Business app privacy policy
Last updated August 2, 2026
1. Who this policy covers
This policy applies to GYMTROX Business, the app used by gym brand owners, branch managers and front-desk staff to run a gym. If you are a gym member using the GYMTROX app, the policy that applies to you is at gymtrox.com/privacy instead. GYMTROX Business has no public sign-up — staff accounts are created for you by your gym’s brand owner.
2. What we collect about you as a staff user
Your name, email address, phone number, the role and branch your gym assigned you, and your account ID. From your device we collect a device identifier and a push notification token so alerts reach the right handset, plus basic diagnostics. We do not collect your location — precise or approximate — at any point.
3. Member data you handle in the app
The app shows you personal data belonging to your gym’s members: names, contact details, photos, membership and package status, check-in history, class and PT bookings, and counter transactions. That data belongs to the gym, not to you and not to us. Your gym decides what is collected and why; GYMTROX processes it on the gym’s instructions to provide the service. You may only use it to do your job at that gym.
4. Camera
The camera is used for two things only: scanning a member’s check-in QR code at the front desk, and verifying a payment reference. Nothing is photographed, recorded or stored — the frame is read for a code and discarded. Permission is requested the first time you tap the scan button, never at launch, and the app works without it if you check members in by name instead.
5. Photos you upload
If you set a staff or branch image, that photo is uploaded to GYMTROX and shown inside the app and on your gym’s public page. Photo library access is requested only at the moment you choose an image.
6. Offline caching on your device
The app is built for gym front desks with unreliable internet, so it caches the data you last loaded — including member names and phone numbers and your branch’s revenue — on the device, and queues check-ins and counter sales until they can be sent. Signing out permanently erases that cache. Transactions that genuinely happened but have not yet reached the server are kept so takings are not lost, and are sent on the next sign-in.
7. Payments
GYMTROX Business records payments taken in person at the counter — cash or card handed over at the desk for a membership, class, personal training session or canteen item. The app is a record-keeping tool: it does not process card payments and never sees or stores card numbers.
8. Notifications
With your permission the app sends operational alerts to your device — check-ins, bookings, payments and renewals. Notification tokens are used only to deliver these alerts and are removed when you sign out. You can turn notifications off at any time in your device settings.
9. Crash diagnostics
If crash reporting is enabled on a release build, a crash sends us the error, the screen it happened on and a technical breadcrumb trail, tagged with your account ID, role and branch so we can reproduce it. It never carries your name, email, phone number or any member’s data, and request and response bodies are never attached.
10. Requesting access to GYMTROX
If you submit the "Request access" form from the sign-in screen, we collect your gym name, your name, email address, WhatsApp number and gym location so our onboarding team can contact you. This is a sales enquiry, not an account. We use it only to reach you about bringing your gym onto GYMTROX, and you can have it deleted at any time — see gymtrox.com/business/delete-account.
11. What we never do
We do not sell your data or your members’ data. We do not share it with advertisers, run ads in this app, or use it for cross-app or cross-site tracking. There is no advertising SDK and no advertising identifier in GYMTROX Business.
12. Security & retention
Data is encrypted in transit over HTTPS and encrypted at rest in certified data centres. Access is limited to staff who need it. Your account data is kept while your gym keeps your account active; member data is retained according to your gym’s own retention decisions and the law. Access enquiry details are deleted within 24 months if the gym does not join.
13. Your rights & deletion
You can ask for a copy of your staff account data, correct it, or have it deleted. Because your gym issues your account, your brand owner can remove it directly in the GYMTROX dashboard; you can also write to privacy@gymtrox.com. Full instructions, including for members and for access enquiries, are at gymtrox.com/business/delete-account.
14. Age
GYMTROX Business is a workplace tool for gym staff and is not directed at or intended for children. You must be 18 or older to hold a staff account.
15. Changes & contact
We'll notify you in the app before material changes take effect. Privacy questions about the Business app: privacy@gymtrox.com — we reply within 7 days.
