come to us first — but we would appreciate the chance.