Privacy Policy

StudioVault PH (“StudioVault”, “we”, “us”, or “our”) operates studiovault.co and the StudioVault platform: a hosted website, booking, and management service for boutique fitness, pilates, yoga, and wellness studios in the Philippines.

We are a personal information controller operating in the Philippines. In this Policy, “personal data” and “processing” have the meanings given in the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (“NPC”).

Our Data Protection Officer is responsible for this Policy and for privacy requests. You can reach the DPO at studiovaultph@gmail.com with the subject line “Privacy Request” or “DPO”. Our postal address is available on request.

This Policy explains how we handle personal data when you visit our marketing site, create or use a StudioVault account, visit a studio’s storefront that we host, contact support, or receive email from us.

It covers the personal data of:

• studio owners, managers, and staff who use the dashboard;
• customers who create an account, book, or buy from a studio through its storefront; and
• visitors to our websites and people who contact us.

It does not cover a studio’s own handling of your data outside the platform — for example a paper form, a walk-in booking, or a service the studio provides after your session. Each studio publishes its own privacy notice, and that notice governs the studio’s processing. It also does not cover third-party websites we link to, such as a payment provider, Google Maps, or WhatsApp.

Studios are the controller for their customer data. When a studio uses the Services to collect and manage its customers, the studio decides what data to collect, why, and how long to keep it. StudioVault is a personal information processor for that data and acts on the studio’s documented instructions — these Terms, this Policy, and the settings the studio chooses. We do not use a studio’s customer data for our own marketing.

We are the controller for our own account and platform data. We decide how to handle your login and account details, your studio’s subscription and billing records, support conversations, and the technical and security records of how the platform is used. We are also the controller for the limited processing needed to keep the platform secure, prevent fraud and abuse, and comply with the law.

If you are a customer, start with your studio. The studio is the controller for your booking, waiver, and membership records, so it is best placed to answer questions about them. You can still contact us: we will route studio-controlled requests to the studio and answer requests for data we control. Section 13 explains your rights.

The categories below describe the personal data we handle. What applies to you depends on your role.

Account and identity data. Your name, email address, mobile number, profile photo, and account role. We do not store your password in readable form; authentication is handled by our authentication provider using hashed credentials. If you sign in with Google, we receive your Google account identifier, name, email address, profile picture, and whether Google has verified the email. We also keep sign-in records, one-time codes sent to your email, and security events such as failed sign-in attempts.

Studio and business data. Your studio’s name, registered company name and number, industry, business contact email and phone number, address and map coordinates, branches and opening hours, logo, banner, gallery images, description, amenities, equipment, prices, policies, class and service descriptions, website content, custom domain, social and WhatsApp links, and your subscription plan and status. It also includes the payment settings a studio configures, such as its GCash or Maya QR image, which may show an account name or number.

Customer profile data. Your name, email address, mobile number, date of birth, gender, home address and map coordinates, emergency contact name and phone number, profile photo, and marketing preferences. Where a studio asks for it, it also includes health information — such as injuries, medical conditions, pregnancy, or answers to a physical-activity readiness questionnaire — together with the waiver version you accepted, your drawn signature, and the IP address recorded when you accepted it.

Booking and transaction data. The classes, appointments, and sessions you book; the studio, branch, and instructor; dates and times; attendance and check-in times; credits, memberships, packages, referrals, and rewards; amounts, payment method, payment status and reference numbers; proof-of-payment images you or a studio upload; refunds, cancellation reasons, and notes attached to a booking.

Records a studio keeps about you. Customer tags, staff notes, visit history, and progress photos with any notes attached. Studio staff create these records; we store them for the studio.

Communications and support. Messages you send through our contact and support forms, support tickets, emails, and demo or callback requests, including any attachments.

Technical and security data. IP address, device and browser information, approximate location derived from your IP address, the pages and features you use, timestamps, session records, audit logs of actions taken in a studio account, and error and performance logs.

What we do not collect. We do not ask for or store full payment card numbers or bank credentials. Card payments are handled directly by the payment provider a studio connects, such as PayMongo or Xendit. We do not buy personal data from data brokers.

We collect personal data in these ways:

• From you. When you create an account, complete your profile, book a session, sign a waiver, upload a payment proof, subscribe to marketing, or contact us.
• From your studio. Studio staff can add you as a customer, record your attendance, write notes, upload progress photos, and record payments. If you are a customer and are unsure why a studio holds a record, ask the studio.
• Automatically. When you use the platform, our servers and our providers record technical and security data, and we set the cookies described in section 8.
• From Google. If you choose Google sign-in, Google shares the account details described in section 4. We also use Google Maps to convert a studio address into coordinates.
• From payment providers. When a studio enables PayMongo or Xendit, the provider tells us whether a payment succeeded and gives us a reference. We do not receive your card details.
• From other users. A referral code links two existing accounts. We do not ask you for a friend’s contact details to send them marketing.

We use personal data to:

• Create and secure accounts. Register you, authenticate you, send one-time codes, enforce session and password rules, and detect suspicious sign-ins.
• Provide the Services. Host a studio’s website and storefront, publish its schedule, take bookings, manage memberships, packages, credits, retail items, client records, staff, payroll and commission records, and produce the reports a studio asks for.
• Keep booking records. Record bookings, check-ins, cancellations, waivers, and payment status so a studio can run its business and resolve disputes.
• Bill studios. Take, check, and reconcile subscription payments, apply plan limits, manage trials, and issue receipts.
• Communicate. Send service messages, security alerts, booking and payment confirmations, and responses to your questions.
• Keep the platform safe. Prevent fraud, verify payment proofs, stop abuse and automated attacks, enforce rate limits, and maintain audit logs.
• Comply with the law. Keep tax, accounting, and corporate records, respond to lawful requests from authorities, and enforce these Terms.
• Improve the product. Understand which features are used, diagnose errors, plan capacity, and test changes, using aggregated or de-identified information where we can.
• Market StudioVault. Send studio owners product news and offers where the law allows, with an unsubscribe link in every message. We do not market to a studio’s customers on our own behalf.

We do not sell personal data. We do not use studio customer data for advertising. We do not make automated decisions that produce legal or similarly significant effects about you: features that sort, filter, or flag records are assistive, and a person reviews suspensions, payment disputes, and account closures.

Under the Data Privacy Act we need a lawful basis for each purpose. The table below maps our purposes to those bases.

Accounts and the Services

Performance of our contract with you, and steps you ask for before entering it.

Bookings, waivers, and studio records

Performance of the contract with the studio and its customer, on the studio’s instructions. Health information and waiver signatures rely on the explicit consent the studio obtains, or another basis the studio identifies.

Billing and receipts

Performance of the contract, and our legal obligation to keep tax and accounting records.

Security, fraud prevention, and audit logs

Our legitimate interests in protecting the platform and its users, and our legal obligation to keep records of certain activities.

Service messages and support

Performance of the contract, and our legitimate interest in responding to you.

Product improvement

Our legitimate interest in improving the Services, using aggregated or de-identified information where practicable.

Marketing email

Your consent, or our legitimate interest in communicating with existing business contacts, always with an opt-out. You can withdraw consent at any time.

Legal claims and compliance

Our legal obligations, and our legitimate interest in establishing, exercising, or defending legal claims.

Optional cookies

Consent, where we introduce a cookie that is not strictly necessary.

Where we rely on legitimate interests, we balance them against your rights and expectations, and you may object as described in section 13. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing that already happened.

You are not required by law to give us your personal data. But if you do not provide what an account, booking, waiver, or payment needs, we may not be able to create your account or complete that booking.

A cookie is a small file a site stores in your browser. We use a small number of first-party cookies, all of them for signing you in or remembering a choice you made.

Authentication cookies

Set by our authentication provider and named with an sb- prefix. They keep you signed in and protect your session. They last for your session or until you sign out.

sb_auth_context

Remembers which studio and branch you were signing in to while you complete Google sign-in. Expires after 10 minutes.

remember_me_pref

Remembers whether you ticked “remember me” while you are on the sign-in page. Expires after 10 minutes.

last_studio_slug

Remembers the last studio storefront you visited so we can return you there after sign-in. Expires after 7 days.

preferred_outlet_<studio>

Remembers the branch you selected on a studio’s storefront. Expires after 30 days.

sv_announce_<studio>

Remembers that you dismissed a studio’s announcement banner. Expires after 1 year.

We do not run advertising or cross-site tracking cookies, advertising pixels, or third-party analytics on this site. Section 14 explains how to control cookies in your browser.

We share personal data only where we need to, and never by selling it. The recipients are:

• The studio and its staff. Staff with the right permissions can see the customers, bookings, notes, and payment records of their own studio. They cannot see another studio’s records.
• Our service providers. Companies that host and run the platform for us: Supabase (database, authentication, and file storage), Vercel (hosting, content delivery, and domains), Resend (email delivery), and Google (Maps lookups for studio addresses, and Google sign-in if you choose it). When a studio enables online payments, PayMongo or Xendit processes the payment on the studio’s account. These providers act on our instructions and are bound to protect the data.
• Professional advisers. Lawyers, accountants, and auditors, where needed and under confidentiality obligations.
• Authorities. Courts, regulators, and law enforcement where the law requires it, or where we need to protect someone’s safety or our legal rights. We review each request and disclose only what is required.
• A successor business. If StudioVault is merged, acquired, or sells its assets, data may transfer to the successor, which must continue to honour this Policy.

Public content. Information a studio publishes is public — for example its class schedule, instructor bios, photos, prices, and address. Do not publish anything you want to keep private.

We do not share personal data with advertising networks or data brokers, and we do not allow a payment provider to use your data for its own marketing.

Our providers may store or process personal data outside the Philippines, including in the United States, Singapore, and the European Union. When data leaves the Philippines, we remain responsible for it and require the recipient to protect it to a standard comparable to the Data Privacy Act, using contractual data-protection terms, access controls, and encryption in transit.

Where the law requires a specific transfer mechanism or notice for a particular transfer, we will use it. You can ask us for more detail about the safeguards that apply to your data by contacting our DPO.

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. What that means in practice:

• Studio accounts and website content. Kept while the account is active. After closure, we make data available for export for a reasonable period (normally 30 days), then delete it from live systems and remove it from backups within 90 days.
• Customer profiles and bookings. Kept while the customer’s account is active, and for as long as the studio needs its booking records. If a customer deletes their account, we remove the login and the customer’s own records and anonymise booking history the studio needs for its financial records.
• Waivers and consents. Kept by the studio as evidence for as long as the studio needs them to show what was agreed and to defend a claim. The studio decides this retention period.
• Billing, tax, and accounting records. Kept for at least the period required by Philippine tax and accounting rules, which is currently 10 years.
• Support conversations. Kept for up to 3 years so we can resolve a follow-up issue.
• Security and audit logs. Kept for up to 12 months, and longer where we are investigating an incident or need the record for a legal claim.
• Marketing preferences. Kept until you opt out, plus a suppression record so we do not contact you again by mistake.
• Aggregated statistics. We may keep de-identified, aggregated statistics, which no longer identify you.

Retention may be longer where a legal hold, dispute, investigation, or regulatory requirement applies. When we delete data, we do so in a way that makes it unrecoverable in the ordinary course.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, and alteration. These include:

• encryption in transit using TLS;
• hashed passwords and email one-time codes for platform sign-in;
• access controls in the application and database, including row-level rules that limit each studio to its own records;
• least-privilege access for staff and audited actions inside studio accounts;
• backups, monitoring, rate limiting, and logging of security events; and
• written data-protection commitments from the providers that process data for us.

No system is completely secure. If you believe an account has been compromised, or you have found a vulnerability, contact us immediately at studiovaultph@gmail.com. Please do not test a vulnerability against another person’s account or data.

Breach notification. If we become aware of a personal data breach, we will investigate, contain it, and notify the NPC and affected individuals within the periods NPC rules require — generally 72 hours for a covered breach. Where we process data for a studio, we will tell the studio without undue delay and give it the information it needs to meet its own notification duties.

Under the Data Privacy Act you have the right to be informed, to object, to access, to rectify, to erase or block, to claim damages, to data portability, and to complain to the NPC. In practice:

• Be informed about how your data is processed, which is what this Policy does.
• Object to processing based on legitimate interests, or to direct marketing at any time.
• Access a copy of the personal data we hold about you, and information about its source, recipients, and how it has been used.
• Rectify inaccurate or incomplete data. You can update most account details in your profile, or ask us.
• Erase or block data where the law allows it. Customers can download their data from the storefront profile page. For account deletion, follow the instructions and support link on that page. Studio accounts are closed through support so the business is not orphaned.
• Claim damages if the law has been breached and you have suffered loss.
• Portability — receive your data in a structured, commonly used, machine-readable format. Customers can export their data as JSON from their profile page.
• Complain to the NPC, as described in section 18.

How to make a request. Email studiovaultph@gmail.com with the subject “Privacy Request”. Tell us your name, the email address on your account, whether you are a studio or a customer, and what you want us to do. We may ask for proof of identity so we do not disclose data to the wrong person, and we will respond within 15 days of verifying your request, or the period the DPA and NPC issuances require. We do not charge a fee for a normal request.

Some rights have exceptions. We may refuse or limit a request where the law allows — for example where we must keep a tax record, where data is needed for a legal claim, or where the request would reveal another person’s data. We will explain the reason. If your data is controlled by a studio, we will forward the request to the studio and help it respond.

Your rights are transmissible: your heirs may exercise them after your death, as the DPA provides.

Email marketing. Every marketing email contains an unsubscribe link, and studio campaigns also honour the studio-specific opt-out recorded on your customer record. You can also change your marketing preference in your profile. Unsubscribing stops marketing but does not stop service messages, such as booking confirmations, payment notices, security alerts, and responses to your support requests.

Cookies. You can delete or block cookies in your browser settings. Blocking the authentication cookies will prevent you from signing in, and clearing the preference cookies only resets choices such as your selected branch. We do not run advertising or cross-site tracking cookies that would need a separate opt-out.

WhatsApp and social links. A studio’s storefront may show a WhatsApp button or social links. Those open the third-party app or site; the messages you send there go to the studio, not to StudioVault, and the third party’s privacy policy applies.

Studio storefronts are part of the Service, but each studio runs its own business. When you book or buy there, the studio is the controller for the data it collects, and its own privacy notice applies. Every studio is required to publish an accurate notice — usually at its/privacy-noticepage — and to obtain any consent it needs, including for health information and waivers.

We give studios the tools for that notice and for recording consent, but we do not write or verify their notice and we are not responsible for the studio’s own processing. If you have a question about a class, booking, refund, waiver, or a marketing message you received from a studio, contact the studio first.

Studio staff can see only their own studio’s records. Our support team may access data to resolve a ticket or fix a fault, and we restrict and log that access.

The Services are intended for studios and for adults. We do not knowingly allow anyone under 18 to create a Studio Account, and our marketing site is not directed at children. A Customer must be at least 18, or have a parent or guardian’s consent.

Studios may serve minors, for example in youth classes. In that case the studio is responsible for obtaining any parental or guardian consent the law requires and for handling the minor’s data lawfully. We process that data only as the studio’s processor.

If we learn that we have collected a child’s personal data without the required consent, we will delete it. If you believe that has happened, contact us at studiovaultph@gmail.com.

We may update this Policy as the Services or the law change. We will post the new version and update the date at the top of the page. If a change materially affects how we use personal data, we will give at least 30 days’ notice by email or in the dashboard before it takes effect, unless a shorter period is required by law or to address a security issue.

Changes do not apply retroactively to processing that has already happened. If you do not agree with an updated Policy, you may stop using the Services and cancel your plan; a studio may also close its account through support.

Privacy questions, data-subject requests, and complaints can be sent to StudioVault PH at studiovaultph@gmail.com with the subject “Privacy Request”, or through our Support page. Please include your name, the email address on your account, whether you are a studio or a customer, and what you would like us to do.

If you are not satisfied with our response, you may complain to the National Privacy Commission at privacy.gov.ph or complaints@privacy.gov.ph. The NPC is at the Philippine International Convention Center, Pasay City. We would appreciate the chance to resolve the issue with you first.