Privacy policy

1. Introduction

StudioFly ("we", "our", "us") is a brand of MyGymDesk Technologies Private Limited (CIN: U62013TS2026PTC213750), which owns and operates it. We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use StudioFly, our cloud-based studio management software ("Service").

This policy applies to our website, studiofly.fit, our mobile applications — StudioFly Business and StudioFly Member (available on the Apple App Store and Google Play Store) — and all related services.

This Privacy Policy is published in compliance with the Information Technology Act, 2000 and the rules thereunder, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025, and — for individuals in the European Union, European Economic Area, and United Kingdom — the EU/UK General Data Protection Regulation ("GDPR").

Where you provide consent as a lawful basis, that consent is given freely, is specific to the purposes described below, and can be withdrawn at any time (see Section 7). For many processing activities, however, we rely on lawful bases other than consent, as set out in Section 4A.

2. Our Role: Data Fiduciary / Controller and Data Processor

StudioFly serves two distinct roles, using the terminology of both the DPDP Act and the GDPR:

Data Fiduciary (DPDP) / Controller (GDPR): For data we collect directly from studio owners and their staff (account information, billing details, usage data). We determine the purpose and means of processing this data.

Data Processor (DPDP and GDPR): For member data that studio owners upload to and manage through our platform (member names, phone numbers, attendance records, payment records, health/fitness data). We process this data strictly on behalf of and on the documented instructions of the studio owner (who is the Data Fiduciary / Controller for their members' data) and only to provide the Service.

If you are a member whose data is managed by a studio using StudioFly, please contact your studio directly regarding your data rights. The studio is responsible for establishing a lawful basis (including obtaining consent where required) and for responding to your data requests. We will assist and cooperate with the studio to fulfil any such requests, as set out in our Data Processing Agreement.

3. Information We Collect

a) Information You Provide (Studio Owners & Staff)

• Account registration information: full name, email address, phone number
• Studio business information: studio name, address, city
• Payment and billing information (processed by our payment partners — we do not store full card numbers)
• Communications with us via email, WhatsApp, or in-app chat
• Business address and tax identifier (e.g. GSTIN for Indian customers) collected for invoicing

b) Member Data (Uploaded by Studio Owners)

• Member names, phone numbers, email addresses
• Membership plan and subscription details
• Attendance and check-in records
• Payment and billing records
• Body measurements and fitness progress data (weight, BMI, chest, waist, hips, bicep measurements) — this may constitute health-related data / a special category of data under the GDPR
• Biometric identifiers where a studio uses biometric attendance devices (e.g. fingerprint templates), processed on the studio's instructions
• Any other information the studio owner chooses to record about their members

c) Information Collected Automatically

• Device and browser information (type, version, operating system)
• IP address
• Usage data: pages visited, features used, time spent, actions performed
• Cookies and similar technologies (see Section 9)
• Error logs and performance data (collected via Sentry for debugging and Service improvement)
• Camera and photo library access (only when you choose to upload photos such as member photos or profile pictures)
• Push notification device tokens (if you opt in to push notifications)
• If you connect an AI assistant to your account (Section 5B): a record of each request it makes — which tool it used, the details it was given, the outcome and the time

d) Information Collected by App Stores

When you download our apps from the Apple App Store or Google Play Store, those platforms may collect data as described in their respective privacy policies. We do not control and are not responsible for data collected by Apple or Google during app download or installation.

4. How We Use Your Information

We use your information for the following specific, limited purposes:

• Service Delivery: To provide, operate, and maintain the Service, including processing member data, generating reports, and enabling communication features.
• Payment Processing: To process subscription payments, including recurring charges on a saved payment method where you have authorized them, and to generate invoices and receipts.
• Communication: To send transactional messages (billing, account updates), onboarding guidance, and product announcements via email and WhatsApp.
• Push Notifications: To send membership reminders, class booking confirmations, payment receipts, and studio announcements (only if you opt in to push notifications on your device).
• Support: To respond to your requests, troubleshoot issues, and provide customer support.
• AI connector: If you connect an AI assistant such as ChatGPT or Claude to your account, to answer the questions you ask it about your studio and to make the changes you confirm (Section 5B).
• Improvement: To analyse usage patterns and improve the Service (using aggregated, anonymized data where possible).
• Security & Fraud Prevention: To detect, prevent, and address security issues, fraud, and abuse.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do NOT use your data or your members' data for automated decision-making that produces legal or similarly significant effects, and we do NOT use it for targeted advertising. Some Service features do use AI to analyse studio and member activity in order to generate coaching content, business insights and drafted messages — see Section 5A (AI Features). If you connect your own AI assistant, the information it asks for is sent to the provider you chose — see Section 5B. We do NOT sell, rent, or trade your personal data to any third party.

4A. Lawful Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following lawful bases (Art. 6) for processing personal data of studio owners and staff:

For member data, the studio (as Controller) is responsible for establishing the lawful basis; we process such data only as Processor on the studio's instructions.

5. Data Sharing & Third-Party Processors / Sub-Processors

We share your data with the following categories of third-party service providers (sub-processors), strictly to provide the Service. Separately, if you connect an AI assistant to your account, we send the information it asks for to the AI provider you chose, on your instruction; that provider is not our sub-processor (Section 5B).

A current list of sub-processors is available on request. We will give you advance notice of any new sub-processor and a reasonable opportunity to object before that sub-processor begins processing your personal data.

We may also disclose your information: (a) when required by law, court order, or government authority; (b) to protect our rights, property, or safety; (c) in connection with a merger, acquisition, or sale of assets (with prior notice to you).

5A. AI Features

Some parts of the Service use artificial intelligence. Where one of the AI features in this section is used, the information needed to answer that particular request is sent to one of our AI sub-processors — Google LLC (Gemini API) or OpenAI, L.L.C., both in the United States — and the generated result is returned to you. The features below are listed with the provider each uses today. We may move a feature between these two providers; if we add a new AI provider, we will give notice as described in Section 5.

Features that use Google (Gemini):

• Business insights (studio owners/staff): aggregated studio figures such as revenue, attendance, renewal and class numbers, together with the studio's name, city and plan names. No member names or contact details are sent.
• Support assistant: the text of your support request, any screenshots you attach to it, and relevant diagnostic results. When you ask about a particular member, the diagnostics can include that member's name, phone number, status, memberships, freezes, bookings, bills and payments. When you ask about a staff member, they can include that person's name, email address, role, branch and when they last signed in. When the question is about how your business is set up, they can include your branches, your GST registration and GSTIN, whether online payments and WhatsApp are set up and how many WhatsApp messages have been used this month, your biometric devices, and the email address of a connected Zoom account. They never include staff pay, bank or ID details, or payment-gateway secret keys or WhatsApp access tokens. Our support team also uses it to help word replies to your support requests, and resolved requests are summarised into help articles.
• Drafted marketing email: your campaign brief, brand tone, studio name and the names of your saved audience segments. No member data.

Features that use OpenAI:

• Business assistant chat (studio owners/staff): the studio's figures, together with the names and phone numbers of members whose memberships are expiring or inactive, members on a freeze, members with dues (owners only) and recent payments by member; and, when your question asks for them, attendance, leads, staff, personal training sessions and the members you name.
• WhatsApp assistant: the messages exchanged in that WhatsApp conversation and the studio's own information, plans and offers. If the person writing is a member we recognise, also their name, membership status and end date, recent check-ins and upcoming bookings.
• AI-drafted workout and diet plans: the member's age, gender, current weight (if recorded), how often they visit, training goal, experience, days per week, the limitations and allergies a trainer has noted, available equipment, dietary preference, calorie target and foods to avoid. The member's name, health questionnaire answers and recorded medical conditions are not sent. A trainer reviews and can edit every drafted plan, and the member sees it only after a trainer assigns it.
• AI coach (member app, where a studio offers it): the member's name, age, gender, body measurements, attendance, membership, bookings, payment history and their chat with the coach.
• Help article search: the text of your support question, and our help articles, are converted into search data so that the support assistant can find the most relevant articles.

Google and OpenAI process this content to return a response. Neither uses data submitted through its paid API to train its models. These commitments cover the features in this section, which we run through our own accounts with Google and OpenAI; they do not cover an AI assistant you connect yourself (Section 5B). AI output can be wrong: it is a draft for a human to review, never an automated decision about a person.

Members under 18. The AI features that talk to an individual member — the AI coach and the WhatsApp assistant — are switched off for members we know to be under 18, and a person handles those conversations instead. This check relies on the date of birth held for that member: where no date of birth has been recorded, the member is treated as an adult. AI-drafted workout and diet plans are created by a trainer for any member and are always reviewed by a trainer before the member sees them. Studios that enrol children should record dates of birth so the check can apply, and remain responsible for obtaining verifiable parental consent before adding a child's data to the Service.

5B. AI Connector: Connecting Your Own AI Assistant

Studio owners, and staff to whom a studio has given a StudioFly login, can connect an AI assistant to their own login — currently ChatGPT, provided by OpenAI, L.L.C., and Claude, provided by Anthropic, PBC. Each person connects from the AI assistant and approves the connection on a StudioFly consent screen. The connector works only where the studio's plan includes it.

What is shared. When you ask the assistant about your studio, or ask it to make a change, it asks StudioFly for the information it needs and we send our answer to that provider. Depending on the question, that answer can include personal data of your members, leads and staff — for example names and member codes, memberships and their end dates, dues and payments, one member's payment history, attendance, class and personal training bookings, leads and follow-ups, and which staff are on shift — as well as studio figures such as revenue and collections, and expenses as totals per category (never single expenses or who was paid). It can include members under 18, in the same way the app shows them to you. The assistant receives only what a question needs, one answer at a time: it cannot list or export all of your members.

Only what your role can already see. The connector uses your own login. It returns only what your role and branches already let you see in StudioFly, and it can make only the changes your role already allows: book a member into a class, schedule classes, cancel a class session, log a response to a follow-up, add a lead, check a member in, extend a membership, freeze a membership (only when the freeze carries no fee), send a member a payment reminder, and submit a WhatsApp template for approval. Before any change it shows you a preview of exactly what will change, and nothing changes until you confirm it. Each change is made, and recorded, as you — just as if you had made it in the app.

What is never shared. An individual's pay or salary, bank and identity-document details, passwords, and payment-gateway or WhatsApp credentials are never sent through the connector. Staff costs appear only as an expense category's total.

What happens to the data after it is sent. The connector sends information to the AI provider you chose, on your instruction. That provider is not a sub-processor of StudioFly: its handling of the information is governed by its own terms and privacy policy, and by the settings of the account you connect — for example, how long it keeps your conversations and whether it may use them to improve its models. We do not control the provider's processing. For your members' data, the studio, as Data Fiduciary / Controller, decides whether to use the connector and is responsible for having a lawful basis to share that data with the provider, as with any other integration a studio connects (Data Processing Agreement, Annex A-1). The providers process data in the United States (Section 11).

What we keep. We keep a record of each request the assistant makes through the connector — which login made it, which tool was used, the details it was given, the outcome and the time — for security, for support and to show who made each change. These records are kept with your account's records (Section 12).

Disconnecting. You can disconnect at any time from Connected AI apps in your StudioFly account, or in the AI assistant's own settings. Once disconnected, the assistant can no longer reach your studio's data. A connection also stops working when the person's access to the studio ends (for example, when a staff member is removed) or when the studio's plan no longer includes the connector. Information already sent to the provider before you disconnect remains subject to the provider's terms.

6. Data Storage & Security

• Your data is stored on Supabase's cloud infrastructure (primary region: Mumbai, India). We select hosting regions that provide reliable performance for our users.
• We use TLS 1.2+ encryption for all data in transit and encryption at rest.
• Sensitive credentials (such as payment gateway keys) are stored in encrypted form. We do not store full payment card numbers; these are tokenized by our payment partners.
• We implement Row-Level Security (RLS) policies in our database to ensure complete data isolation between tenants — no studio can access another studio's data.
• We use role-based access controls and Supabase Auth for authentication.
• We conduct periodic security reviews of our application and infrastructure.

Despite our best efforts, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we take commercially reasonable measures to protect your data.

7. Your Rights

a) Rights under the DPDP Act, 2023 (Data Principal Rights)

• Right to Access: Request a summary of the personal data we process and the related processing activities.
• Right to Correction: Request correction of inaccurate or incomplete personal data. You can also update most information directly in your account settings.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements. Each route is set out step by step on our account deletion page. If you run a studio on StudioFly, we are the controller: as the account owner, request deletion in the StudioFly Business app under Settings → Account Settings, or by emailing support@studiofly.fit. We review each request before anything is deleted. If you are an instructor or staff member, your login is managed by your studio: ask the studio owner to remove you from their team, and email support@studiofly.fit from the address you sign in with to have the login itself deleted. If you are a member of a studio, your studio is the controller of your records and carries out the deletion itself — ask it through the StudioFly Member app under Profile → Delete My Data, or, without the app, by emailing support@studiofly.fit. We record your request, notify your studio immediately so it is not lost in an inbox, and will follow it up with them if you tell us they have not responded.
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer (Section 14).
• Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity, as per the DPDP Act.

b) Additional Rights under the GDPR (EU/UK individuals)

In addition to access, correction, and erasure above, if you are in the EU/EEA/UK you also have:

• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format (CSV/Excel), and have it transmitted to another controller where technically feasible.
• Right to Restriction of Processing: Request that we limit processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests, and object at any time to processing for direct marketing.
• Rights related to automated decision-making: We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to Withdraw Consent: Where we rely on consent, withdraw it at any time (as easily as it was given); withdrawal does not affect prior lawful processing.
• Right to lodge a complaint with your local supervisory authority (and, in India, with the Data Protection Board of India).

To exercise any of these rights, contact support@studiofly.fit. We will acknowledge your request within 7 days and complete the action within 30 days (for GDPR requests, within one month, extendable by two further months for complex requests with notice). If you are a member of a studio, please direct your request to your studio; we will support the studio in fulfilling it.

8. Data Breach Notification

In the event of a personal data breach that is likely to cause harm, we will:

• Notify affected studio owners (tenants) without undue delay and within 72 hours of becoming aware of the breach.
• Provide details of the nature of the breach, categories and approximate number of records affected, and steps taken or proposed to mitigate the impact.
• Report the breach to the Data Protection Board of India as required under the DPDP Act, and — where the GDPR applies and the breach meets the threshold — support affected Controllers in notifying the relevant EU/UK supervisory authority within 72 hours.
• Cooperate with affected tenants in notifying their members where required.

9. Cookies & Tracking Technologies

We use essential cookies and similar technologies for authentication, security, preferences, and aggregated/anonymized analytics. We do NOT use advertising or third-party tracking cookies. You can control cookies through your browser settings and, where required, through our consent banner; disabling essential cookies may affect functionality.

On studiofly.fit, we keep one first-party note in your browser's session storage (the page you first landed on and the website that referred you), used only to attribute a demo booking: it is sent to us only if you book a demo, is cleared when you close the tab, and involves no third-party tracking.

10. Children's Privacy

The StudioFly platform is a business tool intended for use by studio owners and staff who are at least 18 years of age.

Studio owners may add members who are minors (under 18) to their studio records. In such cases, the studio (as Data Fiduciary / Controller) is responsible for ensuring that verifiable parental or guardian consent has been obtained before adding a minor's data to the Service, in compliance with the DPDP Act and, where applicable, the GDPR. StudioFly does not knowingly collect personal data directly from minors. We do not engage in behavioural monitoring or targeted advertising directed at children's data.

11. International Data Transfers

Your data is primarily stored in India (Supabase, Mumbai). Some sub-processors may process data outside India (for example, PayPal and Sentry infrastructure, and our AI sub-processors Google and OpenAI in the United States). If you connect an AI assistant to your account, the information it asks for goes to that provider — OpenAI or Anthropic, both in the United States — on your instruction (Section 5B).

• For personal data subject to the GDPR that is transferred outside the EU/EEA/UK (including to India, which does not currently benefit from an EU adequacy decision), we put in place an appropriate transfer mechanism such as the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum), together with supplementary measures where needed. A copy of the relevant safeguards is available on request.
• For personal data subject to the DPDP Act, transfers outside India are made in accordance with the Act and any restrictions notified by the Government of India.

12. Data Retention

• Active account: Retained for as long as your account is active and the Service is being provided.
• After cancellation/termination: Retained for 30 days to allow export, then permanently deleted from active systems.
• Backups: Backup data may be retained for up to 90 days before permanent deletion.
• Legal obligations: Certain data (such as billing and invoicing records) may be retained as required by applicable tax and accounting laws (in India and, for international customers, their local requirements).
• Anonymized data: Aggregated, anonymized data that cannot identify any individual may be retained indefinitely for analytical and product-improvement purposes.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes at least 15 days in advance via email and/or a prominent notice within the Service, and may require renewed acceptance on next login. The "Last updated" date indicates the most recent revision.

14. Grievance Redressal / Data Protection Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the following officer is designated as Grievance Officer / point of contact for data protection:

• Name: Biswanath Sarkar
• Email: biswa@studiofly.fit
• Address: MyGymDesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India

The Grievance Officer will acknowledge your complaint within 7 (seven) days and resolve it within 30 (thirty) days. If unsatisfied, you may complain to the Data Protection Board of India under the DPDP Act, or (for EU/UK individuals) your local data protection supervisory authority.

EU/UK Representative: If and where required under GDPR Article 27 / UK GDPR, we will appoint an EU/UK representative and publish their contact details here.

15. Contact Us

For privacy-related questions or to exercise your data rights:

• Email: support@studiofly.fit
• Grievance Officer: Biswanath Sarkar — biswa@studiofly.fit
• Address: MyGymDesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India