Privacy Policy

Account information. When you sign up, we collect your name, email address, and business details. If you connect Stripe, we receive limited billing information from Stripe — we never store full card numbers.

Business data. We store the data you enter into Claz on behalf of your business: class schedules, client profiles, bookings, memberships, and payment records. You own this data.

Usage data. We automatically collect information about how you interact with the platform — pages visited, features used, session duration, browser type, and IP address.

Cookies and local storage. We use cookies and browser local storage to keep you signed in and remember your preferences. See Section 5 for details.

• Provide, maintain, and improve the Claz platform
• Process payments and manage your Stripe Connect account
• Send transactional emails (booking confirmations, receipts, account alerts)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Analyse usage patterns to build better features
• Comply with legal obligations

We do not sell your data or your clients' data to third parties. We do not use your client data to train AI models or serve advertising.

When you use Claz to manage your business, you upload personal data about your clients (names, emails, booking history, payment records). In this context, you are the data controller and we are the data processor.

You are responsible for having a lawful basis to collect and process your clients' data, providing them with your own privacy notice, and responding to their data rights requests. We will assist you in fulfilling those requests upon written notice.

Data Processing Addendum. The terms in this section and in Section 3A form our Data Processing Addendum ("DPA"). It applies automatically to the personal data of your clients that we process for you, and it is part of our Terms of Service. If you need a signed copy, for example for a customer in the EU or UK, email privacy@claz.app.

What we process and why. We process your clients' personal data (contact details, booking and attendance history, membership and payment records, forms and notes you store) only to provide the Claz service to you, for as long as you have an account and during the deletion period in Section 6.

Your instructions. We process that data only on your documented instructions, which are your use of the platform and these terms, unless the law requires otherwise. We will tell you if we think an instruction breaks the law.

Confidentiality and security. People who can access the data are bound by confidentiality, and we apply the security measures described in Section 8.

Sub-processors. You authorise the sub-processors listed in Section 4. We bind them to data protection terms no less protective than these. If we add or replace a sub-processor, we will update Section 4 and give notice at least 14 days beforehand. You can object on reasonable data protection grounds by emailing us; if we cannot resolve it, you may cancel and export your data.

Helping you. We will reasonably help you respond to your clients' rights requests and meet your security and assessment obligations, taking into account the nature of the processing.

Breaches. If we become aware of a breach of security affecting your clients' personal data, we will tell you without undue delay and give you the information we have so you can meet your own notification duties.

Return and deletion. You can export your data at any time, and we will delete it after you cancel as described in Section 6, unless the law requires us to keep it.

Audits. On reasonable written request, and no more than once a year, we will give you the information needed to show we follow this DPA. If you need more than that, we will talk about a reasonable way to do it.

International transfers. For transfers of personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, the parties rely on the Standard Contractual Clauses (and the UK addendum where relevant), which are incorporated here by reference and apply as described in Section 9.

We share data only with trusted sub-processors necessary to deliver the service:

• Supabase — database and authentication hosting
• Stripe — payment processing and Connect onboarding
• Vercel — frontend hosting and edge delivery
• Fly.io — API server hosting
• Cloudinary — media storage and optimisation
• Resend — sending magic-link sign-in emails and other transactional emails
• Telnyx — SMS delivery for appointment reminders and communications
• Klaviyo — email and SMS marketing delivery for messages you have opted in to
• PostHog — product analytics, only if you accept analytics cookies
• Zoom and Google — video meeting links and calendar sync, only if a studio connects those integrations

We may also disclose information if required by law, court order, or to protect the rights and safety of Claz or others.

We use the following types of cookies and storage:

Analytics is off until you choose "Accept all" on the cookie banner. If you choose "Essential only" or dismiss the banner, analytics does not run. The banner appears on your first visit; to change your choice later, clear this site's local storage in your browser and the banner will appear again.

We send SMS text messages only if you opt in, by ticking the SMS checkbox when you book or sign up. Opting in is optional and is never a condition of booking or purchasing. Messages may include appointment reminders, class updates, and promotional messages from businesses you are associated with.

Marketing emails work the same way: we only send them if you tick the email opt-in box, and you can unsubscribe at any time from any message.

To opt out: Reply STOP to any message. You will receive a one-time confirmation and no further SMS messages will be sent. Message and data rates may apply.

We do not sell your phone number to third parties. Your number is used solely to deliver messages on behalf of businesses using the Claz platform.

We retain your account data for as long as your subscription is active. When you cancel and request deletion, we delete your data within 30 days, except where we are required to retain records for legal or tax purposes (typically 7 years for financial records).

Backups are purged on a rolling 90-day cycle.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any of these rights, email us at privacy@claz.app. We will respond within 30 days.

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. Authentication is handled by Supabase, which is SOC 2 certified.

No system is 100% secure. If you discover a security vulnerability, please report it to privacy@claz.app.

Claz is operated from the United States and your data is stored and processed in the United States. Our database and authentication (Supabase) are hosted in the AWS US East region (N. Virginia), and our API server (Fly.io) runs in the US East region. Other sub-processors listed in Section 4 may also process data in the United States. Vercel serves pages from edge locations worldwide, which may cache non-personal content close to the visitor.

If you or your clients are in the EEA, the UK, or Switzerland, your personal data is therefore transferred to the United States. For those transfers we rely on the Standard Contractual Clauses (and the UK addendum where relevant) as described in Section 3A, or on a sub-processor's adequacy certification where it has one.

Claz accounts and the Claz business tools are for adults (18+). We do not knowingly create accounts for, or market to, children under 16, and we do not collect personal data from children for our own purposes.

Some studios (for example dance, martial arts, and kids' fitness) use Claz to book classes for minors and to store a child's name, age, or health and waiver information. In that case the studio, not Claz, is responsible for getting any parental or guardian consent the law requires, for telling parents how the child's data is used, and for limiting what it collects about minors. Claz processes that data only as the studio's processor, on the studio's instructions (see Sections 3 and 3A). Parents who want to see, correct, or delete a child's data should contact the studio; if you contact us we will pass the request to the studio or help it respond.

If you believe a child has created an account or given us data directly, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you by email or an in-app notice at least 14 days before material changes take effect. Continued use after that date constitutes acceptance.

Questions about this policy or your data? Contact us at privacy@claz.app.