DRAFT — requires review by legal counsel before launch. Bracketed items are placeholders.

Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains how [COMPANY LEGAL NAME] ("RythmoLabs", "we", "us") handles personal information in the RythmoLabs platform: the studio management software used by dance and activity studios, and the parent portal families use to enroll, pay and stay in touch with their studio.

1. Who is responsible for your information

RythmoLabs is software that studios subscribe to. That gives us two roles:

• For studios' family and student data, we act on behalf of the studio. When a studio uses RythmoLabs to keep its roster, take registrations, bill families and message them, the studio decides what to collect and why. We process that information as the studio's service provider (a "service provider" or "processor") under our agreement with the studio, including the Studio Data Processing Addendum. Questions about a studio's practices should go to the studio first; we will help it respond.
• For our own account and platform data, we are responsible. This covers studio owner and staff accounts, platform billing for studio subscriptions, security logs, and the operation of the service itself.

Each studio runs on its own subdomain (for example yourstudio.rythmolabs.com) and its data is logically separated from every other studio's data.

2. Information we collect

Parents and guardians

• Account details: name, email address, phone number, postal address, password (stored only as a salted, peppered one-way hash), and profile photo if you add one.
• Emergency contact name, phone number and relationship.
• Family records: household members, enrollments, subscriptions, class bookings, waitlist entries, event tickets, store orders and account balances.
• Signed waivers: the signer's name, signature image, the signed PDF, the date, and the IP address and browser user agent at signing.
• Messages you exchange with the studio in the app or by SMS, and your notification and SMS opt-out preferences.
• Answers to registration questions the studio asks.
• Records of which version of our Terms and this policy you accepted, with the date, a truncated IP address and your browser user agent.

Children (students)

Parents or studio staff, not children, enter children's information. It can include:

• Name, date of birth, T-shirt size, profile photo, emergency contact, dance styles and level.
• Class enrollments, attendance, make-up credits, progress scores, achievements and events.
• Notes from the parent and notes from instructors.
• Costume assignments and body measurements submitted for costume sizing.

Children do not have accounts and do not use RythmoLabs directly.

Studio owners and staff

• Name, work email, phone number, role and permissions, and instructor profile details.
• Studio business details: studio name, address, logo, timezone, contact information, and Stripe account status.
• Activity in the admin portal, such as audit records of administrative actions.

Prospective families (leads)

When someone submits a studio's inquiry or trial form, or abandons an online registration, the studio receives a lead record: name, email, phone, the child's first name and age if provided, and the message.

Payments

Card and bank details are entered directly into Stripe's payment forms and are held by Stripe, not by us. We store Stripe identifiers (customer, payment method and payment IDs), the payment method type (for example "card"), amounts, discounts, refunds and status.

Technical information

• Session and security cookies: a sign-in session cookie and, before launch, an access-gate cookie. We do not use advertising or third-party analytics cookies.
• Web push subscription details (an endpoint URL and encryption keys) if you turn on notifications on a device.
• IP addresses used transiently for rate limiting and abuse prevention.
• Error reports when something breaks. These carry an internal user ID and an anonymized IP address, never request bodies, names or email addresses.

3. Children's data and parental consent

Our service is directed to studios and to adults. We collect information about children only from their parent or guardian, or from studio staff acting for the parent.

• Parental consent. Before a child profile is created in the parent portal, the parent or guardian must confirm they are the child's parent or legal guardian and consent to the studio collecting and using the child's information as described here. When studio staff create a student record, they confirm that the studio collected the parent's consent offline. We keep a record of each consent: who gave it, how, when, and which wording was shown.
• Who controls it. The studio is responsible for its relationship with the family and for obtaining consent where the law requires it. We provide the in-app consent flow and records to support that.
• Using it only to provide the service. Children's information is used only to run classes and related services for the studio: rosters, attendance, billing, costumes, recitals and communication with the parent. It is never used for advertising, never sold and never used to build profiles for unrelated purposes.
• Parents' rights. A parent can review and edit their child's information in the parent portal, ask the studio or us for a copy, and withdraw consent at any time from the child's profile. Withdrawing consent stops further collection and deletes or anonymizes the child's personal information; we may keep de-identified financial records the studio is legally required to retain.

Children's Online Privacy Protection Act (COPPA) note: [COUNSEL TO CONFIRM how COPPA applies, given that children do not use the service and information is collected from parents and studios, and whether the consent method above satisfies "verifiable parental consent" where COPPA applies.]

4. How we use information

• To provide the service: accounts, registration, scheduling, attendance, billing, waivers, events, store, costumes and messaging.
• To process payments through Stripe and send receipts and billing notices.
• To send transactional email, SMS and push notifications (for example verification codes, class reminders, payment notices and studio announcements). Studios decide which announcements to send; you can opt out of SMS by replying STOP.
• To secure the service: authentication, rate limiting, fraud and abuse prevention, error monitoring and audit logs.
• To support studios and families, and to improve and fix the product.
• To meet legal obligations and enforce our Terms.

We do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law.

5. How information is shared

• With the studio. Family and student data is available to the studio you enroll with and to its authorized staff, according to their roles. Instructors see what they need for their classes.
• With subprocessors. We use a small set of service providers to host and run the platform, listed on our Subprocessors page. They may only use the data to provide their service to us.
• Payments. Studios accept payments through their own Stripe account (Stripe Connect). Stripe receives your payment details and processes them under its own privacy policy as well as on our behalf.
• Legal and safety. When required by law, or to protect the rights, safety and property of users, studios, us or others.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may transfer under this policy's protections.

6. Retention

• Account and family data are kept while the account is active and while the studio remains a customer.
• When a studio's subscription ends, we return or delete the studio's data as described in the Studio Data Processing Addendum, within [30] days unless the law requires us to keep it longer.
• When a parent deletes their account, we delete or anonymize their personal information, except records the studio or we must keep for legal, tax or accounting reasons (for example payment records for [7] years).
• Withdrawn child consent leads to deletion or anonymization of that child's information as described in section 3.
• Backups are overwritten on a rolling basis within [BACKUP RETENTION PERIOD].
• Short-lived security data (verification codes, password reset tokens, rate-limit counters) expires automatically.

[COUNSEL AND OPS TO CONFIRM retention periods.]

7. Security

• Data is encrypted in transit (HTTPS) and at rest by our hosting and database providers.
• Each studio's data is isolated by tenant checks in the application and by Postgres row-level security.
• Passwords are hashed with Argon2id and a server-side pepper. Sign-in and other sensitive endpoints are rate limited.
• Staff access is role-based, and sensitive administrative actions are logged.
• Uploaded files (waivers, signatures, photos) are stored in access-controlled object storage, and uploads are bound to the uploading user.

No system is perfectly secure. If we learn of a breach affecting your information, we will notify the studio and you as required by law.

8. Your choices and rights

Wherever you live in the United States, you can:

• Access and correct most of your information, and your children's, in the parent portal.
• Export your data or ask us for a copy.
• Delete your account and personal information, subject to the exceptions in section 6.
• Opt out of SMS by replying STOP, and turn off push notifications in your device or browser settings.

California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only to provide the service); and not to be discriminated against for exercising these rights. The categories we collect are listed in section 2, the sources are you, your studio and our service providers, and the purposes are listed in section 4. We have not sold or shared personal information in the past 12 months.

Other states

Residents of other states with consumer privacy laws (for example Colorado, Connecticut, Virginia and Utah) have similar rights to access, correct, delete and obtain a copy of their data, and to appeal our decision on a request by replying to our response.

Making a request

Use the account settings in the app, or email [privacy@COMPANY.com]. We will verify your identity, usually by confirming control of the email address on the account. You may use an authorized agent, who must show written permission. If the request concerns a studio's family or student data, we may pass it to the studio, which decides how to respond, and help the studio fulfil it.

9. Changes to this policy

When we make material changes, we will update the version date at the top of this page and ask signed-in users to review and accept the new version before continuing.

10. Contact

[COMPANY LEGAL NAME] [ADDRESS] [privacy@COMPANY.com]