Privacy Policy

Company details are pending confirmation. Registration of DVelis Technologies as a company is in progress. Items marked Pending confirmation (such as the registered legal entity name, registration number and registered address) are not yet final and will be updated on this page once confirmed.

1. Who we are

This Privacy Policy is issued by DVelis Technologies ("DVelis", "we", "us" or "our"), the provider of GymFlow. GymFlow is a software-as-a-service (SaaS) platform that helps gyms and fitness businesses manage members, memberships, attendance, payments, follow-ups and member communication.

Registered legal entity name: Pending confirmation Registered legal entity name (company registration in progress)
Company registration number: Pending confirmation Registration number (to be issued on registration)
Registered address: Pending confirmation Registered office address
Privacy contact: Our website contact form, as described in section 16.

2. Scope and our role

This policy applies to information processed through:

the GymFlow application used by gym owners, administrators and staff ("Gym Customers");
information about gym members and prospective members ("Members") that Gym Customers store in, or send messages through, GymFlow, including through the GymFlow member portal;
the WhatsApp Business integration that lets a Gym Customer connect its own WhatsApp Business account to GymFlow through Meta Platforms; and
this website (dvelis.com), including the enquiry form.

Member information. Each gym decides which Member information to add to GymFlow and how it communicates with its Members. For that information, we process data on behalf of, and according to the instructions of, the gym. The gym is responsible for having a valid basis (such as consent where required) to collect Member information and to message its Members. Members should contact their gym first with questions about how the gym uses their information.

Gym Customer account information. For information about Gym Customers themselves (for example, account, subscription and support information), we decide how that information is used, as described in this policy.

3. Information we collect

From Gym Customers

Account and contact details: gym or business name, branch details, administrator and staff names, phone numbers, email addresses and login credentials. Passwords are stored as one-way hashes.
Business configuration: membership plans and pricing, staff roles and branch access, message templates and automation settings.
Subscription records: plan, subscription status, invoices and payments recorded against the GymFlow subscription.
Support communications: messages you send us and our replies.

About Members (entered by the gym or by the Member)

name, phone number (including WhatsApp number), email address and similar contact details;
membership details such as plan, start and expiry dates, renewals and status;
attendance and check-in records;
payment records and outstanding balances recorded by the gym;
follow-up notes and other information the gym chooses to record;
WhatsApp consent and opt-out records (see section 8); and
a log of notifications the gym has sent or scheduled, including the message text.

We ask gyms not to store sensitive information (such as detailed health or medical information) in GymFlow unless it is necessary and they have any consent required by law.

Technical and usage information

When GymFlow is used, our servers and hosting provider may process technical data such as IP address and browser type, for example to route requests and limit abuse. GymFlow also keeps an audit log of important actions (for example, connecting or disconnecting WhatsApp, or OTP sign-in events). We use this to operate, secure and troubleshoot the service.

4. WhatsApp Business integration data

A Gym Customer may choose to connect its own WhatsApp Business account to GymFlow. The connection is authorised by the Gym Customer through Meta's own sign-in and permission screens (Embedded Signup), or by entering its WhatsApp Business Platform details. The WhatsApp Business account remains owned and controlled by the Gym Customer. When connected, we process the following information through Meta's WhatsApp Business Platform:

Meta account identifiers: the WhatsApp Business Account (WABA) ID and the session and request identifiers that Meta returns during Embedded Signup.
Phone number identifiers: the phone number ID assigned by Meta, the display phone number, the verified business name, and status information provided by Meta (such as quality rating and verification status).
Access credentials: the access token issued by Meta that lets GymFlow send messages and manage templates for that account. It is encrypted before it is stored and is never shown in full in the application.
Message templates: template names, categories, languages, content and approval status synchronised with Meta.
Message records: for each WhatsApp message, the message ID assigned by WhatsApp, the template and category used, status and timestamps, and the pricing information Meta reports. In these records the recipient's number is stored as a one-way keyed hash together with its last four digits, not as the full number.
Webhook events: notifications Meta sends to our systems, including message status updates (sent, delivered, read, failed) and error codes, incoming messages, template status changes and account updates. We store only the fields needed to process each event. We do not store the full event payload or the text of incoming messages. Incoming messages are checked for opt-out keywords and to track WhatsApp's customer service window.

We use this information only to provide the WhatsApp features of GymFlow to the Gym Customer that connected the account. That includes sending messages, showing delivery status, handling opt-outs, showing usage, troubleshooting and preventing misuse. We do not sell this information or use it for advertising.

5. How we use information

We use information to:

provide, operate and maintain GymFlow for Gym Customers;
manage member records, memberships, attendance, payments, follow-ups and reports as instructed by the gym;
send messages and notifications that the gym has configured or triggered;
authenticate users and protect accounts (see section 7);
provide customer support and respond to requests;
monitor, secure and improve the service, including detecting fraud, abuse, spam and security incidents;
manage GymFlow subscriptions; and
comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use Member information for our own marketing.

6. Message delivery and notification processing

GymFlow can send WhatsApp messages on behalf of a gym. Examples include welcome messages, membership expiry and renewal reminders, outstanding payment reminders, class reminders, birthday greetings, announcements and other messages the gym sets up. Automated messages follow the gym's settings, such as quiet hours and daily limits.

To deliver a message, we:

check that the Member has the required consent and has not opted out;
prepare the message from the gym's approved template and the relevant Member details;
send it to Meta's WhatsApp Business Platform from the gym's connected number;
record the message ID and the status updates Meta returns through webhooks; and
show delivery status to the gym and flag messages that failed.

WhatsApp/Meta performs the actual delivery, and it is subject to Meta's policies and the recipient's device and settings. We cannot guarantee that every message will be delivered or read.

7. OTP and authentication processing

Members can sign in to the GymFlow member portal with a one-time passcode (OTP) sent by WhatsApp using an authentication message template. The OTP is sent from the gym's connected WhatsApp number or, where that is not available, from a DVelis WhatsApp number. To do this we process the Member's phone number, the OTP, when it was issued, and whether verification succeeded or failed.

OTPs are used only for sign-in and verification, never for marketing.
OTPs are stored only as one-way hashes, never as the readable code.
By default an OTP expires after 5 minutes, works only once, and is locked after 5 incorrect attempts. A short wait applies before a new code can be requested.
OTP sign-in events are recorded in the audit log for security.

Never share an OTP with anyone. DVelis and your gym will not ask you to read out or forward an OTP.

10. Data security and access restrictions

We use technical and organisational measures intended to protect information against unauthorised access, loss or misuse. These include:

separating each gym's data, so a gym's users can access only their own gym's records;
role-based access within a gym (for example, administrator and staff roles, and branch restrictions), controlled by the gym's administrator;
encrypting Meta access tokens before storage, and keeping them and other secrets on the server side, never in browser code;
storing passwords and OTPs only as one-way hashes, and recipient numbers in WhatsApp message records as keyed hashes;
checking Meta's cryptographic signature on every webhook event before processing it;
an audit log of security-relevant actions; and
limiting DVelis staff access to customer data to what is needed for support, maintenance, security or legal reasons.

No system is completely secure. DVelis does not currently hold any third-party security or privacy certification, and nothing in this policy claims one. If we become aware of a security incident affecting personal information, we will take steps to contain it and will notify affected gyms, and others where required by law.

11. Retention and deletion

We keep information only for as long as it is needed for the purposes in this policy:

Gym Customer and Member records are kept while the gym's GymFlow account is active. When a gym deletes a Member in GymFlow, the record is archived (hidden and made inactive). Permanent deletion can be requested as described on our Data Deletion page.
WhatsApp access credentials are destroyed when the gym disconnects WhatsApp. The remaining account identifiers are kept as connection history until the gym asks us to delete them or its account is deleted.
Message records, webhook event records, OTP records and audit logs are kept for delivery reporting, security, troubleshooting and abuse prevention. Pending confirmation Retention periods for message, webhook, OTP and audit records
Backups may contain deleted information until they are overwritten in the normal backup cycle. Pending confirmation Backup retention period

We may keep certain information for longer where we must by law (for example, subscription invoices and tax records), or to resolve disputes, prevent fraud or enforce our agreements. When information is no longer needed, we delete or anonymise it.

12. Your privacy rights

Depending on where you live and the law that applies, you may have the right to:

access the personal information held about you;
correct inaccurate or incomplete information;
request deletion of your information;
withdraw consent or opt out of messages;
object to or restrict certain processing; and
raise a complaint with a data protection authority.

Members: because your gym controls your Member records, please send requests to your gym first. If you cannot reach your gym, contact us using the procedure below. We will pass your request to the gym and help them respond where we can.

Gym Customers: contact us using the procedure below.

We verify requests before acting on them, to protect your information from unauthorised requests. Governing law and jurisdiction for this policy: Pending confirmation Governing law and jurisdiction

13. Children's information

GymFlow is a business tool for gyms and is not directed at children. If a gym registers a Member who is a minor, the gym is responsible for obtaining any consent from a parent or guardian required by law before adding the minor's information or messaging them.

14. This website

If you submit the enquiry form on dvelis.com, we receive the name, business name, phone number, email address and message you provide. We use this only to respond to your enquiry. The form is processed on our server and delivered to us by email.

This website does not use advertising or analytics cookies. Our hosting provider may process technical data such as IP address to deliver and protect the website.

15. Changes to this policy

We may update this policy, including when DVelis company registration is complete and the details marked as pending above are confirmed. We will post the updated version on this page with a new "Last updated" date. Where changes are significant, we will also inform Gym Customers directly.

16. How to contact us

To ask a question, exercise a privacy right or make a complaint, contact us through the enquiry form on our website:

Go to the contact form on dvelis.com.
In "Business Name", enter your gym's name (Members: the gym you are a member of).
Start your message with "Privacy request" and describe what you are asking for.
Use the phone number and email address linked to your account or Member record, so we can verify the request.

For deletion requests, see our Data Deletion page.