Privacy Policy for Trainers

How Grytt handles your data and your clients’ data when you use Grytt for Trainers.

1. Two Kinds of Data, and Who Decides

• •Your data is the information about you and your business: your account, profile, payments and how you use the dashboard. We decide how it is used, for the purposes in this policy.
• •Your clients’ data is the information about the people you coach that you enter, upload or receive through Grytt. You decide why and how you use it for your coaching. We store and process it on your behalf, to provide the Service to you and your clients, and for no other purpose of our own. Your responsibilities for it are in section 6 of our Terms of Service for Trainers.

A client who is also a Grytt member has their own account, and the general Privacy Policy covers their relationship with Grytt, including what a connected trainer can see.

2. Information We Collect About You

Information you provide

• •Account: your email address and password (we store a hashed version of the password, not the password itself), your name, and, if you sign in with Google or Apple, the identifier and email that provider gives us.
• •Sign-up question: how you heard about Grytt, if you choose to tell us. Some older accounts also answered questions about their coaching business at sign-up.
• •Profile (optional): a photo, phone number, gender, date of birth, bio, specialisations, certifications, years of experience, a social handle, and a location you search for (we keep the country, timezone and map coordinates it resolves to).
• •Your content: programs, workouts, courses and videos, templates, check-ins, notes, and messages.
• •Client invitations: the email addresses or usernames you enter to invite clients.
• •Payments: records of your orders (plan, amount, currency, dates and Razorpay reference). Razorpay collects your card, UPI or bank details; we do not receive or store them.
• •Support: what you send us when you write to us.

Collected automatically

• •Usage: the pages you view and actions you take in the dashboard, tied to your account email and name. We do not record your screen or your sessions.
• •Technical: device and browser type, app version, language, error reports, and the time you last signed in.
• •Approximate location for pricing: we use your approximate country (from your connection, your browser language, or your own choice on the pricing page) to show prices in the right currency.

3. Your Clients’ Information in Grytt

Depending on what your clients do in Grytt and what you enable, you may see or enter:

• •Their name, username, photo and contact email.
• •Workouts and training logs, personal records, progress and consistency, and habits and supplements you set up.
• •Body measurements, weight and height, and progress or physique photos (including photos you take or upload for them).
• •Food diary entries, meal photos and nutrition targets.
• •Check-in answers (including photo answers), Readiness Check ratings, and form-check videos.
• •Health data from a client’s phone (such as sleep, steps, active energy, exercise minutes and resting heart rate), only if the client turns sharing on. They can turn it off again at any time.
• •Messages between you and the client, and your private notes and tags about them.

A client’s access is controlled by their connection with you. When the connection ends, your access to their data ends. Some of this information is sensitive; section 13 explains how we treat it.

4. How We Use Information

• •To create and run your account and the dashboard, and to connect you with your clients.
• •To take payments, activate plans, send receipts, and process refunds.
• •To send you the emails the Service needs (verification codes, invitations, receipts).
• •To deliver notifications to your clients when you message them or send a check-in.
• •To provide AI features you ask for (section 5).
• •To understand how the dashboard is used, find and fix errors, and improve it.
• •To keep the Service secure, prevent fraud and abuse, and enforce our Terms.
• •To respond to you, and to comply with the law.

5. AI Features

When you use the AI Builder or the Co-pilot, we send what you type and the client data needed to answer it to our AI providers, who return a response. That can include a client’s training and nutrition logs, health data they have chosen to share, your notes about them, and, when you ask it to look at them, their progress photos.

• •Providers. We currently use Anthropic, and OpenAI for the faster, lower-cost tier of the AI Builder and for matching text in the Co-pilot. Each provider handles the data under its own terms and privacy policy.
• •We record AI Builder conversations for quality and debugging. The text of your AI Builder requests and the responses, including the client information in them, is recorded in our AI monitoring tool (Langfuse). For other AI features we record only technical details such as timings, token counts, model and tool names, and cost.
• •Output is a suggestion. You review it before it reaches a client, as the Terms for Trainers explain.
• •Only use it for clients who agree. Do not use AI features on a client’s data unless they know and agree.

6. Who We Share Information With

We do not sell your personal data or your clients’ data. We share information only as described below.

• •With your clients. They see what you share with them and your display name, photo and bio.
• •With your team. If you join or run a team, team administrators can see every client, conversation and note in it, including private notes.
• •With the public. Your profile and invite link show your username, display name, photo, bio, specialisations and the number of clients you coach to anyone who has the link. Your photo may also be used as the preview image when the link is shared.
• •With service providers who help us run Grytt, under confidentiality and data-protection obligations:

Cloud hosting

Runs our servers and database. All your data, including your clients’ data.

DigitalOcean Spaces

Stores uploaded files: photos, videos and avatars.

Anthropic and OpenAI

AI features (section 5). The text you send and the client data needed to answer it.

Langfuse

AI monitoring. Technical details of AI requests, and the text of AI Builder conversations (section 5).

Razorpay

Payments. Your name, email, billing details and the amount. Card and UPI details go to Razorpay only.

MailerSend

Sends our emails. Your email address, and the addresses you invite.

Mux

Course video hosting and playback, if you use Courses. Your course videos.

Expo, Apple and Google push services

Deliver notifications to your clients’ phones. A device token and the notification text.

PostHog

Product analytics. Your email, name and actions in the dashboard.

Sentry

Error reporting. Technical error details and app or device information.

Google and Apple

Sign-in. Your account identifier and email.

OpenStreetMap (Nominatim)

Looks up the place you type when you set your location.

YouTube

The AI Builder looks up exercise videos. A search phrase.

Slack

Internal error alerts to our team. Technical details that may include an account identifier.

• •For legal reasons: to comply with applicable law, regulation, legal process, or an enforceable government request, or to protect the rights, property, or safety of Grytt, our users, or others.
• •In a business transfer: if Grytt is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

7. Cookies and Local Storage

• •Needed to sign in. A secure session cookie keeps you signed in, and related cookies protect sign-in requests.
• •Preferences. We store your choices in your browser, such as the light or dark theme, banners you have hidden, and the country you choose for prices.
• •Analytics. Our analytics tool (PostHog) may store an identifier in your browser to recognise you between visits.

8. International Data Transfers

Grytt operates globally. Some of our service providers, including our analytics (PostHog) and crash-reporting (Sentry) providers and our AI providers, process data in the United States, and our payment provider processes payments in India. This means your information may be transferred to, stored, and processed in countries that have different data-protection laws than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

9. Data Retention

We keep information only as long as needed for the purposes in this policy:

• •Account, profile and content: kept while your account is active, and deleted after you ask us to delete your account (section 10).
• •Payment records: kept as long as the law requires us to keep accounting and tax records.
• •Crash and diagnostic data: kept for up to 90 days.
• •Analytics and AI monitoring data: we have not set a fixed period for these. We will delete what is linked to you if you ask.

Some data may be kept longer where required by law, or to resolve disputes and enforce our agreements.

10. Deleting Your Account

• •How to ask. Email vysakh@grytt.coach from the address on your account with the subject “Delete My Account”.
• •When. We review every request, then permanently delete your personal data within 30 days at the latest. Your data stays in place until the request is actioned, and you can tell us you have changed your mind before then.
• •What goes. Your account, profile, content, notes and files. If you coach on your own, your team and the links to your clients are removed, and your clients’ own Grytt accounts stay with them. If you are a coach on a team with other coaches, we ask you to hand your clients over first.
• •What may stay. Payment records, and anything the law requires us to keep, or that is held in a form that cannot identify you.

11. Your Rights

Depending on where you live, you may have some or all of these rights over your personal data:

• •Access: ask for a copy of the personal data we hold about you.
• •Correction: update or correct your details (most fields can be edited in your profile).
• •Deletion: ask us to delete your account and data (section 10).
• •Portability: ask for your data in a portable format.
• •Restriction or objection: restrict or object to certain processing.
• •Withdraw consent: where processing is based on consent, withdraw it at any time, without affecting what was done before.

If you are in the European Economic Area or the UK, you may also complain to your local data protection authority. If you are in California or another US state with privacy laws, you have the right to know what we collect, to ask for deletion, and not to be treated differently for using your rights. If you are in India, you have the rights that India’s Digital Personal Data Protection Act, 2023 gives you, to the extent it applies to us, including to access, correct and erase your data and to have a grievance heard.

Your clients’ rights. A client who wants to see, correct or delete their data should ask you first. If they ask us, we will help them and may involve you. Tell us promptly if a client contacts you.

To use any of these rights, write to vysakh@grytt.coach. We may need to verify your identity first. For complaints, write to our Grievance Officer, Vysakh P K, at the same address. See our contact page for response times.

12. Legal Bases (EEA / UK)

Where the GDPR or UK GDPR applies, we process your personal data on these legal bases:

• •Performance of a contract: to provide the dashboard and the features you ask for, and to take payment.
• •Consent: for optional features and sensitive data, which you can withdraw at any time.
• •Legitimate interests: to operate, secure, analyse and improve the Service, balanced against your rights.
• •Legal obligation: to comply with the law, for example tax and accounting records.

For your clients’ data, you are responsible for having your own legal basis, as the Terms for Trainers explain.

13. Sensitive Information

Some of the data your clients’ data can include is sensitive: fitness and health information (such as injuries, limits, sleep and activity data), physique and progress photos, and ratings of stress and soreness. Where the law requires consent, it is for you to have it from your client before you enter, upload or ask us to process it. We use this information only to provide the Service to you and your client, and it is shared with the providers in section 6 only for that purpose. We never use health data for advertising.

14. Security

We use reasonable technical and organisational safeguards to protect information, including encryption in transit (HTTPS) and hashed passwords. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Keep your password private, and tell us at once if you think your account has been misused.

15. Children

Grytt for Trainers is for adults. You must be at least 18 to have a trainer account, and the clients you add must be 18 or older. We do not knowingly collect personal data from anyone under 18 through the dashboard. If you believe we have, contact us and we will delete it.

16. Changes to This Policy

We may update this policy from time to time. When we make changes, we will revise the “Last updated” date above and, where appropriate, notify you in the dashboard or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

17. Contact

Questions, concerns or requests about this policy or your data? Write to vysakh@grytt.coach. Vysakh P K, trading as Grytt, Vyshnavam Nechully (H), Krishna Garden Road, Opp AM Motors, Kayarampara, Palappuram PO, Palakkad, Kerala 679103, India. Our Grievance Officer and response times are on the contact page.