Privacy Policy

1. Introduction

ClassFlow ("ClassFlow," "we," "us," or "our") respects your privacy and is committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you use our website, mobile applications, and services (collectively, the "Services") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

Two different relationships are described in this policy, and the difference matters. When you visit our website, contact us, or subscribe to ClassFlow as a studio, we determine how your information is used and we are responsible for it directly. When a studio uses ClassFlow to manage its own members, the studio decides what member information to collect and why, and ClassFlow processes that information on the studio's behalf and under its instructions. If you are a member of a studio and want to exercise a right over your information, contact your studio first; we will support them in responding.

For technical detail on where data is stored, who can access it, our subprocessors, and what we do and do not claim, see our Security and Data Protection page.

2. Information We Collect

We collect several types of information from and about users of our Services:

2.1 Personal Information

• Name, email address, phone number, and mailing address
• Payment information (processed securely through Stripe)
• Business information (studio name, location, etc.)
• Account credentials

2.2 Usage Information

• Information about how you use our Services
• Device information (IP address, browser type, operating system)
• Log data and analytics

2.3 Member Data

If you are a studio using our Services, you may upload information about your members. You are responsible for obtaining appropriate consent from your members for this data collection and use.

3. How We Use Your Information

We use information that we collect about you or that you provide to us:

• To provide, maintain, and improve our Services
• To process transactions and send related information
• To send you technical notices, updates, and support messages
• To respond to your comments, questions, and requests
• To communicate with you about products, services, and events
• To monitor and analyze trends, usage, and activities
• To detect, investigate, and prevent fraudulent transactions
• To personalize and improve your experience

4. Information Sharing

We may share your personal information in the following situations:

• Service Providers: With vendors, consultants, and other service providers who need access to such information to carry out work on our behalf (including Stripe for payment processing, Supabase for database services, Cloudflare for web hosting and delivery, and communications providers when those services are enabled)
• Legal Requirements: If required to do so by law or in response to valid requests by public authorities
• Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business
• With Your Consent: In any other cases with your explicit consent

A current list of our subprocessors, including what each one does and what data it receives, is published on our Security and Data Protection page.

We do not sell studio or member data, and we do not share it with advertising platforms. Information that studios and their members enter into the ClassFlow application is used to operate the Services for that studio. It is not sold, rented, or disclosed to advertisers or data brokers, and it is not used to build cross-context advertising profiles.

Separately, our public marketing website uses analytics and advertising technologies to measure how visitors find us, described in the Cookies and Tracking section below. Under some state privacy laws, that activity can be treated as "sharing" personal information for cross-context behavioral advertising. This applies to website visitors, not to member records inside the application. You can opt out by using your browser's Global Privacy Control signal or by emailing us at info@classflow.studio.

5. Data Security

We implement appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. We use technical and organizational safeguards intended to protect information in light of the nature of the data and the Services.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention and deletion timing can vary by data type, backup lifecycle, contractual obligation, and applicable law. You may request deletion using the contact information below.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Opt-out: Opt out of marketing communications

To exercise these rights, please contact us at info@classflow.studio. We will not discriminate against you for exercising a privacy right. If you are a member of a studio rather than a studio subscriber, please contact your studio, which controls its own member records; we will assist the studio in responding.

7a. State Privacy Rights

Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and others, may have rights to know what personal information is collected about them, to access or receive a copy of it, to correct it, to delete it, to opt out of its sale or its use for targeted advertising, and to limit the use of sensitive personal information. Depending on the state, you may also have a right to appeal a decision we make about your request.

For California residents specifically, the categories of personal information we collect, the purposes for which we use them, and the categories of third parties with whom we share them are described in the Information We Collect, How We Use Your Information, and Information Sharing sections above. We do not sell personal information for money. We do not knowingly collect or sell the personal information of individuals under 16.

You may submit a request, or appeal a decision on a request, by emailing info@classflow.studio with the nature of your request and the state you reside in. We may need to verify your identity before responding, and we will respond within the timeframe your state's law requires. An authorized agent may submit a request on your behalf with proof of authorization.

7b. Health and Injury Information

Studios may record notes about a member's injuries, pregnancy, or movement restrictions so that instructors can safely program a class. Where that information is collected, the studio decides what to collect and is responsible for obtaining any consent its state requires. ClassFlow stores it on the studio's behalf.

Information of this kind is treated as sensitive. It remains scoped to the studio that collected it, is governed by that studio's staff roles, can be restricted to administrators, and is never used for advertising, never shared with advertising platforms, and never sold. ClassFlow is not designed as a healthcare system of record, does not act as a HIPAA business associate, and does not offer a business associate agreement.

7c. Email and Text Message Communications

ClassFlow delivers email and SMS on behalf of studios. Text messages are sent under the studio's own registered sender identity, and the studio is responsible for how it collects consent from its members. ClassFlow records consent for each phone number, keeping transactional consent for class reminders, cancellations, and waitlist notices separate from consent to receive marketing, along with the source and time each consent was recorded.

You can stop marketing email by using the unsubscribe link in any marketing message, and stop text messages by replying STOP to any message. Opt-out requests are honored across the platform. We may still send transactional messages necessary to your account or a booking you made. Message and data rates may apply.

7d. Security Incidents

If we became aware of a security incident affecting personal information we hold, we would notify affected studios without undue delay, describe what information was involved, and support each studio in providing any notice its members are owed under applicable law. Because a studio's members are that studio's customers, notice to members is provided by the studio, and ClassFlow supplies the facts and affected records needed to make it.

8. Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our Services and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. We use essential cookies for authentication and preferences, and analytics cookies to understand how our Services are used.

On our public marketing website we also use advertising and measurement technologies, including Google Tag Manager and Meta advertising tools, to understand which campaigns bring studios to us. Refusing non-essential cookies does not affect your ability to use the ClassFlow application. We honor the Global Privacy Control signal where your browser sends it, and we do not use advertising or measurement technologies inside the studio application on member records.

9. Children's Privacy

ClassFlow is not directed to children acting as independent account holders. Studios may use the Services to manage classes or services involving minors and may provide us with information about those participants at the direction of a parent, guardian, or authorized studio. Studios are responsible for obtaining the permissions required for that information. Parents or guardians may contact us with questions or requests.

10. International Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. If you are located outside the United States, please be aware that information we collect will be processed and stored in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: