Privacy Policy

This Privacy Policy explains how Premier Sports Group (“Gympanels,” “we,” “us,” or “our”), operating the Gympanels gym management platform at gympanels.com and app.gympanels.com (the “Service”), collects, uses, discloses, and protects information when you use our Service.

Gympanels is a multi-tenant platform used by fitness franchises, gyms, and their staff and members, organized under a Brand → Company → Location hierarchy. This policy applies to all users of the Service: franchise administrators, gym staff, and gym members.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, phone number, role/job title
• Member records: name, phone number, email, date of birth, emergency contact, membership plan, billing address
• Authentication data: phone number used for WhatsApp OTP verification, TPIN (numeric PIN), password hashes (we never store passwords or TPINs in plain text)
• Payment information: billing details and transaction records processed through our payment/billing ledger (we do not store raw card numbers; these are handled by our payment processor)
• Communications: messages sent and received via WhatsApp, Instagram Direct, Facebook Messenger, SMS, and email through the Service

1.2 Information Collected Automatically

• Check-in data: QR scan check-ins, staff-logged check-ins, self check-ins, and front-desk venue visit logs, with associated timestamps and location
• Usage data: log data, device/browser information, IP address, pages visited within the Service
• Cookies and similar technologies: used for session management and analytics on gympanels.com

1.3 Information from Third-Party Platforms

When you or your gym connects the following services to Gympanels, we receive and process data from them as necessary to provide the Service:

• Meta Platforms (WhatsApp Business Platform, Instagram Direct, Facebook Messenger): message content, sender/recipient identifiers, delivery/read status, and profile information made available via these platforms’ APIs
• TikTok (TikTok Business Messaging API): message content, sender/recipient identifiers, delivery status, and TikTok profile information (display name, profile photo, and TikTok user ID) made available via the TikTok Business Messaging API when your gym connects a TikTok Business account
• HubSpot: contact records and lead data synced via CRM integration
• Shopify: order and customer data from connected storefronts
• Resend / Google Workspace: email delivery and engagement data

2. How We Use Information

We use collected information to:

• Provide, operate, and maintain the Service (membership management, scheduling, check-ins, billing)
• Authenticate users via WhatsApp OTP and TPIN
• Send transactional and marketing communications via WhatsApp, Instagram, Messenger, SMS, and email, where consent has been given
• Power Campaigns, Sequences, and Trigger/auto-responder messaging features
• Support AI-assisted features such as message drafting and lead scoring, using third-party AI providers (OpenAI or OpenRouter) — message and lead content may be sent to these providers solely to generate suggestions; it is not used by us to train third-party foundation models beyond what those providers’ own data-use terms specify
• Generate invoices and maintain the immutable billing ledger
• Analyze usage to improve the Service
• Comply with legal obligations and enforce our Terms of Service

3. Legal Basis and Consent for Messaging

Where we send WhatsApp, Instagram, Messenger, SMS, or email communications, we do so based on:

• Consent given at signup or opt-in (e.g., WhatsApp OTP flow, marketing opt-in checkbox)
• Legitimate interest in operational/transactional messages tied to an existing membership (e.g., booking confirmations, payment reminders)

Users may opt out of marketing messages at any time via the unsubscribe/opt-out mechanism provided in each channel, or by contacting us directly. Opting out of marketing does not affect transactional messages necessary for account or membership operation.

4. How We Share Information

We do not sell personal information. We share information only with:

• Sub-processors and service providers: cloud hosting and infrastructure providers (data is stored on a regional basis as described in Section 8), messaging platforms (Meta Platforms, TikTok, Twilio/SMS gateways where applicable), email delivery (Resend, Google Workspace), CRM (HubSpot), e-commerce (Shopify), AI providers (OpenAI/OpenRouter)
• The gym/franchise you are a member of: your gym’s staff and administrators can view your membership, check-in, and billing records within their Company/Location scope
• Legal and safety purposes: where required by law, regulation, or to protect the rights, property, or safety of Gympanels, our users, or the public
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections

4.1 Meta Platform Data Use

Data received through WhatsApp Business Platform, Instagram Direct, and Facebook Messenger integrations is used solely to provide messaging features within Gympanels (sending/receiving messages, template messaging, automated responses) and is handled in accordance with Meta’s Platform Terms and Developer Policies. We do not use this data for advertising purposes outside the Service.

4.2 TikTok Platform Data Use

Data received through the TikTok Business Messaging API integration (message content, delivery status, and TikTok profile information) is used solely to enable messaging features within Gympanels — sending and receiving messages, automated responses, and message thread management — for the gym or franchise that has connected its TikTok Business account. This data is:

• Not sold, and not shared with third parties other than the sub-processors listed in this section that are necessary to operate the Service
• Not used for advertising, ad targeting, or any purpose outside providing the messaging functionality your gym has enabled
• Not used to train third-party or foundation AI models; where AI-assisted drafting (Section 2) is used, TikTok-sourced message content is processed solely to generate in-context suggestions
• Deleted or de-identified in accordance with Section 5 (Data Retention) when a gym disconnects its TikTok Business account, or upon a verified deletion request

Use of TikTok data through this integration is also subject to TikTok’s Developer Terms of Service and Business Messaging Policies.

5. Data Retention

We retain personal data for as long as an account or membership is active, and thereafter as needed to:

• Comply with legal, tax, and accounting obligations (billing ledger entries are append-only and retained per applicable financial record-keeping requirements)
• Resolve disputes and enforce agreements

Data received via connected messaging platforms (WhatsApp, Instagram, Messenger, and TikTok) is retained only as long as necessary to provide the messaging features it supports. When a gym disconnects a platform integration, associated platform data is deleted or de-identified within a reasonable period, unless we are required to retain it for legal, billing, or dispute-resolution purposes as described above.

Members and gym administrators may request deletion of personal data, subject to retention obligations described above.

6. Data Security

We implement technical and organizational measures to protect personal data, including encryption of data in transit (TLS) and at rest, encrypted authentication (OTP/TPIN, hashed credentials), role-based access controls scoped to the Brand → Company → Location hierarchy, and regular review of security practices for our connected platform integrations (including TikTok, Meta, and other third-party APIs). Should a data breach affecting your personal information occur, we will notify affected users and relevant authorities as required by applicable law. No system is completely secure; we cannot guarantee absolute security of information transmitted to or from the Service.

7. Your Rights

Depending on your location, you may have rights to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing
• Withdraw consent for marketing communications
• Request a copy of your data in a portable format

To exercise these rights, contact us at info@premiersports.pk.

8. International Users and Data Storage

Gympanels is operated by Premier Sports Group, headquartered in Pakistan. We store and process personal data on a regional basis to help meet applicable data protection requirements:

• Personal data subject to the UK/EU General Data Protection Regulation (GDPR) is stored on infrastructure located in the United Kingdom.
• Other regions may be served by dedicated, regionally located database infrastructure to help meet applicable local data residency expectations.
• Where data is transferred internationally — including to the sub-processors and service providers listed in Section 4 — we rely on appropriate safeguards, such as standard contractual clauses or equivalent mechanisms required by applicable law.

By using the Service, you consent to the processing of your information as described in this section.

9. Children’s Privacy

The Service is not directed to individuals under 16. Gym memberships for minors must be registered and managed by a parent or legal guardian, who is responsible for the accuracy of the minor’s data. Consistent with TikTok’s Business Product Terms, we do not knowingly collect, share, or process data relating to minors through our TikTok integration.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email. Continued use of the Service after changes take effect constitutes acceptance.

11. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact:

Premier Sports Group
Email: info@premiersports.pk
Address: DHA Lahore, Pakistan

Gym Panels is owned by Premier Sports Group.