Privacy policy

1. Who this policy covers

This policy applies to the YogaSwiss customer app, the YogaSwiss Studio host app, and YogaSwiss websites and account services. YogaSwiss is responsible for the personal data it processes to operate these services. You can contact the YogaSwiss team at hello@yoga-swiss.ch or through our contact page.

The customer app offers public discovery; an account is needed for personal bookings and account functions. Studio is a free, invitation-only workspace for hosts and authorised teams. An invitation determines membership and permissions, not a paid entitlement.

Teachers and studios are responsible for their own services and for personal data they use independently, such as their attendance records, payment arrangements and direct communications. Their own privacy notices may also apply. We do not give every community member access to your account or bookings.

2. Data we collect and why

Data comes from information you submit, actions you take, authorised hosts managing their classes, and the technical requests needed to operate the service.

• Account and authentication: email address, name, account identifiers, Firebase identity, verification/session information and, if supplied, telephone number. We use these to sign you in, protect the account, provide support and send service messages. You can sign in using a Firebase magic link or an email address and password. Passwords are sent directly to Firebase Authentication for verification; YogaSwiss does not store your password in its Django database or on your device. Password setup and reset are handled by Firebase through an email sent to your address. Magic-link sign-in remains available without a password.
• Profile information: profile photograph and other fields you choose to supply, which may include address, date of birth, gender, emergency contact information or health notes where the service offers those fields. These support the services you request. Do not submit unnecessary sensitive information. Health notes and emergency details are not needed for public discovery; contact us to remove information you previously supplied.
• Bookings and participation: selected city, class and provider, booking/waitlist status, appointment requests, attendance, cancellations and related messages. We use these to organise your practice and allow the relevant host to provide the service.
• Provider service records: credit balances, memberships, payment references, amounts, status, receipts and refund records where applicable. These reconcile a teacher's or studio's services; they are not paid YogaSwiss app entitlements.
• Studio operations: organisation membership, assigned role, invitations, classes, locations, customer records and changes made by authorised staff. We use these for administration, permission checks, operational reports and audit history.
• Public provider content: teacher/studio names, biographies, professional details, photographs, schedules and venue addresses intended for publication are shown in discovery and may be indexed by search engines. Private customer records are not public profiles.
• Support and requests: correspondence, deletion requests and identity confirmation needed to respond and prevent unauthorised changes.
• Technical and usage information: IP address, request time, browser/device information, pages or API routes accessed, errors and relevant security events. These help deliver the service, prevent abuse, diagnose faults and understand use. Website analytics are described separately below.

Where a legal basis is required, we process data to provide the service you request, meet legal duties, protect legitimate interests such as security and support, or with your consent where required. Optional marketing consent is separate from essential sign-in, booking and security communications.

3. Teachers and payments

YogaSwiss is a community aggregator. All payments for teachers' classes and services are managed directly by the teachers/providers, who set their prices, service terms and payment arrangements. YogaSwiss does not charge for unlocking app functionality, a premium tier or a software subscription.

Where an eligible provider service uses an integrated hosted checkout, the platform can pass the booking reference and necessary customer/order details to the payment processor and receive the resulting payment status. Stripe processes card details on its hosted payment surface. YogaSwiss does not store full card numbers or card security codes. Payment references and service records may still be stored to keep bookings and provider accounts accurate.

For questions about a class charge, refund or provider-held payment record, contact the teacher or studio. Contact YogaSwiss for personal data held in your platform account. Deleting a YogaSwiss account does not automatically reverse a payment or cancel a booking.

4. Who receives data

We do not sell your personal data. We share information needed for the purposes described here:

• The relevant teacher/studio and authorised team: booking identity/contact details, attendance, service entitlements and relevant requests needed to deliver and administer that provider's services. Access is limited by organisation and role.
• Hosting and infrastructure: the Django application and its data services are hosted on Webi infrastructure. Hosting, storage and network providers process requests and stored data to run YogaSwiss.
• Google Firebase Authentication: email address, authentication identifiers and technical/security information used to verify identity and maintain sign-in. See Firebase privacy information.
• Email delivery: Resend and configured email infrastructure process recipient addresses, transactional message content and delivery status for sign-in links, invitations and service emails. See Resend's privacy policy.
• Payment processing: Stripe receives the information needed for an eligible provider checkout; its own privacy notice applies to its processing. See Stripe's privacy policy.
• Website tools: Google Analytics and Hotjar support website measurement; Sentry may receive technical error information where configured. Tally processes information you submit through embedded contact or partner forms. These tools are distinct from the native apps' core booking functions.
• Legal and security recipients: when necessary to comply with law, respond to valid legal requests, protect people or investigate misuse.

We require service providers acting on our behalf to use personal data only for the agreed purposes, apply appropriate confidentiality and security safeguards, and provide protection consistent with this policy and applicable requirements. Independent teachers, payment providers and external services also have responsibilities under their own privacy notices. External links or opening a teacher's website do not grant that service general access to your YogaSwiss account.

5. Device storage and permissions

The native apps store session credentials using secure device storage. Language, selected city/studio, saved teacher/studio favourites, pending sign-in email and request-retry identifiers may be stored locally to keep the experience consistent. Device-local favourites are not a public profile. Signing out clears the app's stored account session; other local preferences can remain.

City selection is manual. The current native apps do not require precise GPS location, contacts, microphone, camera, HealthKit data or advertising identifiers for their core functions. They do not include advertising tracking across other companies' apps and websites. Viewing a venue address is not the same as collecting your device location.

You control system permissions in your device settings. Removing an app does not itself delete your server-side YogaSwiss account; use the deletion process below. Provider images and network responses can be cached by your device for display.

6. Website analytics and cookies

The website uses cookies and browser storage for sessions, language and preferences. It also uses first-party activity measurement, Google Analytics for page/interaction statistics, and Hotjar for interaction analysis such as heatmaps and session recordings. These web tools can process browser/device information, page visits, interaction events and cookie identifiers. They are separate from the native apps; a web page opened from an app follows the website's practices.

You can block or remove cookies and site storage in your browser, use content-blocking controls, and use Google Analytics' opt-out tool. Blocking essential storage may affect sign-in and preferences. You can also contact us to withdraw optional processing consent or request information about website data associated with you. This privacy-policy page does not load Google Analytics, Hotjar or our page-activity tracker.

If you open a Tally form or an external community service such as WhatsApp, that provider processes the information you choose to submit under its own notice. Joining a community chat is optional and can expose your profile or contact details to other members according to that service's settings.

7. Optional ChatGPT connection

The separate YogaSwiss ChatGPT integration is optional. The mobile apps do not automatically send your account data to ChatGPT. If you explicitly connect your account and invoke the integration, OpenAI receives the tool inputs/results needed for your request, which can include class information, bookings, memberships, credits and waitlist status.

The integration uses short-lived access tokens and opaque references rather than exposing internal database identifiers in the conversation. Card details are not sent to ChatGPT. Provider payments are completed in hosted web payment flows, not in the ChatGPT integration. Disconnect the integration in ChatGPT's connected-app settings and contact YogaSwiss if you need linked access revoked. OpenAI's own privacy controls govern data already held in your ChatGPT account.

8. Retention and security

We retain account and service records while needed to operate your account, deliver requested services and resolve support issues. When no longer needed, personal data is deleted or anonymised, subject to legal retention duties and legal holds. Records required for accounting, tax or disputes may need to be kept for up to ten years; this is not a blanket retention period for all profile data.

Deletion requests are processed within 30 days. We retain only the limited evidence of a request and any records needed to meet legal duties, resolve disputes or demonstrate its handling. Retained records are restricted and are not used to keep your account active. Backup copies are not used as active customer records and are removed through the backup lifecycle; deletion must be respected if a backup is restored.

For the separate ChatGPT integration, authorisation codes expire after ten minutes, access tokens after one hour and refresh tokens after thirty days. Its production diagnostic logs are designed to exclude access tokens, email addresses and raw database identifiers and are retained for no longer than thirty days.

Safeguards include encrypted network connections, authentication, role-based access and secure device credential storage. No internet service can guarantee absolute security. Keep sign-in links private: possession of a valid email link can allow access to the associated account.

9. Delete your account

1. YogaSwiss customer app: open You → Settings → Delete account.
2. YogaSwiss Studio: open More → Request account deletion.
3. Confirm your account email and submit the deletion request. The app displays the request status and due date.

This requests deletion of your YogaSwiss account and associated personal data across YogaSwiss, including Studio access. It is not merely a sign-out or temporary deactivation. We process the request manually within 30 days and email confirmation when completed. You may continue using the account while the request is being processed.

Only records we must retain for legal reasons are excepted, with access restricted. Teachers may independently retain service records where they have a lawful obligation to do so. Account deletion does not automatically cancel upcoming bookings, request refunds or remove content already held by independent services. Please manage bookings with the relevant provider before submitting.

If you cannot sign in, email hello@yoga-swiss.ch with “YogaSwiss account deletion”. We may ask for proportionate identity verification to prevent someone else deleting your account. Do not send passwords, card details or sign-in links.

10. Your choices and rights

Depending on applicable law, you can request access to your personal data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. You can withdraw consent for optional processing without affecting the lawfulness of processing already carried out. Contact hello@yoga-swiss.ch; we may verify your identity before disclosing or changing personal data.

You can browse public classes without registering, edit available account fields, remove saved favourites and change language/city preferences. Use unsubscribe controls in optional marketing messages or contact us to stop them. Essential security, sign-in and booking messages are separate. Withdrawing data necessary to operate an account may mean we can no longer provide that account service.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or another competent data-protection authority.

11. International processing

Our service providers may process data in Switzerland, Europe, the United States or other countries where they operate. A Swiss class listing does not mean that every authentication, email or infrastructure operation takes place in Switzerland. Where required, transfers must rely on recognised adequacy decisions or appropriate safeguards such as contractual data-protection clauses. Contact us for information about the providers and safeguards relevant to your data.

12. Children

Our account services are not intended for children under 13. We do not knowingly collect account information from children under 13. If you believe a child has supplied personal data, contact us so we can investigate and remove it where appropriate. A teacher's age requirements for attending a class are separate from eligibility to create an app account.

13. Contact and updates

For privacy, access, correction or deletion requests, contact the YogaSwiss team at hello@yoga-swiss.ch or use our contact page. Include enough information to identify the account or request, but no passwords, payment credentials or sign-in links.

We update this policy when our practices change. The date at the top identifies the current version. Material changes will be communicated through the service or other appropriate notice; where a new purpose requires consent, we will request it. This policy does not make teacher services free and does not replace a provider's booking or payment terms.