Privacy Policy

We collect the following information, directly from you:

• Account details — your name, email address, and phone number, provided when you create an account. If you sign in with Google, we receive your name and email from Google; passwords are handled by our authentication provider and are never visible to us.
• Bookings and purchases — the sessions you book or cancel, session packages and credits you buy, and payment records (amount, payment method, payment status, and — for card payments — Stripe transaction references). Card numbers are NEVER stored or seen by us: card payments are entered directly on Stripe's secure checkout page and processed by Stripe.
• Liability waiver — before your first session you sign our liability waiver, which records your typed signature name, any injuries or health conditions you choose to disclose, an emergency contact name and phone number, your confirmation that you are an adult, and the IP address and browser identifier at the time of signing.
• Contact form messages — your name, email address, and message are delivered directly to the studio's email inbox; they are not stored in our database. To prevent abuse, we briefly retain a hashed (unreadable) form of your IP address for rate limiting, deleted within a few hours.
• Studio notes — the studio may keep brief administrative notes on your account (for example, scheduling preferences) to serve you better.

Your information is used only to run the studio and its booking service:

• Managing your account, bookings, session credits, and payments.
• Sending transactional emails: booking confirmations (including a calendar attachment), cancellation notices, purchase receipts, class reminders, and — at most once — an invitation to share feedback about the studio.
• Keeping the studio informed about its own schedule, rosters, and payments.
• Meeting our legal, tax, and record-keeping obligations.

We do not send marketing newsletters, and we do not use your information for advertising.

We rely on a small number of service providers, each processing your information only as needed to provide their service to us:

• Supabase — secure database and account authentication hosting.
• Stripe — card payment processing. Your card details go directly to Stripe and never touch our systems.
• Resend — delivery of the transactional emails described above.
• Vercel — hosting of this website and application.
• GitHub — storage of routine, access-restricted database backups.

We do not sell, rent, or share your personal information for advertising or any other consideration, and we have not done so in the preceding 12 months. There are no advertising networks, data brokers, or social media trackers on this site.

This site uses only functional cookies: the session cookies required to keep you signed in to your account, set by our authentication provider. We use no analytics, advertising, or tracking cookies of any kind.

• Account, booking, and payment records are kept while your account is active, and afterwards as needed for business, tax, and legal record-keeping.
• Signed liability waivers are retained for as long as the law allows claims to be brought, as they document the terms under which you participated.
• Routine database backups are kept for up to about 13 months and then deleted automatically.
• Contact-form rate-limiting records (hashed IP addresses only) are deleted within a few hours.

If you are a California resident, the California Consumer Privacy Act gives you the right to:

• Know and access the personal information we hold about you.
• Correct inaccurate personal information.
• Request deletion of your personal information, subject to legal record-keeping exceptions (for example, payment and waiver records we must retain).
• Not be discriminated against for exercising any of these rights.

To exercise any of these rights, email ginnymcginnis@gmail.com or call (415) 497-7059. We will verify your identity (typically by confirming control of the email address on your account) and respond within the timeframe the law requires. Because we do not sell or share personal information, there is nothing to opt out of.

Your data is stored with access controls that limit each person and system to what they need: you can see only your own information, and studio staff access is restricted to running the studio. Payment card data is handled entirely by Stripe, a PCI-DSS certified payment processor.

Our services are intended for adults. Booking a session requires signing a liability waiver confirming you are at least 18 years old, and we do not knowingly collect personal information from children.

If we change this policy, we will update the effective date above. Material changes will be communicated by email or a notice on this site.

Questions about this policy or your personal information? Contact Embodied Pilates at ginnymcginnis@gmail.com, (415) 497-7059, or in person at 340 Lorton Ave #211, Burlingame, CA 94010.