Who we are
yogispace is an online marketplace where students book live, online yoga sessions and group classes with independent yoga teachers.
We, yogispace, are the controller of the personal data described in this policy, which means we decide how and why it is used. You can reach us about anything in this policy at helloyogispace@gmail.com.
Teachers on yogispace are independent. When a teacher uses the details of students who book with them (for example, to prepare a session), they are responsible for handling that information properly too.
What we collect
When you create an account
- Your name and email address
- Your password, which is stored in scrambled (hashed) form so no one can read it, not even us
- Your profile photo and phone number, if you choose to add them
- Your timezone, taken from your browser, so we can show session times correctly
- If you sign in with Google: your name, email address and profile picture from your Google account
If you teach on yogispace
- Your bio, tagline, yoga styles, experience and teaching levels
- Your certificates and the images you upload of them
- Your intro video link, availability, prices, classes and minimum booking notice
- A reference to your Stripe account for payouts. Stripe collects and verifies your identity and bank details directly; we don't see or store your bank details.
- Notes from our review of your profile, if we ask you to change something
When you book or teach a session
- Booking details: teacher, date, time, duration, price and status
- Anything you write in the booking notes (see Health information)
- Payment, refund and payout records: amounts, dates and Stripe references. We never see or store full card numbers.
- Reviews you write
Messages
Messages you send through yogispace are stored so the conversation is available on all your devices. Only the student and teacher in a conversation can read it. We may look at a conversation if it's reported to us or we need to investigate misuse.
Video sessions
Sessions take place in a private video room provided by Daily.co. We do not record sessions. Daily processes the technical information needed to connect your call (such as your IP address and connection quality) and we record whether a teacher joined, so we can handle no-show refunds.
Technical information
- Basic device and browser information and IP addresses, kept in our hosting providers' logs for security and troubleshooting
- Results of the automatic security check on sign-up and login (Cloudflare Turnstile), which helps block bots
- Anonymous visitor statistics (which pages are viewed, the referring site, and your country and device type) through Vercel Web Analytics. It uses no cookies and doesn't identify you or follow you across other sites.
Health information
When you book, you can tell your teacher about injuries, conditions or anything else that affects your practice. This is optional. Information about your health is a special category of personal data, so we only use it with your explicit consent, which you give by choosing to add it to your booking notes.
We use it only to pass it to your teacher so they can adapt the session. You can withdraw your consent at any time by emailing us, and we'll delete it from your bookings. Please don't share more than your teacher needs to know.
How we use your information, and why we're allowed to
Data protection law requires us to have a legal reason (a "lawful basis") for each use of your data:
- To provide the service you signed up for (contract): creating your account, showing teacher profiles, taking bookings and payments, issuing refunds, paying teachers, running video sessions, sending booking confirmations, reminders and message notifications, and customer support.
- Our legitimate interests: keeping yogispace secure (security checks, rate limits, fraud prevention), reviewing teachers' profiles and certificates before they go live, investigating reports and disputes, improving how the site works (including anonymous visitor statistics), and keeping records of past bookings after an account is deleted so the other person keeps their history.
- Legal obligations: keeping booking and payment records for tax and accounting, and responding to lawful requests from authorities.
- Your consent: health information in booking notes. You can withdraw consent at any time.
We don't sell your data, and we don't use it for advertising. We don't make decisions about you using only automated processing that has legal or similarly significant effects.
Who we share it with
Other users
Students can see teachers' public profiles (name, photo, bio, styles, certificates, reviews, availability and prices). Teachers can see the names, photos and booking notes of students who book with them, and both sides can see their messages with each other. We never show your email address or phone number to other users.
Service providers
We use trusted providers who process data on our behalf, under contracts that require them to protect it:
- Supabase: database, login, file storage and server functions
- Vercel: website hosting and anonymous visitor statistics
- Stripe: card payments, refunds and teacher payouts. Stripe also acts as its own controller for identity checks and fraud prevention; see Stripe's privacy policy.
- Daily.co: video rooms for sessions
- Resend: sending emails such as confirmations, reminders and password resets
- Cloudflare: the security check on sign-up and login (Turnstile)
- Google: "Continue with Google" sign-in, and Google Fonts
When the law requires it
We may share information if we're legally required to, or to protect the safety of our users or others.
International transfers
Some of our providers are based in, or process data in, the European Economic Area or the United States. When your data leaves the UK, we make sure it's protected: either the country has been approved by the UK government as having adequate protection (including US organisations certified under the UK Extension to the EU–US Data Privacy Framework), or we rely on the UK International Data Transfer Agreement or Addendum with our provider.
How long we keep it
- Your account: for as long as your account is open.
- When you delete your account: we delete your profile, photos, favourites, reviews and notification settings, and hide a teacher's public profile. Records of past bookings and payments, and the messages in your conversations, stay available to the other person, but they're no longer linked to your account or show your contact details.
- Booking, payment and payout records: 6 years after the end of the tax year they relate to, as required for tax and accounting.
- Health information in booking notes: for as long as the booking record is kept, unless you ask us to delete it sooner.
- Security and server logs: kept by our hosting providers for a limited period, typically no more than 90 days.
- Visitor statistics: kept only as anonymous totals; no personal profile is created.
Cookies & local storage
We don't use advertising or tracking cookies, so there's no cookie banner. We only use technologies that are strictly necessary for the site to work, which don't need your consent:
- Your browser's local storage, to keep you logged in and remember your choices
- Cloudflare Turnstile, to check you're not a bot when you sign up or log in
- Stripe, on the booking page, to process payments and prevent fraud
Teacher intro videos are embedded from YouTube (in privacy-enhanced mode) or Vimeo (with do-not-track), and only load when you press play. For YouTube videos, the preview picture is shown from YouTube’s image server when you open the profile (no cookies are set). Our fonts are loaded from Google Fonts. Those services receive your IP address when that happens.
Our visitor statistics (Vercel Web Analytics) don't use cookies or store anything on your device.
Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you
- Correct data that's wrong or incomplete (most of it you can edit yourself in Settings)
- Delete your data. You can delete your account yourself in Settings.
- Restrict or object to how we use your data, including anything we do based on legitimate interests
- Data portability: receive the data you gave us in a common, machine-readable format
- Withdraw consent at any time, where we rely on it
To use any of these rights, email helloyogispace@gmail.com. We'll reply within one month. There's no fee.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.
Security
- All connections to yogispace are encrypted (HTTPS)
- Passwords are hashed; card details are handled only by Stripe
- Database rules make sure people can only see and change what they're allowed to
- Payments, refunds and payouts are processed on our servers, never trusted to your browser
- Video rooms are private and only open to the teacher and the students booked into that session
No system is completely secure. If we become aware of a breach that puts your rights at risk, we'll tell you and the ICO as the law requires.
Age
yogispace is for adults. You must be 18 or over to create an account. We don't knowingly collect data from anyone under 18; if you think a child has signed up, please contact us and we'll delete the account.
Changes to this policy
We may update this policy as yogispace changes. If we make significant changes, we'll let you know by email or on the site before they take effect. The date at the top shows when it was last updated.
Questions?
If you have a question about this policy or your data, email us at helloyogispace@gmail.com.