Solid Chat with us

Privacy Policy

What Solid collects, why, who sees it, how long it is kept, and how you control it.

In force from 9 October 2026. Last updated 9 October 2026.

1. Who we are

Mettle Labs Private Limited ("Solid", "we", "us"), of 222, Park Road, Laxman Chowk, Dehradun, Uttarakhand 248001, runs Solid, Solid for Gyms, and this website. This policy explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 and the rules made under it.

  • For your Solid account and what you do in the Solid app, Solid decides how your data is used, and is responsible for it.
  • A gym that uses Solid for Gyms keeps its own register of members, visits, payments, and staff. The gym decides what it records and why. Solid stores and processes that data for the gym, under the gym's instructions and this policy. You can ask the gym, or us, about what it keeps.

2. What we collect

  • Your account: your mobile number, your name, and a photo if you add one.
  • What a gym records about its members: name, mobile number, photo, plans and passes, payments and dues, receipts, check-ins, an emergency contact, documents, the gym's waiver you accepted, and notes the gym adds. For a member under 18, a parent's or guardian's name, number, relation, and consent.
  • Gym owners and staff: name, mobile number, role and access, the shifts and attendance the gym records, and the gym's business details: its name, addresses, GSTIN, PAN, the documents it uploads to be verified, and its bank account for payouts. Solid keeps only the last four digits of the account number; the full number goes straight to Cashfree.
  • Payments: for a payment through Solid, the amount, what it was for, its status, and Cashfree's reference. Solid never sees or stores your card number, CVV, bank login, or UPI PIN.
  • Location: only while you use the app, and only if you allow it, to show gyms near you. The place you choose is kept on your phone. We do not track your location in the background or keep a history of where you have been.
  • Messages: what you write to Solid's support, enquiries you send a gym, and reviews you post.
  • Your device: a token for push notifications, the app's version, and crash reports and usage events (which screens are used, and what fails), tied to a random account number, never to your name or phone number.
  • Sign-in protection: before a sign-in code is sent, Cloudflare Turnstile checks that a person is asking, from signals it reads on your device.
  • This website sets no cookies and loads nothing from anyone else. Its Solid Pay page loads Cashfree's checkout to take your payment.

3. Why we use it

  • To run Solid: your account and sign-in, a gym's register, check-ins, receipts, dues, and payouts.
  • To take payments for gyms, pay gyms out, and keep the receipts, invoices, and tax records the law requires.
  • To send what you need: sign-in codes by SMS or WhatsApp, and receipts, reminders, and alerts by push notification or WhatsApp. A gym's promotional messages go out only as the law and your choices allow.
  • To keep Solid safe, by stopping fake visits, misuse of sign-in codes, and fraud.
  • To fix and improve Solid, from crash reports and counts of how it is used.
  • To answer you when you write to us, and to meet our legal obligations.

We use your data with your consent, given when you sign up or when a gym records you with your agreement, and for the legitimate uses the law allows, such as meeting a legal obligation. You can withdraw your consent at any time (section 7). What was done before stays lawful, and some features may stop working.

4. Who we share it with

  • Your gym sees what it needs to serve you: your name, photo, plan, payments, and check-ins at that gym. It never sees your card or bank details, or which other gyms you visit.
  • Everyone can see a gym's public page: its name, address, photos, prices, hours, and ratings.
  • Our service providers, who process data only for us, under contract:
    • Supabase: our database, sign-in, and file storage, hosted in Mumbai, India
    • Cashfree Payments: payments, refunds, Autopay, and gyms' payouts
    • MSG91: SMS and WhatsApp messages, with Meta delivering WhatsApp's
    • Apple, Google, and Expo: push notifications, and Google's maps in Solid for Gyms
    • Sentry and PostHog: crash reports and usage analytics, hosted in the European Union
    • Cloudflare: this website and the sign-in check
    • Zoho: our email
  • Authorities, when the law requires it, such as the tax authorities, or a court or the police with a lawful request.
  • If Solid's business is ever sold or merged, your data moves with it, under this policy.

We do not sell personal data, and we do not share it with advertisers.

5. Where it is kept

Solid's data is stored in India, in Mumbai. Crash reports and usage analytics are processed in the European Union, and some of the providers above may process data outside India, as the law permits.

6. How long we keep it

  • Your account: while it is open. When you ask us to delete it, we erase it within 30 days, except what the law requires us to keep.
  • A member a gym removes from its register: the emergency contact is erased after 30 days, and the name, number, photo, and notes after 90 days. Plans, visits, and payments stay without them, for the gym's figures and accounts.
  • Receipts and tax records: as long as GST law requires, which is 72 months from the due date of the annual return for their year. The buyer's name on a receipt, and the payment messages from Cashfree, are erased after that.
  • An enquiry to a gym: 12 months after it is closed.
  • A conversation with Solid's support: what was written, 24 months after it is resolved.
  • Records of how the Solid app is used: 180 days.

A job runs each night to erase what has reached its time. Erased data can remain in backups until those backups expire.

7. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

  • get a summary of your personal data, and of who it has been shared with;
  • have it corrected, completed, or updated;
  • have it erased, unless the law requires us to keep it;
  • withdraw a consent you gave;
  • name someone to use these rights for you if you die or cannot use them yourself;
  • have a complaint answered.

Write to privacy@solidgyms.com with your mobile number. We confirm it is you before we act, acknowledge your request within 48 hours, and answer it within 30 days. For what a gym keeps, you can also ask the gym. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

8. Children

Solid accounts are for people 18 and older. A gym can keep a record of a member under 18 only after a parent or guardian agrees, and Solid keeps the words they agreed to with the record. We do not track children or show them advertising.

9. Keeping it safe

Data travels encrypted. Each person at a gym sees only what their role allows, which the database itself enforces. Sign-in uses one-time codes behind a human check, and full bank account numbers are not stored. No system is perfectly secure: if a breach affects you, we will tell you, and the Data Protection Board, as the law requires. To report a security problem, write to security@solidgyms.com.

10. Changes to this policy

We may update this policy. The date at the top shows the version in force. If a change matters to you, we tell you in the app or by message before it applies.

11. Contact and grievances

Grievance Officer: Pratyaksh Gupta, Founder, Mettle Labs Private Limited, 222, Park Road, Laxman Chowk, Dehradun, Uttarakhand 248001. Email privacy@solidgyms.com, or call +91 79064 04128.