Sub-processors and Data Processing Agreement
Last updated: October 22, 2026
Who is responsible for what
For your own Trainzilla account we are the data controller. For the information you keep about your clients or members (plans, check-ins, progress, notes), you are the controller and Trainzilla is your processor. Our Privacy Policy explains this in full.
Trainzilla is operated by TrainZilla India Pvt. Ltd., Pune, India.
Where your data is stored
- Database: MongoDB Atlas, Mumbai, India.
- Application servers: Chennai, India.
- Uploaded files: Amazon Web Services, Sydney, Australia.
We do not currently host data in the EU or UK.
Sub-processors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| MongoDB Atlas | Main database | All account, coaching and payment-record data | Mumbai, India |
| Amazon Web Services (S3) | File storage | Photos, videos, documents and reports you upload | Sydney, Australia |
| Application server host | Runs the Trainzilla API | All data in transit through the service | Chennai, India |
| Razorpay | Payments and subscriptions to Trainzilla | Name, email, amount, currency, payment reference (no full card numbers reach us) | India |
| Apple, Google (incl. Firebase) | In-app purchases, app distribution, push notifications, crash reports | Device identifiers, purchase status, crash diagnostics | United States / global |
| Google (Gemini), OpenAI, Anthropic | AI drafting of plans and answers | The plan, check-in and profile data needed for the draft, under business API terms that do not allow training on it | United States |
| Google (Gmail) or Amazon SES | Sending service emails | Recipient email, message content | Global |
| Google Analytics, Meta Pixel | Website analytics and ad measurement (website visitors only, with consent where required) | Cookie identifiers, pages viewed | United States / global |
| Netlify, Cloudflare | Website hosting, content delivery and security | IP address, request metadata | Global |
| ipapi.co | Approximate country from IP, to show the right language and currency | IP address | Global |
What our Data Processing Agreement covers
If you coach or run a gym with clients in the EU, UK or Switzerland, you can ask us for a signed Data Processing Agreement. In summary:
- We process your clients’ personal data only on your documented instructions, which are your use of Trainzilla and your settings in it.
- People at Trainzilla with access to that data are bound by confidentiality, and access is limited to what they need.
- We protect the data with encryption in transit (HTTPS), access controls and secure sign-in.
- We use only the sub-processors listed on this page. When we add or replace one, we update this page and its date.
- We help you answer access, correction and deletion requests from your clients.
- We tell you without undue delay if we learn of a breach affecting your clients’ personal data.
- When you delete your account, or ask us to, we delete or anonymise personal data within 30 days. Invoices and payment records we must keep by law are kept for up to 8 years.
- Transfers of EEA, UK or Swiss personal data outside those regions rely on the European Commission’s Standard Contractual Clauses and the UK Addendum.
Request a DPA
Email support@trainzilla.in with your business name and country. This page is a summary, not the agreement itself.