How we handle your information

1. Introduction

This Privacy Policy describes how Pilates by Piper ("we," "us," or "our") collects, uses, and shares information when you visit our website, create a member account, book a session, or otherwise interact with our services (collectively, the "Services").

2. Information we collect

• Account information. Name, mobile phone number, and (where provided) email address.
• Authentication data. One-time codes sent by SMS for sign-in, session tokens, and basic authentication logs (timestamps, success/failure).
• Booking & studio activity. Sessions reserved, attended, cancelled, and any health or preference notes you choose to share with your instructor.
• Payment information. Processed by our third-party payment processor; we do not store full card numbers on our systems.
• Device & usage data. IP address, browser type, pages viewed, and similar diagnostic information collected automatically.
• Communications. Messages you send us and our responses.

3. How we use information

• Authenticate you and secure your account.
• Schedule, confirm, and manage your sessions.
• Process payments and maintain billing records.
• Send transactional messages (sign-in codes, booking confirmations, schedule changes).
• Operate, maintain, and improve the Services.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms.

4. SMS messaging & mobile information

No mobile information or SMS consent will be shared with third parties or affiliates for marketing or promotional purposes. Mobile phone numbers, SMS opt-in status, and consent records collected by Pilates by Piper are used solely to operate the Services and are never sold, rented, or shared with third parties or affiliates for their marketing or promotional use.

We use a third-party messaging provider (our SMS aggregator and telecommunications carriers) solely to deliver one-time authentication codes and essential transactional messages (such as booking confirmations, schedule changes, and payment reminders) to the mobile number on your account. These providers act as service providers on our behalf, are contractually restricted from using your information for their own marketing, and may only process it as needed to deliver the message.

Message frequency varies based on your account activity. Message and data rates may apply. Reply STOP to any message to opt out of non-essential SMS and HELP for assistance. Opting out of authentication messages will prevent you from signing in. Categories of messages sent: account authentication (one-time passcodes), booking request status, payment requests, and schedule updates.

5. Cookies & similar technologies

We use cookies and local storage to keep you signed in, remember your preferences, and measure how the Services are used. You can control cookies through your browser settings; disabling them may limit functionality.

6. How we share information

We share information only as described below:

• Service providers that help us operate the Services, including hosting, database, authentication, SMS delivery, and payment processing. These providers are bound by contractual confidentiality and data-protection obligations.
• Legal & safety. When required by law, subpoena, or court order, or to protect the rights, property, or safety of our members, staff, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

We do not sell your personal information. Mobile information and SMS/text messaging consent are never shared with third parties or affiliates for marketing or promotional purposes.

7. Data retention

We retain personal information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Authentication logs and booking history may be retained in aggregated or anonymized form for analytics.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encrypted transport, access controls, and row-level database authorization. No system is perfectly secure; you use the Services at your own risk and are responsible for safeguarding your account credentials.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or port the personal information we hold about you, and to object to or restrict certain processing. California residents have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what categories of personal information we collect and the right not to be discriminated against for exercising these rights. To make a request, contact us using the details below; we may need to verify your identity before responding.

10. Children's privacy

The Services are intended for adults 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. International users

The Services are operated from the United States. If you access them from outside the U.S., you understand that your information will be transferred to, stored, and processed in the U.S., where data-protection laws may differ from those in your jurisdiction.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice through the Services.

13. Contact

Privacy questions or requests can be directed to the studio at the contact information provided in your welcome materials.