ThreeSets Logo
ThreeSetsBack to Home
ThreeSets Legal

Privacy Policy

Your data belongs to you. Here is exactly what we collect, why we collect it, and how we protect it.

Last updated: 24 October 2026

1. Introduction

ThreeSets Technologies Pvt. Ltd. (“ThreeSets”, “we”, “our”, or “us”) operates the gym management SaaS platform available at threesets.fit and its associated mobile applications (collectively, the “Platform”). This Privacy Policy explains how we collect, use, disclose, and safeguard information about you and the gyms that use our Platform in India and internationally.

We are committed to compliance with India’s Digital Personal Data Protection (DPDP) Act, 2023 and any rules or regulations issued thereunder. By accessing or using the Platform, you consent to the practices described in this Policy.

2. Information We Collect

2.1 Information You Provide Directly

  • Account Registration: Name, business email, mobile number, gym name, city/state, and password hash when you create a ThreeSets owner or staff account.
  • Gym Member Data: Member names, mobile numbers, membership plan details, payment records, and attendance data that you enter on behalf of your gym members.
  • Payment Information: UPI transaction IDs, invoice data, and plan subscription details processed through our integrated payment gateway partners (Razorpay/PayU). We do not store raw card details.
  • Support Communications: Messages you send via WhatsApp support, email, or in-app chat.

2.2 Information We Collect Automatically

  • Usage Data: Pages visited, features used, session duration, and button click events (anonymised via Plausible Analytics — no cross-site tracking cookies).
  • Device & Log Data: IP address, browser type, OS version, and crash logs collected for security and debugging.
  • QR Attendance Scans: Timestamps and member identifiers recorded when members scan QR codes at gym entry.

2.3 WhatsApp Automation Data

When you use our WhatsApp fee-reminder and renewal engine (powered by the WhatsApp Business API), we store message templates, delivery status, and read receipts. We do not read the content of conversations outside our own system-generated template messages.

3. How We Use Your Information

  • To provide, maintain, and improve the Platform and its features.
  • To send automated WhatsApp fee reminders, renewal notices, and invoices on your behalf.
  • To process subscription payments and generate GST-compliant digital invoices.
  • To provide customer support and respond to queries.
  • To detect, investigate, and prevent fraud, abuse, or security incidents.
  • To send product update notifications and occasional marketing communications (you may opt out at any time).
  • To comply with applicable laws including the DPDP Act 2023, GST regulations, and RBI payment guidelines.

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

  • Contractual Necessity: To provide the SaaS service as outlined in our Terms of Service.
  • Legitimate Interests: For security, fraud prevention, and product analytics.
  • Consent: For marketing communications and optional data integrations, where we request explicit consent.
  • Legal Obligation: To comply with Indian tax law, data protection regulations, and court orders.

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following limited circumstances:

  • Payment Processors: Razorpay or PayU — for processing subscription payments. They are PCI-DSS compliant.
  • WhatsApp Business API Provider: Meta Platforms (WhatsApp) — for message delivery only.
  • Cloud Infrastructure: AWS Mumbai region — your data stays within India.
  • Analytics: Plausible Analytics — privacy-first, GDPR-compliant, no cookies, no cross-site tracking.
  • Legal Requirements: We may disclose data if required by law, court order, or government authority.

6. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, we purge personal data within 30 days, except where retention is required by law (e.g., GST invoices must be retained for 8 years under Indian tax law). Anonymised, aggregated analytics data may be retained indefinitely.

7. Data Security

  • All data transmitted via the Platform is encrypted in transit using TLS 1.3.
  • Data at rest is encrypted using AES-256 encryption on AWS.
  • Access to production systems is restricted to authorised personnel only, with multi-factor authentication enforced.
  • We conduct regular vulnerability assessments and penetration testing.
  • We maintain a 99.9% uptime SLA with automated backups every 6 hours.

8. Your Rights Under DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

  • Access: Request a copy of personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Erasure (Right to be Forgotten): Request deletion of your personal data, subject to lawful retention obligations.
  • Grievance Redressal: Lodge a complaint with our Data Protection Officer.
  • Nominate: Nominate a person to exercise rights on your behalf in case of death or incapacity.

To exercise any of these rights, email us at privacy@threesets.fit with the subject line “Data Rights Request”. We will respond within 72 hours.

9. Cookies & Tracking

The ThreeSets marketing website uses no third-party advertising cookies. We use Plausible Analytics, which is cookieless and privacy-preserving. The dashboard application uses essential session cookies only — these are strictly necessary for login functionality and are not used for advertising.

10. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

11. International Transfers

All personal data of Indian users is stored and processed in the AWS Mumbai (ap-south-1) region, within India. We do not transfer your data outside India unless explicitly required by law or with your prior consent.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notification at least 14 days before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

13. Contact & Data Protection Officer

For privacy-related queries, data rights requests, or to report a security vulnerability, please contact: