Privacy policy

From Studios:business legal name, tax IDs, billing email, business address, contact details (bank details go to Stripe, not to us), the studio's configuration on the Platform (class types, schedule, pricing).

From Clients:name, email, phone, optional address, marketing-consent flags, booking history, payment records via Stripe, optional health/safety notes provided to the Studio (kept only with the Client's explicit consent, given when the notes are saved), and messages sent to Refi, the Studio's AI assistant.

Automatically: log data (IP, user-agent, access timestamps) for security and rate-limiting purposes. Retained for 30 days unless an incident requires longer retention.

• Provide the booking, payment and admin functionality of the Platform.
• Send transactional emails (booking confirmation, reminders, cancellations).
• Facilitate payments via Stripe (Studios collect through their own Stripe accounts; Stripe pays them out directly).
• Answer questions through Refi, the AI assistant on booking pages and in the Studio admin. Messages and the booking context needed to answer them are processed by our AI provider, Anthropic (see the sub-processors).
• Detect and prevent abuse and fraud.
• Comply with legal obligations (tax records, regulatory requests).

We do not sell or share personal data with third parties for their own marketing purposes.

We rely on the following legal bases under GDPR Article 6:

• Contract: processing necessary to provide the Platform to Studios and Clients.
• Legal obligation: tax and accounting records.
• Legitimate interest: abuse prevention, service improvement.
• Consent: marketing emails / WhatsApp / SMS where the Client has explicitly opted in.
• Explicit consent (GDPR Article 9): health notes a Client chooses to share with the Studio. The Client can withdraw it at any time by clearing the notes on their account page.

The Platform uses strictly-necessary cookies for authentication (Supabase session) and CSRF protection. No advertising cookies are set, and we do not use any cross-site tracking.

For visitor statistics we use Fathom Analytics, which sets no cookies and does not track anyone across websites. It counts page views and, per Fathom, derives a temporary site-specific signature that rotates daily rather than storing a raw IP address alongside browsing activity. For visitors in the EU, Fathom strips the IP address inside the EU before the request reaches its US infrastructure; the resulting anonymised counts are stored on Fathom's US servers. We cannot identify an individual from this data, and no consent banner is required for it.

Listed in our Data Processing Agreement.

You may exercise the GDPR rights of access, rectification, erasure, portability, restriction of processing and objection. Clients can download their data and delete their account themselves from their account page. For anything else, Clients should contact their Studio first; we will help the Studio fulfil the request. Studios may contact us directly.

Active account data: for as long as the Studio uses the Platform plus 90 days. Payment records: 7 years (Dutch tax law). Backups: up to 12 months. Audit logs: 12 months.

Data is processed within the European Economic Area where possible. Some sub-processors operate outside the EEA, notably Anthropic (the AI provider behind Refi) in the United States and parts of Stripe's operations. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses otherwise.

Questions or requests about this policy: email info@reformerpilatesbooking.com or write to Tekun B.V., Zeestraat 61A, 2042 LB Zandvoort, the Netherlands. You can also complain to a data protection authority. Ours is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also contact the authority in the EU country where you live.