Endorfins Fitness Clubs Pvt. Ltd. (operating the "Cretos" mobile application, club management systems, and our physical fitness clubs, collectively referred to as "Cretos", "Endorfins", "we", "us", or "our") is committed to safeguarding your personal data and respecting your privacy. This Privacy Policy describes how we collect, handle, store, and protect your information across our mobile app, websites, and fitness facilities.
1. Company Identity & Applicability
This Privacy Policy applies to all members, visitors, and users who register on the Cretos mobile application, visit our website at www.thecretos.com, purchase memberships, personal training packages, recovery physiotherapy sessions, or order meals from the Cretos Cafe.
Legal Entity: Endorfins Fitness Clubs Pvt. Ltd.
Registered Office: 213, Skye Privilon, Nipania, Indore, Madhya Pradesh, India
Website: www.thecretos.com
Contact Email: endorfinsfitness@gmail.com
2. Information We Collect
We collect information necessary to provide high-quality fitness coaching, facility access, nutrition ordering, and seamless club management:
Full name, mobile phone number, email address, date of birth, gender, emergency contact details, and profile avatar.
Height, weight, target fitness goals, workout logs, body transformation photos, and physical injury notes shared for physiotherapy.
Club check-in history, personal trainer (PT) sessions, recovery physiotherapy appointments, and cafe meal tokens.
Order IDs, transaction identifiers, payment status, GST billing details, and loyalty reward tokens. (Card/UPI credentials processed by Razorpay).
Device OS, model, IP address, app version, and Firebase Cloud Messaging (FCM) tokens for workout reminders and notifications.
Direct chat messages exchanged with assigned trainers, support tickets, feedback, and customer service inquiries.
3. How We Use Your Information
We process your personal information strictly for legitimate fitness and operational purposes:
- Membership & Access Control: Verifying entry at our fitness clubs, managing active plans, and issuing digital member badges.
- Coaching & Personal Training: Enabling certified trainers to design customized exercise routines, assess progress, and track workouts.
- Recovery & Physiotherapy: Scheduling therapy sessions, maintaining assessment notes for injury rehabilitation, and ensuring physical safety.
- Cretos Cafe & Nutrition: Processing kitchen orders, validating healthy meal passes, and managing pickup queues.
- Secure Payments: Facilitating membership dues, PT packages, cafe orders, and automated refunds via Razorpay.
- Push Notifications & Reminders: Delivering workout alerts, session booking confirmations, payment receipts, and club announcements.
- Legal & Tax Compliance: Maintaining GST tax invoices, audit trails, and responding to lawful requests by authorities.
4. Payments & Financial Security
We do not store your credit card numbers, debit card details, CVV, or UPI PIN on our servers. All financial transactions are securely processed through Razorpay, an authorized payment gateway compliant with the Payment Card Industry Data Security Standard (PCI-DSS). Razorpay securely tokenizes payment methods and ensures end-to-end encrypted financial communications.
5. Data Sharing & Third-Party Disclosures
We respect your trust. We do not sell, rent, or trade your personal data to any advertisers or third-party brokers. Data is shared only with trusted service partners under strict confidentiality agreements:
| Recipient / Provider | Purpose | Data Shared |
|---|---|---|
| Razorpay | Payment processing, subscriptions, and refunds | Transaction amount, contact phone/email, Order ID |
| Google Firebase (FCM) | Push notifications for workouts, reminders & cafe orders | FCM Device Token, notification title & body |
| Club Staff & Assigned Trainers | Delivering personal training & physiotherapy sessions | Member name, fitness goals, exercise logs, recovery notes |
| Statutory / Tax Authorities | GST and statutory corporate audit compliance | Tax invoices, transaction logs (as legally required) |
6. Data Security Measures
We employ robust technical and organizational safeguards to prevent unauthorized access, alteration, or disclosure of your personal data:
- Encryption: All data transmitted between the Cretos mobile app and our backend servers is encrypted using Transport Layer Security (TLS 1.2/1.3 / HTTPS).
- Authentication: Secure JSON Web Token (JWT) based session management and role-based access control (RBAC).
- Database Isolation: Production databases are protected within secure private subnets with automated backups.
- Physical Security: Club check-ins and member records are restricted to authorized front-desk and managerial staff.
7. Data Retention & Account Deletion
We retain your profile data as long as your membership or user account remains active. If you discontinue using our services, you may request full account and data deletion at any time:
- Public Deletion Portal: You can submit an account deletion request without needing the app installed by visiting our Delete Account Request Page.
- What is Deleted: Your profile details, phone number, workout history, health metrics, active FCM push tokens, and loyalty points are permanently erased or anonymized.
- Statutory Retention: Past invoices, GST transaction records, and Razorpay payment reference IDs are retained for the statutory period required under Indian taxation and corporate laws.
8. Your Legal Rights
Under applicable Indian data protection regulations, you hold the following rights regarding your information:
- Right to Access: View the personal data and workout metrics linked to your profile in the app.
- Right to Rectification: Correct inaccurate or outdated phone numbers, email addresses, or health parameters.
- Right to Eradication: Request complete account and data removal via our deletion portal or email.
- Right to Withdraw Consent: Disable push notifications or revoke optional fitness tracking permissions via device settings.
9. Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our club services, operational practices, or statutory legal requirements. When updates are published, the revised date at the top will be updated, and active app users will be notified for material changes.
10. Grievance Officer & Contact Details
In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact details of our Grievance Redressal Officer are provided below: