Privacy Policy

Last updated: July 2025

Torzil ("we", "us", or "our") operates the website at www.torzil.com and the Torzil gym management platform, including the member mobile application ("Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. Please read this policy carefully. If you disagree with its terms, please discontinue use of our Services.

1. Information We Collect

We collect information in the following ways:

Information you provide directly

When you register for an account, submit a demo request, or use our platform, we may collect:

• Name, email address, phone number, and business details
• Gym name, location, and branch information
• Member records you enter into the platform (member names, contact details, attendance, and payment history)
• Billing and payment information (processed through our payment partners — we do not store full card details)
• Communications you send us, including support requests

Information collected automatically

When you access our Services, we automatically collect certain technical information, including:

• Device type, operating system, and browser information
• IP address and approximate location
• Pages visited, features used, and time spent on the platform
• Crash reports and error logs

Information from third parties

If you use integrations such as WhatsApp Business API or biometric attendance devices, we may receive data from those systems as part of delivering the service.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Torzil platform
• Process transactions and send related information, including invoices and payment confirmations
• Send automated communications on your behalf (such as member renewal reminders via WhatsApp and SMS)
• Respond to your comments, questions, and support requests
• Send you technical notices, updates, and administrative messages
• Monitor and analyse usage trends to improve our Services
• Detect, prevent, and address technical issues and fraudulent activity
• Comply with legal obligations

We do not use your members' data for our own marketing purposes. The member records stored in Torzil belong to your gym and are used solely to provide the service you have subscribed to.

3. How We Share Your Information

We do not sell your personal data. We may share information in the following circumstances:

Service providers

We work with third-party companies to help deliver our Services, including cloud hosting providers, payment processors, SMS and WhatsApp delivery services, and analytics tools. These providers have access to your information only as necessary to perform their functions and are bound by confidentiality obligations.

WhatsApp / Meta

If you use our WhatsApp integration, messages are sent via the Meta Cloud API. Member phone numbers and message content are transmitted to Meta's infrastructure in accordance with Meta's data processing terms. Torzil is an official Meta Technology Partner.

Google Workspace APIs (Google Meet and Google Calendar)

If a gym connects its Google account to Torzil in order to run online classes, Torzil requests the following Google API scopes, and only these:

• https://www.googleapis.com/auth/calendar.events — to create, update and delete the calendar event that carries the Google Meet link for an online class scheduled in Torzil.
• https://www.googleapis.com/auth/userinfo.email — to read the connected account's email address and user ID, so Torzil can display which Google account is connected and identify it when the gym disconnects.

What we do with this data. When a gym schedules an online class in Torzil, we create a Google Calendar event on the connected account and store the resulting event ID and Google Meet join link against that class, so members can join it. When the gym changes the class time, duration or title, we update that event. When the gym cancels the class, we delete it. Torzil only ever acts on calendar events it created for a Torzil class.

What we do not access. Torzil does not read, list, modify or delete any other event on the connected Google Calendar. We do not access Google Meet recordings, transcripts, chat, participant lists or meeting content, and we do not access the Google account's contacts, email or files.

What we store. We store the connected account's email address and Google user ID, and the calendar event ID and Meet join link for events Torzil created. OAuth access and refresh tokens are encrypted at rest using AES-256 with a key held outside the database. This data is stored against that gym's own tenant and is visible only to that gym's staff. It is never sold, and is never shared with any third party except the cloud hosting provider that operates our infrastructure on our behalf.

How to revoke access and delete the data. A gym can disconnect Google at any time from Org › Integrations › Google Meet inside Torzil. Disconnecting deletes the stored OAuth tokens immediately and Torzil stops acting on the Google account. Access can also be revoked directly at myaccount.google.com/permissions. To request deletion of the remaining stored data, contact us using the details in section 12.

How we protect it. Google user data is transmitted over TLS and stored encrypted at rest. OAuth tokens are additionally encrypted with AES-256 using a key held outside the database. Access is restricted to the gym's own authenticated staff, and internally to the small number of engineers who operate the service.

How long we keep it. We retain the connected account's email address, Google user ID and OAuth tokens for as long as the Google account remains connected. Disconnecting deletes the OAuth tokens immediately. Calendar event IDs and Meet join links are retained for as long as the related class record exists, and are deleted when the gym's account is deleted, subject to the retention period in section 5.

Uses we explicitly prohibit. We do not, and will not, use or transfer Google user data for any of the following:

• serving advertising of any kind, including retargeting, personalised advertising and interest-based advertising;
• selling, licensing or transferring the data to data brokers, information resellers or any other party for independent use;
• determining creditworthiness or for any lending or credit-assessment purpose;
• training, fine-tuning or otherwise improving generalised or non-personalised artificial intelligence or machine learning models; or
• any purpose other than providing and improving the Torzil features the gym has chosen to use.

Limited Use disclosure. Torzil's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read Google user data unless we have the gym's affirmative agreement for specific messages, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymised for internal operations such as diagnosing a fault.

Legal requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Torzil, our users, or others.

Business transfers

If Torzil is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

4. Data Storage and Security

Your data is stored on secure servers. We implement industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security reviews.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your account data for as long as your subscription is active. If you terminate your account, we will retain your data for up to 30 days to allow for data export, after which it is permanently deleted upon request. Certain records may be retained longer where required by applicable law.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access - Request a copy of the personal data we hold about you
• Correction - Request correction of inaccurate or incomplete data
• Deletion - Request deletion of your personal data, subject to legal retention requirements
• Portability - Request your data in a portable, machine-readable format
• Objection - Object to certain types of processing, including direct marketing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

Our website uses cookies and similar tracking technologies to enhance your experience and collect usage data. These include essential cookies (required for the platform to function), analytics cookies (to understand how users interact with our site), and preference cookies (to remember your settings). You can control cookie settings through your browser, though disabling certain cookies may affect functionality.

8. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, please contact us and we will promptly delete it.

9. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies separately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are significant, notify you by email or through the platform. Your continued use of our Services after any changes constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. For users in other jurisdictions, we also endeavour to comply with applicable local data protection laws.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Torzil
Email: [email protected]
Website: www.torzil.com