Privacy for class participants

When you book a class, two different organisations handle your data, and which one does what matters.

Your studio decides what happens with your bookings, your attendance and your purchases. Under the GDPR it is the controller for those, and its own privacy policy covers them. easybook.studio only carries out the studio's instructions there, as its processor under Art. 28 GDPR.

easybook.studio is the controller for one part: the account itself — the login you created and the technical records that keep it working and secure. That part is what this notice is about.

So: questions about your bookings go to your studio. Questions about your account and this notice come to us.

easybook.studio, Christoph Morosoli, c/o embrace yoga, Felsenkellerstr. 1b, 07745 Jena, Germany. Email: [email protected].

We are not required to appoint a data protection officer. Write to the address above with any data protection question.

• Your account: first and last name, email address, and the language you use the software in.
• Your password, stored only as a cryptographic hash. We cannot read it.
• Sign-in tokens that keep you signed in between visits.
• Your messages to us: if you write to us, for example at [email protected], we keep your message and our reply to deal with your request.
• Technical records from our servers: your IP address, the time, the endpoint called and error details — to keep the service running and to stop abuse such as automated sign-in attempts.

Everything else — your bookings, attendance, credits and purchases — we process for your studio, on its instructions, not on our own account. This also applies when your studio uses our AI assistant, which can access your data at your studio for this purpose.

• Providing the account, sign-in and booking — Art. 6(1)(b) GDPR, performance of this agreement with you.
• Answering your messages to us, including with AI-assisted reply drafts that a person reviews and sends — Art. 6(1)(b) GDPR where it concerns your account, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering requests promptly.
• Security and operation — rate limiting, preventing abuse, error analysis — Art. 6(1)(f) GDPR, our legitimate interest in a stable service free of abuse.
• Meeting legal obligations that apply to us — Art. 6(1)(c) GDPR.

We do not build a profile of you, make automated decisions about you, or use your data for advertising. The software only sets the cookies and local storage values technically required for your sign-in.

We use service providers that process on our instructions:

• Supabase — database hosting, EU servers
• Google Cloud — hosting, EU servers
• Cloudflare — delivery and protection of the website, global network
• Amazon Web Services (SES) and Resend — email delivery
• Stripe and PayPal — payments, where your studio has connected them; for your payment they act for your studio
• Whereby — video rooms, if your studio offers online classes
• Google Workspace — our support mailbox, if you write to us
• Anthropic — AI-assisted drafts of our replies to support messages and the AI assistant your studio can use, USA. Names, email addresses, phone numbers and addresses are replaced with placeholders before transfer; in free text this only works for details we recognise. Customer notes and bank details are never transferred. Pseudonymised data remains personal data. A person reviews and sends every support reply.

Where a provider processes outside the EU, we rely on the EU Standard Contractual Clauses. We do not sell your data and only share it when the law requires it.

We keep your account data for as long as your account exists. After it is deleted, we remove or anonymise it within 90 days, unless the law requires us to keep it longer.

We keep your messages to us and our replies for up to three years after the request is closed.

We keep technical and security records only as long as we need them to investigate errors and abuse, and delete them afterwards.

You can ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict what we do with it (Art. 18), to hand it over in a portable format (Art. 20), and you can object to processing we base on legitimate interests (Art. 21). Where you gave consent, you can withdraw it at any time, which does not affect what we did before.

Write to [email protected]. If your request is about your bookings rather than your account, we will pass it to your studio, who decides on it.

You can also complain to a supervisory authority. Ours is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, and you may instead go to the authority where you live or work.