Two controllers
bookacla.ss and the creator you book with are independent controllers of your details. bookacla.ss holds them to run the booking, the payment record, the ticket and the emails about them; the creator holds them to run the class and, only if you asked, to tell you about new classes. Each is responsible for its own use.
What we hold
- Your name and email address, and a mobile number if you gave one.
- Your bookings, tickets, attendance, passes and credit balances, and the price and policy shown when you booked.
- Payment records: the amount, the booking fee within it, the Stripe reference and the outcome. Card details are held by Stripe, never by us.
- A card you save for booking: its brand, last four digits and expiry, and Stripe's reference for it — never the number, which Stripe holds.
- The consents you gave at checkout, with the document version and the time.
- The emails we sent you and whether they arrived.
- How the booking pages are used, recorded without cookies and without your address: a salted key that changes daily, the page, the class and the outcome.
Why, and on what basis
- To take and honour your booking, issue your ticket and handle cancellations and refunds — performing the contract.
- To send the emails a booking needs: confirmation, reminders, changes, refunds — performing the contract.
- To tell you about a creator's new classes — only with your consent, which you can withdraw from any message.
- To keep financial and consent records, resolve disputes and meet legal duties — legal obligation and legitimate interest.
- To keep the platform safe, measure the booking funnel and fix faults — legitimate interest, with no profiling and no sale of data.
Who else sees it
Our processors, each under contract and each holding only what its job needs: Supabase (database and email delivery of sign-in codes, hosted in the EU), Stripe (payments), Resend (email), Vercel (hosting), PostHog (product analytics, EU), Sentry (error reporting) and Help Scout (creator support). The creator sees the details above for their own classes. We do not sell or share your details with anyone else, except where the law requires it.
How long we keep it
The retention schedule is at /legal/retention. In short: booking, payment, refund and consent records are kept for six years as financial and legal records; email logs for twelve months; sign-in codes and holds for minutes; a customer record is redacted on request where no obligation remains, and otherwise when the last obligation ends.
Your rights
You can ask for a copy of what we hold, correct it, ask us to erase it, object to or restrict its use, and complain to the Information Commissioner's Office. From My classes you can download your data yourself; for erasure or anything else, email support@bookacla.ss from the address on your booking and we will answer within thirty days. Where a record must be kept — a payment, a refund, a consent — we redact your details from it rather than delete it.
Children
Bookings are made by adults. Where a person under eighteen attends, the booking is made by a parent or guardian who accepts the waiver on their behalf. We do not collect dates of birth.
Contact and changes
bookacla.ss, support@bookacla.ss. This notice is dated and versioned; a material change is shown before it applies.