What Aevantos Fitness handles today.

Who we are

Aevantos Fitness is a product of Aevantos, a sole proprietorship. It is software that gyms use to run memberships, check-ins, classes and dues. A gym is invited onto the product by us; everyone else at the gym is invited by the gym’s owner. There is no public sign-up.

Records about a gym’s members are entered by that gym and held by us so the product can work for that gym. Questions about a member record may therefore need to reach the gym that holds it.

Gym owners and staff

For owners, managers, front-desk staff and trainers we hold an email address, a display name, a role, a password (stored only as a one-way hash), the secret of the authenticator app, and backup codes (stored as hashes). We use them to sign you in and to decide what you may see.

We store each gym’s own payout details, its UPI ID and bank account (account name, number, IFSC, bank and branch), as entered by the gym’s owner. We show them, with the gym’s GSTIN if it has one, to that gym’s members so they can pay the gym directly; we take no payment ourselves. Only the owner can change them, and the record of each change keeps only the last four digits of the account number.

We also keep a record of actions taken in the product, such as a sign-in, a check-in you ran or a booking change, against the person who took them. It is kept for security and accountability. It is not used for analytics or advertising.

In the Staff app, the camera reads a member’s check-in QR code at the desk. No image is kept. The check-in itself is recorded for the gym.

Gym members

The gym enters a member’s details. Depending on what the gym records, this can include:

• full name, phone number, email address, date of birth and gender;
• an emergency contact’s name and phone number;
• free-text notes written by staff. We do not control what staff type there, and gyms sometimes note injuries or health conditions;
• plan, membership dates, dues, payments and receipts. Payments are recorded by method (for example cash, UPI or bank transfer), with the transaction reference staff type in for a UPI or bank payment; we hold no member’s card or bank details;
• check-ins (which member, when, allowed or denied, and which staff member ran the door), class bookings and waitlist places;
• for a member under 18, the guardian’s name, relationship and phone number, and a record that the guardian agreed;
• an identifier for the member’s printed check-in card, held as a hash.

If the gym uses door readers, we hold the reader’s own identifier for the person. We do not hold fingerprint or face templates or images.

In the Member app, a member who has accepted the gym’s invite has an account with their email address and a password, and the app shows their plan, dues, receipts and classes and lets them book. The check-in QR code is drawn on the phone and changes regularly.

This data is used to run the gym’s membership service. Nothing is used for advertising or profiling.

This website

If you use the contact form we store your name, email address, optional phone number and message so we can read and answer it. If you request the walkthrough we store your name, work email, mobile number, business name, city, state and country, the time and wording of your consent, and your browser’s user-agent string, plus (where enabled) a hash of a coarse part of your network address, used to limit abuse. Walkthrough details are deleted automatically after 24 months. We run no analytics or advertising scripts on this site.

Cookies are used only for signing in and for the walkthrough access you earn by submitting the form. There are no tracking cookies.

Where it is stored, and who else sees it

We use two service providers to run the product, and no others hold your data:

• Supabase hosts the database (Postgres), in its Mumbai region.
• Vercel hosts the website and the API, with its functions set to run in Mumbai. Its logs record request addresses, which can include a search term typed into the member search.

Each gym’s records are separated from other gyms’ at the database level. We do not sell data, we do not share it for advertising, we do not track you across other sites or apps, and the apps contain no third-party analytics or advertising code. No payment, SMS, WhatsApp or email provider is connected today, so none receives your data.

Security

Every account, for staff and members, signs in with a password and a code from an authenticator app. Email is not used as a second factor. Passwords and backup codes are stored as hashes, session tokens are stored only as hashes, and authenticator secrets are encrypted. On the phone, the sign-in token is kept in the iOS Keychain, on that device only. Staff sessions last 12 hours; a member’s session on their own phone lasts 30 days. A gym owner can disable a staff account, which ends that person’s sessions at once.

No system is perfectly secure, and we will not claim this one is.

How long we keep it

Walkthrough details are deleted automatically after 24 months. For everything else there is no automatic deletion today: gym, staff and member records, check-ins, bookings, receipts and contact messages are kept for as long as the gym uses the product. Closing an app login does not delete them: the login stops working, and the gym’s records of membership, payments, receipts, check-ins and bookings stay with the gym. The record of actions in the product can only be added to, so entries that name a person remain. Receipts are cancelled rather than edited or deleted.

Your rights

Under India’s Digital Personal Data Protection Act, 2023 you may ask to see the personal data we hold about you, ask us to correct it, ask us to erase it, withdraw consent you gave, and make a complaint about how it is handled.

To use any of these, including to ask us to close your account, email sunny.joshi@aevantos.com from the address on the account and say what you want. For a member record, we may need to involve the gym that holds it. We handle these requests by hand today; there is no button in the apps for it yet.

Grievances go to the same address. If we have not resolved yours, you may complain to the Data Protection Board of India.

Children

Gyms may have members under 18. A member under 18 is flagged from the date of birth the gym enters, and the product will not give that member an app account until gym staff have recorded a guardian’s consent. The gym records that consent; we do not independently verify the guardian or the member’s age. We do not show advertising to anyone, and we do not track or profile children. A guardian who wants to see, correct or erase a child’s data, or withdraw consent, can write to the address below.

Contact

Aevantos (sole proprietorship) — sunny.joshi@aevantos.com

We will say here when this notice changes, and the date above will change with it.