Privacy Policy

This policy explains what personal data Kazi Ramjan Ali (trading as FitIts) ("we", "us") handles when you visit our website or use the FitIts gym management software (the "Service"), why, and what choices you have. Questions: support@fitits.app.

1. What we collect

From gym owners and staff

• Account details: name, email address, phone number, password (stored only as a secure hash), language and role.
• Gym details: gym name, web address, country and settings.
• Billing details: plan, invoices, payments and the payment method type. Card and wallet details are entered with the payment provider (SSLCommerz or Paddle); we do not receive full card numbers.
• Security and usage records: sign-in times, IP address, browser details and a log of changes made in the gym (the audit log).

Data gyms enter about their members

• Contact and profile details (for example name, email, phone, date of birth, gender, address), memberships, classes and trainer.
• Workout plans, diet plans, health assessments, doctor assignments and prescriptions. Health information is sensitive; only the gym's authorised staff and the member can see it.
• Invoices and payments, and the emails and WhatsApp messages prepared or sent to the member, including whether the member agreed to receive WhatsApp messages.

From website visitors

Our web server records standard request information (such as IP address, browser and pages requested) for security and to keep the site working. We do not use advertising or analytics trackers on the website or in the Service.

2. How we use it

• To provide the Service: accounts, sign-in, the features each gym uses and messages the gym asks us to send.
• To bill gyms and send service emails such as email verification, password links, invoices, receipts and billing reminders.
• To keep the Service secure, prevent abuse and investigate problems.
• To answer your questions and give support.
• To meet legal, tax and accounting duties.

We do not sell personal data, and we do not use gyms' member data for our own marketing.

3. Who we share it with

We share personal data only as needed to run the Service, with:

• Hosting and email providers that store the Service's data and deliver its emails for us.
• Payment providers: SSLCommerz for payments in taka and Paddle.com for payments in US dollars. Paddle is the Merchant of Record for those orders and handles the buyer's payment details under its own privacy policy.
• WhatsApp (Meta): when a gym's staff tap "Send on WhatsApp", the message text and the member's number open in WhatsApp on their own device. If a gym connects a WhatsApp Business API number, messages are sent through Meta's WhatsApp Cloud API.
• Google Fonts: the app's typeface is loaded from Google's servers, so your browser sends Google its IP address when it loads the font.
• Authorities, when the law requires it, or to protect our rights or someone's safety.

These providers may be located outside your country.

4. Cookies

We use only the cookies needed for the Service to work: a session cookie that keeps you signed in and a security token that protects forms. We don't use advertising or tracking cookies.

5. How long we keep data

• A gym's data is kept while its account exists, including when it is read-only because of an unpaid subscription, so nothing is lost if the gym pays again.
• When a gym owner asks us to delete the gym, we delete its data from the live system, except records we must keep by law (such as our own invoices to the gym).
• Security records are kept only as long as needed for security and troubleshooting.

6. Security

The Service uses HTTPS. Passwords are stored as secure hashes. Each gym can only see its own data, staff see only what their role allows, and changes are recorded in the audit log. No system is perfectly secure; if a breach affects your data, we will tell affected gyms without undue delay.

7. Your choices and rights

• You can see and correct your account details in the app.
• You can ask us for a copy of your personal data, or to correct or delete it, by emailing support@fitits.app. We may need to confirm who you are.
• Members: your gym manages your data, so please ask your gym. We will help the gym answer your request.
• You can stop WhatsApp messages from a gym by telling the gym; staff can turn them off on your profile.

8. Children

FitIts is used by businesses. Gyms that add members under 18 are responsible for getting a parent's or guardian's consent.

9. Changes

We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell gym owners by email or in the app.

10. Contact