Privacy Policy

Effective Date: January 1, 2024 Last Updated: April 19, 2026

1. Data Controller and Introduction

Sumtuches Inc. ("we", "us", "our", or "Company") is the data controller responsible for your personal information. We are committed to protecting your privacy and ensuring you have a positive experience on our website and in our studio.

This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal information. It applies to information collected through our website (www.sumtuches.com), mobile applications, in-studio registrations, classes, events, and communications.

Sumtuches Inc. is located at 1247 Wellness Boulevard, Suite 200, San Francisco, CA 94103. If you have questions about our privacy practices, please contact us at [email protected] or +1 (555) 234-7890.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide to us:

Account Registration: Name, email address, phone number, date of birth, address, emergency contact information
Class Enrollment: Class preferences, experience level, physical limitations, health conditions, medical history, pregnancy status
Membership: Payment information (processed securely through third-party payment processors), billing address, membership preferences
Communications: Feedback, testimonials, reviews, survey responses, and communications you send us
Wellness Assessments: Information about your fitness level, yoga experience, health goals, dietary preferences (especially for retreat participants)
Private Sessions: Additional health information, specific goals, modifications needed, availability preferences
Teacher Training: Educational background, teaching experience, goals, references (for 200-hour and 500-hour programs)
Online Purchases: Products purchased, quantity, delivery addresses, payment methods
Event Registration: Attendance at workshops, retreats, special events, training programs
Promotional Content: Email addresses and preferences for newsletters, promotions, and marketing communications

2.2 Information Collected Automatically

When you interact with our website and services, we automatically collect:

Device Information: Device type, operating system, device identifier, browser type and version
Usage Information: Pages visited, time spent, clicks, interactions, class attendance patterns, login times
Location Data: General location information (city, country level) based on IP address; precise location only if you explicitly enable it
Cookies and Similar Technologies: Session cookies, persistent cookies, tracking pixels, web beacons (see Cookie Policy)
Server Logs: IP addresses, access times, referring URLs, error messages, bandwidth usage
Performance Data: How long pages load, which features are used most, technical errors encountered
Camera/Microphone Access: If you use our online classes, we collect data related to your audio/video setup (with your explicit permission)

2.3 Information from Third Parties

We may receive information about you from:

Payment Processors: Transaction data, billing information, payment status, fraud detection data from Stripe, PayPal, or similar services
Social Media: If you connect your social media account to our platform, we receive your public profile information
Marketing Partners: When you click on our ads on other platforms, we may receive attribution data
Class Referrals: Information from other students who refer you to our studio
Healthcare Providers: With your explicit consent, medical professionals may share relevant health information for prenatal or therapeutic classes
Retreat Partners: Information from hotel/venue partners, guides, and wellness specialists who assist with retreats
Email Service Providers: Engagement data about our emails (opens, clicks) from Mailchimp or similar providers

3. How We Use Your Data

We use the information we collect for the following purposes:

3.1 Service Delivery

Registering and managing your account
Scheduling and delivering yoga and meditation classes
Processing memberships, class packages, and payments
Providing private sessions and personalized instruction
Delivering online classes, recordings, and digital content
Organizing wellness retreats and teacher training programs
Sending class reminders and schedule notifications
Responding to your inquiries and providing customer support

3.2 Communication

Sending transactional emails (confirmations, receipts, updates)
Notifying you of class cancellations or schedule changes
Communicating about your membership, account status, or services you've requested
Sending wellness tips, meditation guidance, and educational content (if opted in)
Following up on feedback or support inquiries

3.3 Marketing and Promotional Activities

Sending newsletters with class updates, instructor spotlights, wellness tips
Informing you about new classes, services, retreats, and special events
Offering personalized recommendations based on your class attendance and preferences
Running targeted advertising campaigns (with appropriate consent)
Inviting you to participate in surveys, polls, or feedback sessions

3.4 Analytics and Improvement

Analyzing class popularity, attendance patterns, and student engagement
Understanding which services and content are most valued
Identifying technical issues and improving website performance
Measuring the effectiveness of our marketing campaigns
Developing new classes and programs based on student interest
Conducting research to enhance our offerings

3.5 Legal Compliance and Safety

Complying with legal obligations and court orders
Enforcing our Terms and Conditions and other agreements
Protecting against fraudulent, illegal, or harmful activities
Responding to legitimate requests from law enforcement
Protecting the safety and rights of our students and staff
Preventing and detecting fraud, security breaches, or abuse

3.6 Business Operations

Managing instructor schedules and payroll
Maintaining facility management and security
Conducting risk assessments for specialized classes (prenatal, hot yoga)
Managing supplier and vendor relationships
Emergency communications if needed for studio closures or safety issues
Generating anonymous, aggregated statistics about our studio

4. Legal Basis for Processing

We process your personal information under the following legal bases:

4.1 Consent

We process certain information (such as marketing communications, testimonial use, or optional wellness assessments) based on your explicit consent. You may withdraw this consent at any time by updating your preferences or contacting us.

4.2 Contract

We process information necessary to enter into and perform our service agreements with you, including:

Class enrollment and scheduling
Membership management and billing
Private session bookings
Retreat registrations
Teacher training programs

4.3 Legitimate Interest

We process information for legitimate business interests, including:

Improving our services and user experience
Conducting analytics to understand student needs
Marketing our classes and services to prospective students
Preventing fraud and ensuring security
Defending legal claims
Managing our business operations

4.4 Legal Obligation

We may process information to comply with applicable laws and regulations, including:

Tax and accounting requirements
Employment law obligations
Health and safety regulations
Court orders or legal requests
Contractual obligations with business partners

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information in these limited circumstances:

5.1 Service Providers

We share information with third-party service providers who help us operate our business:

Payment Processors: Stripe, PayPal, or similar for processing transactions
Email Service Providers: Mailchimp or similar for newsletters and communications
Class Management Software: Mindbody or similar for scheduling and attendance
Cloud Storage: Google Drive, Dropbox for secure data storage
Analytics Providers: Google Analytics for website analytics
Website Hosting: Amazon Web Services or similar for website operations
Accounting Software: QuickBooks or similar for financial records

All service providers are contractually obligated to maintain confidentiality and use data only as directed.

5.2 Legal Authorities and Compliance

We may disclose information if required by law or if we believe in good faith that disclosure is necessary to:

Comply with court orders, legal processes, or government requests
Enforce our Terms and Conditions
Protect against fraud, security threats, or illegal activity
Protect the safety and rights of our students, staff, and the public
Establish, exercise, or defend legal claims

5.3 Business Transfers

If Sumtuches Inc. is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

5.4 Aggregated and De-identified Data

We may share aggregated, anonymized information that cannot identify you, such as:

"78% of our students practice yoga 3+ times per week"
Attendance statistics by class type
General demographics (without identifying individuals)
Anonymized testimonials or case studies

5.5 With Your Consent

We may share information with third parties when you explicitly consent, such as:

Sharing your testimonial on our marketing materials
Referring you to partner wellness professionals
Including your story in our success stories (with permission)

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy:

Account Information: Retained for the duration of your membership plus 3 years after account closure for legal and tax purposes
Class Attendance Records: Maintained for 7 years for insurance and liability purposes
Payment Information: Retained for 7 years per accounting regulations; stored securely and never in plain text
Medical/Health Information: Retained for the duration of your active classes plus 5 years; earlier deletion available upon request
Teacher Training Records: Retained for 10 years to support certification and career references
Marketing Communications: Retained until you unsubscribe; opt-out honored immediately
Website Analytics Cookies: Retained for 26 months per Google Analytics defaults
Backup Data: Retained for 30 days for disaster recovery purposes
Legal/Litigation Data: Retained for 7 years or duration of any legal proceedings plus 3 additional years

After retention periods expire, we securely delete or permanently anonymize your information. If you request deletion, we will remove data within 30 days unless legal obligations require longer retention.

7. Data Security

We implement comprehensive security measures to protect your personal information:

7.1 Encryption

All data transmitted to our servers uses SSL/TLS encryption (https://)
Sensitive data (payment information, health records) is encrypted at rest using industry-standard AES-256 encryption
Database encryption prevents unauthorized access to stored data

7.2 Access Controls

Strict access controls limit employee access to personal information
Only staff members who need information to perform their job have access
All staff sign confidentiality agreements
Two-factor authentication required for accessing sensitive systems
Regular access reviews ensure only current staff maintain access

7.3 Physical Security

Secure office and server facilities with restricted access
Security cameras and alarms monitoring premises
Secure disposal of physical records containing personal information
Locked file cabinets for paper records

7.4 Infrastructure Security

Regular security audits and vulnerability assessments
Firewalls and intrusion detection systems
Regular software updates and security patches
Backup systems to prevent data loss
Disaster recovery plans in place

7.5 Incident Response

Procedures in place to detect and respond to security breaches
If a breach occurs affecting your information, we will notify affected individuals and relevant authorities as required by law
Notifications will include details of the breach, information involved, steps we're taking, and resources available

7.6 Third-Party Security

Service providers undergo security assessments before engagement
Contracts require vendors to maintain security standards
Regular audits of vendor security practices
Only necessary data shared with third parties

8. Your Rights Regarding Your Data

You have the following rights concerning your personal information:

8.1 Right of Access

You have the right to request access to all personal information we hold about you. We will provide a copy of your data in a clear, understandable format within 30 days of your request, free of charge. To exercise this right, contact [email protected] with "Data Access Request" in the subject line.

8.2 Right of Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction. We will update your information promptly and ensure corrections are shared with relevant third parties. You can update most information in your account settings, or contact us for assistance.

8.3 Right of Erasure ("Right to Be Forgotten")

You may request deletion of your personal information in certain circumstances:

When the data is no longer necessary for our purposes
When you withdraw your consent
When you object to our processing and we have no legal basis to continue
When the data was unlawfully processed

Note: We must retain some information for legal, accounting, or contractual reasons (such as payment records for 7 years). We will delete all other information upon request within 30 days.

8.4 Right to Restrict Processing

You may request that we limit how we use your information:

While we verify the accuracy of disputed data
When you object to processing but we haven't yet determined our legal basis
When processing is unlawful but you prefer restriction over deletion
When we no longer need the data but you need it for legal claims

We will restrict use but maintain secure storage of the data.

8.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format (such as CSV or PDF), and to transmit it to another organization. We will provide this within 30 days of your request. To exercise this right, contact [email protected].

8.6 Right to Object

You have the right to object to our processing of your information:

Marketing Communications: You may opt out of promotional emails by clicking "unsubscribe" or updating your preferences. We will honor requests within 48 hours.
Analytics and Tracking: You may opt out of cookies and tracking through your browser settings or our cookie preference tool
Other Processing: You may object to processing based on legitimate interests by contacting us

8.7 Right to Withdraw Consent

If we're processing your information based on your consent (such as for marketing or optional health information), you may withdraw that consent at any time. Withdrawal won't affect the legality of processing before withdrawal. Contact [email protected] to withdraw consent.

8.8 Right to Lodge a Complaint

If you believe we've violated your privacy rights, you have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first to resolve any concerns.

9. International Data Transfers

Sumtuches is based in California, USA. Your information is primarily stored on servers located in the United States. By using our services, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.

When we transfer data internationally, we implement safeguards:

Standard contractual clauses approved by regulatory bodies
Adequacy decisions from relevant authorities
Your explicit consent for transfers
Ensuring recipient countries have adequate privacy protections

EU and UK residents should note that the United States may not have the same data protection standards as European countries. However, we implement appropriate safeguards and your information remains protected.

10. Children's Privacy

Our services are not intended for children under age 16. We do not knowingly collect personal information from children under 16 without parental consent.

For children 16-18, we require parental consent before:

Processing personal information beyond what's necessary for service delivery
Marketing communications
Sharing information with third parties
Automated decision-making

If we learn we've collected information from a child under 16 without proper consent, we will delete it promptly. Parents or guardians may contact us at [email protected] if they believe their child's information has been collected.

Note: Children of any age may participate in classes with parental presence and consent. We request health information necessary for safe instruction but do not use this for marketing or unnecessary sharing.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this policy
Notify you via email if you've provided an email address
Require your explicit consent if changes significantly expand how we use your information
Provide at least 30 days' notice before material changes take effect

Your continued use of our services after changes become effective constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or your personal information, please contact us:

Sumtuches Inc. Data Protection Officer 1247 Wellness Boulevard, Suite 200 San Francisco, CA 94103 Email: [email protected] Phone: +1 (555) 234-7890 Business Hours: Monday-Friday 6am-8pm PST

We will respond to privacy inquiries within 30 days. If you're not satisfied with our response, you may lodge a complaint with your local data protection authority.