Privacy Policy

1. Our two roles

We handle personal data in two different roles:

• As a controller: for data about the people who run studios on StudioVita (studio owners, admins and staff with portal logins), people who start a trial or contact us, and visitors to studiovita.app. We decide how this data is used.
• As a processor: for data about a studio's members (for example class bookings, memberships and payments in the member app). Here the studio is the controller and we only process the data on its instructions, under our Data Processing Agreement (studiovita.app/dpa). If you are a member of a studio, please contact your studio first about your data. We will pass on any request we receive to the studio and help them respond.

2. Data we collect

Studio accounts and trial sign-ups: name, business name and type, email address, phone number, login details (passwords are stored only as secure hashes), subscription plan and billing history (card details are handled by Stripe and never reach us), and support messages you send us.

Website visitors and enquiries: the details you enter in the contact form (studio name, email, message). If enabled, we use Plausible Analytics, which is cookieless and records only aggregated, anonymous visit statistics (page, referrer, country, device type). It does not identify you or track you across sites.

Studio members (processed for the studio): identity and contact details (name, email, phone, address, date of birth), emergency contact details, membership and plan details, class bookings, waitlist and attendance records, payment history and status (card details are handled by Stripe), notifications and messages from the studio.

Technical data: IP address, browser and device type and login times, used to keep the service secure. Our server logs record the request path, status and timing, not the content of requests or responses.

3. Why we use your data and our legal basis (for data we control)

• To provide your studio account, trial and subscription: performance of a contract.
• To bill your subscription and keep financial records: performance of a contract and legal obligation.
• To answer enquiries and provide support: our legitimate interests in responding to you, or steps you asked for before entering a contract.
• To keep the platform secure, prevent fraud and abuse, and fix faults: our legitimate interests.
• To send service and account emails (for example trial reminders and receipts): performance of a contract.
• To send occasional product news to studio business contacts: our legitimate interests. You can opt out at any time using the link in the email or by contacting us.
• Anonymous website statistics: our legitimate interests in understanding how the site is used. No personal data is involved.

We do not sell personal data, and we do not use it for advertising.

4. Who we share data with (sub-processors)

We use a small number of service providers, each bound by a data processing agreement:

• Replit, Inc. (USA): application hosting, database and file storage. Transfers protected by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Stripe (Stripe, Inc., USA, and Stripe Payments Europe Ltd, Ireland): subscription and member payments. Stripe participates in the EU-U.S. Data Privacy Framework (and UK Extension) and also uses Standard Contractual Clauses.
• Resend (USA): transactional email. Resend participates in the EU-U.S. Data Privacy Framework (and UK Extension) and uses Standard Contractual Clauses.
• Plausible Insights OÜ (EU, servers in Germany): cookieless website statistics, public pages only, when enabled. No data leaves the EU.

We may also disclose data if required by law, or to a buyer of our business, who would be bound by this policy. The current sub-processor list is kept in our DPA at studiovita.app/dpa.

5. International transfers

We are based in the UK, which the EU recognises as providing adequate protection, so data can flow from EU studios to us without extra safeguards. Some of our providers store data in the United States. Where that happens we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, where the provider is certified, the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for a copy of the relevant safeguards.

6. Cookies

We use only strictly necessary cookies: a session cookie that keeps you logged in, and a security token that protects forms against cross-site request forgery. We use no tracking, advertising or third-party analytics cookies, so we do not show a cookie banner.

7. How long we keep data

• Studio accounts: for as long as the account is active. After a subscription ends, studio and member data stays available for export for 30 days and is then permanently deleted.
• Member accounts: when a member asks to delete their account, it is permanently deleted after a 30-day grace period, unless the studio must keep certain records.
• Our own billing and accounting records: 6 years from the end of the financial year they relate to, as required by UK law.
• Enquiries and support messages: up to 24 months after the last contact.
• Backups are overwritten on a rolling basis, so deleted data disappears from them over a short period.

8. Your rights

Under the UK GDPR and the EU GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw consent where we rely on consent. To use these rights, email support@studiovita.app. We will reply within one month. If you are a studio member, we will refer your request to your studio, which is responsible for it.

You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU you can contact the authority in the country where you live or work, for example Integritetsskyddsmyndigheten (IMY, imy.se) in Sweden. We would appreciate the chance to resolve your concern first.

9. Children

StudioVita is a business tool and is not aimed at children. Some studios have members under 18. In that case the studio, as controller, is responsible for having a lawful basis and any necessary parental consent.

10. Security

We protect data with encrypted connections (HTTPS/TLS), passwords stored only as bcrypt hashes, strict separation of each studio's data, role-based access controls, rate limiting, protection against cross-site request forgery, and encryption at rest provided by our hosting infrastructure. If a personal data breach affects you, we will notify the studio, the authorities and you where the law requires.

11. Changes to this policy

We will post any changes here and update the date above. If the changes are significant we will tell studio account holders by email before they take effect.

12. Contact

Freddie Media Ltd, 85 Great Portland Street, London W1W 7LT, United Kingdom. Email: support@studiovita.app