Staunch User Privacy Policy

This policy applies to personal data processed in connection with the Staunch user-facing Services. Staunch acts as the Data Fiduciary (controller) for user personal data and engages trainers and vendors as processors to deliver the Services.

a. Personal Information

• Full name
• Mobile number
• Email address
• Date of birth (optional)
• Profile photo (if uploaded)
• Preferences (e.g., fitness goals)
• Partner contact for couple plans (partner phone; optional name)

b. Service & Booking Information

• Plan/Subscription selections, booking history, session schedule/status
• Approved service address/venue notes, society/clubhouse access details where relevant
• Trainer allocation/substitution metadata
• In-app identifiers (session IDs, QR/access tokens)

c. Location Data

• Precise or approximate geolocation when permitted, used to check serviceability, help select/confirm addresses (e.g., Google Places/Maps), and route trainers
• On Android, you may see background (“always”) access prompts to support seamless operation around session times; you can disable location anytime in device settings

d. Payment & Transaction Data

• Payment order IDs, payment status, and reconciliation references from our payment processor (e.g., Razorpay)
• We do not store full card numbers or CVV
• GST invoicing references

e. Device & App Usage Data

• Device type, OS version, IP address, crash reports, and usage analytics via Firebase Analytics and Crashlytics
• Cookies/local storage identifiers on web to keep you signed in and prevent fraud

f. Login & Authentication

• Sign-in using OTP/email via Firebase Authentication
• Secure session cookies and encrypted tokens for backend access

g. Communication Data

• Firebase Cloud Messaging (FCM) for session updates, reminders, and app notifications

h. Media Uploads (Optional)

• Progress photos, testimonials, or feedback you voluntarily submit; stored securely on our servers

• To register and manage your account and profile
• To book, reschedule, and manage training sessions
• To allocate and substitute trainers and coordinate service delivery
• To process payments, reconcile status, and issue tax invoices
• To verify serviceability at your location and enable trainers to reach approved venues
• To provide transactional communications, reminders, and important updates
• To improve app functionality, performance, and support (analytics and crash diagnostics)
• To comply with legal obligations (tax, accounting, fraud prevention) and enforce our Terms and User Agreement

• Consent (e.g., precise location, certain analytics)
• Contractual Necessity (e.g., account, bookings, payments)
• Legitimate Business Interests (e.g., app security, service improvements)
• Legal Obligation (e.g., tax and regulatory compliance)

We do not sell or rent your personal information. We may share your data with:

• Trainers: only the details necessary to perform your session (e.g., first name, session time, approved service address/venue notes). Trainers are instructed not to contact you off-platform
• Service providers (processors): Firebase (Authentication, Analytics, Crashlytics), Google Maps/Places, Razorpay/payment networks, secure hosting, communication and support tools — all operating under contracts with confidentiality and security controls
• Government authorities where required by law
• Internal staff under confidentiality
• Advisors and auditors as required
• In the event of a business transfer (e.g., merger/acquisition), pursuant to this Policy

• Encryption in transit and at rest; restricted access on a need-to-know basis
• Encrypted authentication tokens; logging and monitoring
• Regular security reviews and access control measures

No method of transmission or storage is fully secure; we cannot guarantee absolute security.

We retain your information as long as necessary to meet legal and operational needs. You may request deletion, but some information may be retained as required by law (e.g., tax/accounting records).

• Right to Information
• Right to Access
• Right to Correction
• Right to Erasure
• Right to Withdraw Consent
• Right to Grievance Redressal

The Services are intended for users aged 18 and above. We do not knowingly collect data from children.

While the mobile app does not use cookies, web sessions may use cookies and similar technologies to keep you signed in, operate the site, measure performance, and prevent fraud. Firebase and other SDKs may use identifiers for analytics and crash monitoring. You can clear cookies/local storage via browser/device settings.

• Security assessments
• Staff training and access restrictions
• Breach detection and incident response protocols
• Processing documentation

We may update this Policy and will notify users via the app, website, or email where required. Continued use after updates indicates acceptance.

In case of a personal data breach, we will notify affected users and authorities as required by law without undue delay.

Your data is primarily stored in India. If transferred internationally through our service providers, we ensure appropriate safeguards are in place.

You may contact the DPO with concerns. We will acknowledge within 7 days and aim to resolve within 30 days. If unsatisfied, you may escalate to the Data Protection Board of India as per applicable law.

To delete your account, submit a request via this form (or use in-app options where available). Verified requests are processed within 7 working days. Certain information may be retained for legal or regulatory purposes.