Privacy Policy

PT Alien Wave Group operates Nugym. Two different relationships matter here:

• Gym owners are our customers. We are the controller of their account data (name, email, phone, billing records) — we decide how it is used.
• Gym members' data belongs to the gym. When a gym stores its members in Nugym, the gym is the controller and we are the processor: we hold and process that data on the gym's instructions and do not use it for our own purposes.

If you are a gym member with a question about your data, contact your gym first — they decide what is stored and can correct or delete it. We will help them do so.

From gym owners and staff:

• Name, email address, phone number, and a password stored only as a bcrypt hash — never in readable form.
• Gym details: business name, address, city, country, currency, opening hours, logo.
• Identity documents you upload for verification (government ID, business licence). These are access-controlled and are never public.
• Subscription and billing history for your Nugym plan.

Member data that gyms store in the platform:

• Contact and profile details: name, phone, email, photo, date of birth, blood group, emergency contact.
• Membership records: plan, joining and expiry dates, payments, invoices, wallet and loyalty balances.
• Attendance and check-in records, including entry method and timestamps.
• Biometric templates, where a gym uses fingerprint or face check-in hardware. These are mathematical templates, not images, and are used solely to recognise a member at that gym's door.
• Access credentials issued by the gym: door access codes and RFID card numbers.
• Optional fitness data the gym or member records: body measurements, progress photos, workout and diet plans, class bookings.
• Messages sent through the platform's chat, and community posts.

Automatically: basic technical data needed to run and secure the service — IP address, browser type, and request logs — plus anonymous usage analytics.

Fingerprint and face templates are sensitive personal data and are treated differently under the law in many countries, often requiring explicit, separate consent and sometimes prohibiting their use outright.

• Biometric check-in is optional. A gym chooses whether to enable it, and a member can always be checked in by card, QR code, or by staff instead.
• Templates are stored to identify a member at that gym only. They are never shared between gyms, sold, or used to identify anyone anywhere else.
• If a gym enables biometric check-in, that gym is responsible for obtaining the consent its local law requires from each member before enrolling them.
• A member can ask their gym to delete their biometric template at any time; deleting it removes fingerprint entry but not their membership.

• To provide the service you signed up for — running memberships, attendance, billing and communications.
• To take payment for your Nugym subscription and to let your members pay you.
• To send transactional messages: welcome emails, renewal and expiry reminders, receipts, and account notices.
• To keep the service secure — detecting abuse, rate-limiting sign-in attempts, and keeping audit logs of sensitive actions.
• To meet legal and accounting obligations.

We do not sell personal data, and we do not use your members' data to advertise to them.

We use a small number of providers to run the service. Each receives only what it needs:

• MongoDB Atlas — the managed database where your data is stored.
• Hostinger — hosting and content delivery for the application.
• Stripe and the local gateways a gym connects (JazzCash, Easypaisa, Razorpay, Midtrans, PayTabs, Paystack, Flutterwave and others) — payment processing. Card details are entered on the provider's own page and never reach our servers.
• Twilio — SMS and WhatsApp notifications, where a gym has enabled them.
• Cloudinary — image storage and delivery, where configured.
• Your own email provider — a gym connects its own SMTP account, so its member emails are sent by the gym, from the gym.
• Google Analytics — anonymous usage statistics for our public pages.

• Account and member records: for as long as the gym's account is active.
• Financial records (payments, invoices, transactions): retained after deletion where accounting and tax law requires it.
• Deleted members are soft-deleted first, so a gym can recover from a mistake, and are then removed on request.
• If a gym closes its account, we delete or anonymise its data within 90 days, except records we must legally retain.

• All traffic is served over HTTPS.
• Passwords are stored as bcrypt hashes; payment-gateway credentials are encrypted at rest.
• Each gym's data is isolated — one gym cannot read or modify another's.
• Access to sensitive features is restricted by role, and sensitive administrative actions are recorded in an audit log.
• Identity documents are access-controlled and require authentication to view.

No system is perfectly secure. If we discover a breach affecting personal data, we will notify affected gyms without undue delay and provide what we know.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to certain processing, and to complain to your local data protection authority.

• Gym owners can export their full data at any time from the dashboard, and can request deletion by writing to support@nugym.app.
• Gym members should contact their gym, which controls their record. We will assist the gym in fulfilling the request.

Nugym is not intended for children. Where a gym enrols a minor, the gym is responsible for obtaining consent from a parent or guardian as its local law requires.

We will update this page when our practices change and revise the date above. For anything privacy-related, write to support@nugym.app.