Privacy Policy

Audience: EU / Portugal consumer app (students, instructors, studios). Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal.

1. Who we are

Student Body, Lda. (“Student Body”, “we”, “us”), NIPC 519312708, registered at Rua de Santos Pousada 826, 4000-481 Porto, Portugal, is the controller of the personal data processed through studentbody.pt, app.studentbody.pt, and the Student Body mobile apps (the “Service”).

Contact for any privacy matter or to exercise your rights: hello@studentbody.pt. We have not appointed a Data Protection Officer.

2. The personal data we collect

We collect data you give us, data generated as you use the Service, and a small amount of technical data:

• Identity & contact — name / display name, email address, phone number (if you provide it, e.g. at a walk-in check-in), profile photo, bio, and your chosen public handle.
• Date of birth — or, when you sign up in the middle of a booking, your confirmation that you are at least 16 (with the date asked for afterwards). Used only to check the minimum age (see §3); never for marketing.
• Account & authentication — your account identifier and login metadata (authentication is handled by our provider Supabase; we never see your password).
• Location — the city/country and, if you use location features, the approximate coordinates derived from an address you enter, plus your chosen search radius.
• Profile & preferences — interests, languages, accessibility preferences, notification settings, appearance settings, and your schedule preferences (the days of the week and times of day you tend to practice, if you choose to tell us).
• Bookings & activity — classes you book, attendance, waitlist entries, saved/followed classes, instructors and studios, streaks and milestones; and, if you choose to tell us, why you didn’t complete a booking — a reason you pick from a list (for example that your card didn’t work) and any note you add. If you book as a guest, are given a ticket by a friend, or are checked in as a walk-in, we keep the name and email address provided so the booking can be linked to an account later — yours, when you sign up with that email address or follow the link in the email we send you.
• Class check-in details — including optional injury notes and experience / “vibe” preferences you choose to share before a class (see §3).
• Content & social — class feedback and ratings (including private comments you leave), direct messages, connections/contacts, and any support messages you send us.
• Payment data — a payment-provider customer reference and the brand, last 4 digits and expiry of a saved card, and — for up to 24 hours after you pay — of the card you paid with, so we can ask whether to save it. We never store full card numbers — these are held by our payment processor, Stripe.
• Consent records — your acceptance of the Terms, marketing opt-in choice, and cookie/analytics consent, each with a timestamp (proof of consent).
• Status updates — the email address you give us on our status page (status.studentbody.pt) or on our website if you ask to be emailed when the Service is down or back. You do not need an account for this.
• Technical & usage data — IP address and device/browser information used to keep the Service secure and working; account-level usage events our servers record while you are signed in (for example, that you booked or cancelled a class); and, only with your consent, in-browser product-analytics events about how you use the app, identified by a random analytics identifier (see §4).

3. How and why we use your data

Demand summaries. If you tell us when you like to practice, we include your schedule preferences in aggregated demand summaries shown to instructors and studios so they can plan classes at times students actually want. These summaries are group counts only: a day-and-time combination is only ever shown when at least 5 students selected it, other tallies (such as preferred language or class type) only when at least 3 students share them, and groups below those minimums are hidden entirely rather than shown as small numbers. Your individual preferences are never shown to anyone. Your preferences are included by default; you can exclude them at any time by unticking the option during onboarding or in Settings → Practice preferences, which takes effect immediately. This is also how you exercise your right to object (Art. 21) to this processing.

Status updates. If you ask, on our status page or on our website, to be told by email when the Service is down or back, we first send a confirmation email to the address you gave, and add it to the list only when you follow the link in that email. We use the address only to send these updates: asking for them does not sign you up for marketing emails. Every status update has an unsubscribe link. Using it stops the status updates and, if that address also receives our marketing emails, those too.

We do not sell your personal data.

4. Cookies & analytics

• Strictly-necessary cookies keep you signed in and the Service secure. These are always on (no consent required).
• Error monitoring (Sentry, hosted in the EU data region) runs to keep the Service stable and secure. It is configured to collect no IP address or personal identifiers and is treated as strictly necessary.
• Analytics (PostHog, hosted in the EU) helps us understand usage. In your browser it runs only after you accept via our cookie banner, and sets no cookie before then. On booking pages this can include a replay of how you moved through the page, with everything you type masked. You can accept, reject, or change your choice at any time.
• Account-level usage events. While you are signed in, our servers also record key events tied to your account — for example, that you signed up, booked or cancelled a class — so we can see where the Service works and where people get stuck. We do this under our legitimate interests (§3). If you reject analytics in the cookie banner or cookie preferences — whether before or after you sign in — we stop recording these events and delete your analytics profile (a choice made before signing in is applied when you sign in).
• Continuing in another browser. Apps such as Instagram open links in their own built-in browser, which keeps its storage separate from your usual browser. If you accepted analytics in that built-in browser and then continue in another one — by tapping the sign-in link we email you, or with “Open in browser” — the link carries your random analytics identifier (a code, never your name or email, valid for 30 minutes) so the visit counts as one journey. In the new browser, in-browser analytics still runs only if you accept it there. When you sign in, we connect that identifier to your account, unless you have rejected analytics.

5. Who we share your data with (sub-processors)

We share data only with service providers (“processors”) acting on our instructions under data-processing agreements, each only as needed for its function:

What studios and instructors receive about you. The studio or instructor whose class you book sees your name as you chose to show it, your booking, and whether you attended. They receive your email address and phone number only if you switched on “Share my contact with studios & instructors” in your settings, or if you gave them at the door. Your standing accessibility needs are shown to whoever runs check-in only if you chose to show them. An injury note you write before a class is shown to the teacher of that class and to nobody else. Where a studio has connected another booking system and switched on the mirroring of bookings, your name and email address are sent to that system when you book, so that your place exists there too.

If you connect a third-party booking system (e.g. Acuity, BSport, YOGO) as an instructor or studio, we exchange the data needed to sync your classes with that provider, which acts as its own controller.

6. International transfers

Most of your personal data is stored and processed within the European Economic Area: our database (Supabase, Frankfurt), infrastructure and queues (AWS, Paris), application hosting (Fly.io, Paris), product analytics (PostHog, EU), error monitoring (Sentry, EU) and email (Brevo, EU) all process data in the EU.

Several of these providers are nonetheless incorporated in the United States (Supabase, Fly.io, Vercel, PostHog, Sentry). Storing data in an EU region does not, by itself, rule out the possibility that a US parent company could be subject to a US legal request. A small number of providers additionally process data outside the EEA: Mapbox processes geocoding requests in the United States, Cloudflare serves instructor video and images from a global edge network, and Stripe makes limited onward transfers to its US entity.

For every transfer that leaves the EEA — and as a supplementary safeguard for EU-resident data held by US-incorporated providers — we rely on an appropriate mechanism under Chapter V GDPR: the EU Standard Contractual Clauses and/or the provider’s certification under the EU–US Data Privacy Framework, with supplementary measures where needed. You can request details of the safeguard for a specific provider at hello@studentbody.pt.

7. How long we keep your data

8. Your rights

You can, at any time: access your data, rectify it, erase it, restrict or object to processing, obtain it in a portable format (portability), and withdraw consent (without affecting processing done before withdrawal).

We have built self-service tools for the two most common requests, in Settings → Account:

• Download my data — a structured (JSON) copy of your personal data (access & portability).
• Delete my account — permanently erases your personal data across our systems and our processors. Copies in our backups are overwritten within 30 days.

You can also edit your profile directly (rectification) and change marketing/cookie consent in settings; rejecting analytics there is also how you object to the account-level usage events in §4. To object to the use of your schedule preferences in demand summaries, simply turn off “Include my preferences in demand summaries” in Settings → Practice preferences. To stop status updates, use the unsubscribe link in any of them. For any other request, email hello@studentbody.pt; we respond within one month (Art. 12(3)).

9. Automated decisions & profiling

We use your activity to personalise recommendations and rankings (e.g. classes you might like). This is profiling in the ordinary sense, but we do not make decisions about you that are solely automated and produce legal or similarly significant effects within the meaning of Art. 22.

10. Children

The Service is intended for users aged 16 and over (the age of digital consent in Portugal). We do not knowingly collect data from children under 16; if you believe a child has used the Service, contact us and we will delete the account.

11. Security

We protect your data with encryption in transit, application-level encryption of sensitive fields, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and will notify you and the CNPD of a breach where the law requires.

12. Complaints

You have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt), without prejudice to any other administrative or judicial remedy.

13. Changes

We may update this Policy. The current version is always the one published here; we will flag material changes.