Privacy Policy
Last Updated: October 13, 2025
Introduction
This Privacy Policy explains how Graceful Space Yoga ("we", "us", "our") collects, uses, discloses, and safeguards your personal information when you use our website gracefulspaceyoga.com (the "Site") and our services, including creating an account, purchasing class passes, and booking/attending in‑person yoga classes (the "Services"). It also explains your rights and choices.
Please read this Privacy Policy together with our Terms & Conditions.
Table of Contents
1. Who We Are
Graceful Space Yoga provides Vinyasa flow yoga classes and an online booking system. We operate in the UK. References to "we", "us" or "our" are to Graceful Space Yoga.
2. Information We Collect
The types of information we collect depend on how you use the Site and Services:
- Account Information: name, email address, password (hashed), and optional profile details.
- Booking & Purchase Information: class selections, class pass purchases, Stripe checkout session identifiers, payment status and records associated with your bookings.
- Health Information (optional): during registration you may provide information about health conditions relevant to practicing yoga. This is special category data and is entirely optional.
- Communications: messages you send to us and related contact details.
- Technical & Usage Data: IP address, browser type, device information, pages viewed, and interactions with the Site. This may be collected via logs and analytics.
- Cookies & Similar Technologies: see the Cookies section below.
3. How We Use Your Information
- Provide, operate, and maintain the Site and Services.
- Create and manage user accounts.
- Process purchases of class passes and manage class bookings and attendance.
- Communicate with you about your bookings, passes, account updates, and service notices.
- Improve the Site and Services, including safety, performance, and user experience.
- Comply with legal obligations and enforce our Terms.
- With your explicit consent, consider any health information you provide to support safe participation in classes.
4. Legal Bases (UK/EU)
- Contract: to create your account, process payments, and provide booked classes.
- Legitimate Interests: to secure our Site, prevent misuse, and improve our Services.
- Legal Obligation: to maintain records required by tax and accounting laws.
- Consent: for optional activities such as certain analytics cookies (where applicable), marketing communications, and processing of special category data (health information) you choose to provide.
5. Cookies and Similar Technologies
We use cookies and similar technologies to operate and secure the Site (e.g., session and security cookies), to remember your preferences, and to understand how the Site is used. You can usually control cookies through your browser settings. Disabling cookies may affect core functionality like sign‑in or bookings.
6. Analytics
We may use analytics tools to understand usage and improve the Site. Our configuration allows connections to PostHog (a product analytics platform). Analytics may collect pseudonymous usage information such as pages viewed, actions taken, and basic device data. Depending on your location, analytics may rely on our legitimate interests and/or your consent, particularly where cookies are used.
7. Payments
We use Stripe to process payments. When you purchase a class pass or complete checkout, certain information is shared with Stripe (such as your email, amount, currency, and order identifiers). Stripe is a separate controller/processor for your payment data and processes it in accordance with its own privacy policy. We do not store full payment card numbers on our servers.
For more information, please refer to Stripe's Privacy Policy at stripe.com.
8. Disclosure of Information
We share information only as needed to provide the Services, comply with the law, protect our rights, or with your consent. This includes:
- Service Providers and Partners: e.g., Stripe for payments; analytics providers (e.g., PostHog) where enabled.
- Legal and Compliance: when required by applicable law or to respond to valid legal requests.
- Business Transfers: in connection with a reorganisation or similar event, consistent with this Policy.
9. International Transfers
Our service providers may process information outside of the UK. Where applicable, we rely on appropriate safeguards such as standard contractual clauses, adequacy regulations, or other lawful transfer mechanisms.
10. Data Retention
We retain personal information for as long as necessary to provide the Services and for legitimate and legal purposes (e.g., tax/accounting). Health information, if provided, is retained only as long as needed to support your participation or until you withdraw consent, whichever occurs first, subject to any legal obligations.
11. Security
We take reasonable technical and organisational measures to protect your information. No online service can be completely secure. You are responsible for keeping your account credentials confidential.
12. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your data, and to object or restrict certain processing. Where processing is based on consent, you can withdraw consent at any time. To exercise your rights, please contact us using the details below.
13. Children
Our classes are for adults. If we learn we have collected personal information from a child without appropriate consent, we will take steps to delete such information.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates the latest revision. Significant changes will be communicated via the Site. Your continued use after changes indicates acceptance of the updated Policy.
15. Contact
If you have questions about this Privacy Policy or how we handle your data, please contact us via the details provided on our Site.