Privacy Policy

Account information. When you sign up, we collect your name, email address, and studio details. If you connect Stripe, we receive limited billing information from Stripe — we never store full card numbers.

Studio data. We store the data you enter into Claz on behalf of your business: class schedules, client profiles, bookings, memberships, and payment records. You own this data.

Usage data. We automatically collect information about how you interact with the platform — pages visited, features used, session duration, browser type, and IP address.

Cookies and local storage. We use cookies and browser local storage to keep you signed in and remember your preferences. See Section 5 for details.

• Provide, maintain, and improve the Claz platform
• Process payments and manage your Stripe Connect account
• Send transactional emails (booking confirmations, receipts, account alerts)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Analyse usage patterns to build better features
• Comply with legal obligations

We do not sell your data or your clients' data to third parties. We do not use your studio's client data to train AI models or serve advertising.

When you use Claz to manage your studio, you upload personal data about your clients (names, emails, booking history, payment records). In this context, you are the data controller and we are the data processor.

You are responsible for having a lawful basis to collect and process your clients' data, providing them with your own privacy notice, and responding to their data rights requests. We will assist you in fulfilling those requests upon written notice.

We share data only with trusted sub-processors necessary to deliver the service:

• Supabase — database and authentication hosting (EU/US)
• Stripe — payment processing and Connect onboarding
• Vercel — frontend hosting and edge delivery
• Render — API server hosting
• Cloudinary — media storage and optimisation
• Twilio — SMS delivery for appointment reminders and studio communications

We may also disclose information if required by law, court order, or to protect the rights and safety of Claz or others.

We use the following types of cookies and storage:

You can manage your cookie preferences at any time using the banner shown on your first visit, or by clearing your browser's local storage.

When you provide your phone number, you consent to receive SMS text messages from Claz and studios using our platform. These include appointment reminders, class updates, and promotional messages from studios you are associated with.

To opt out: Reply STOP to any message. You will receive a one-time confirmation and no further SMS messages will be sent. Message and data rates may apply.

We do not sell your phone number to third parties. Your number is used solely to deliver messages on behalf of studios using the Claz platform.

We retain your account data for as long as your subscription is active. When you cancel and request deletion, we delete your studio data within 30 days, except where we are required to retain records for legal or tax purposes (typically 7 years for financial records).

Backups are purged on a rolling 90-day cycle.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any of these rights, email us at privacy@claz.app. We will respond within 30 days.

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. Authentication is handled by Supabase, which is SOC 2 certified.

No system is 100% secure. If you discover a security vulnerability, please report it to privacy@claz.app.

Claz operates globally. Your data may be processed in the United States and the European Union. Where we transfer personal data outside the EEA, we rely on Standard Contractual Clauses or the sub-processor's adequacy decision.

Claz is a business tool intended for adults (18+). We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you by email or an in-app notice at least 14 days before material changes take effect. Continued use after that date constitutes acceptance.

Questions about this policy or your data? Contact us at privacy@claz.app.