ClassKeep ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect when you use the ClassKeep platform, why we collect it, how we use and share it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Brazilian Lei Geral de Proteção de Dados (LGPD).
Who is the controller
For studio admins and instructors, ClassKeep is the data controller. For students booking classes via a studio's page, the studio is the controller and ClassKeep acts as a data processor under a Data Processing Addendum (DPA).
What we collect
- Account data: name, email, hashed password, profile image, locale, and OAuth identifiers (Google).
- Studio data: studio name, branding, schedule, class types, resources, opening hours, and Stripe Connect account references.
- Booking and payment data: bookings, attendance, credit ledger, subscriptions, and Stripe payment metadata. Card details are handled and stored by Stripe; we never see them.
- Operational data: device, IP address, and minimal request logs used to run the service and detect abuse.
- Optional analytics: with your consent, we use PostHog in the browser for page views and Google Analytics (GA4) for aggregate marketing reach. When PostHog is configured, we also send first-party product events from the server (sign-up, booking, payment) using opaque account ids — not email, name, or phone — so we can operate and improve the product.
Legal bases
- Performance of a contract — to provide the ClassKeep service to studios and students.
- Legitimate interests — to keep the service secure, prevent abuse, and improve features.
- Consent — for optional analytics and marketing communications.
- Legal obligation — for tax, accounting, and compliance requests from authorities.
How we share data
We share data with subprocessors strictly to deliver the service: Stripe (payments), our hosting provider (Coolify on a self-managed VPS), Contabo (S3-compatible storage), fortuly.cloud (transactional email), Firebase Cloud Messaging (mobile app push), Sentry (error monitoring), PostHog (product analytics: client pageviews with consent; server conversion events with opaque ids when configured), and Google Analytics (aggregate traffic analytics, with consent). We do not sell your data.
Where we store data
Primary storage is hosted in Europe and the United States. By using ClassKeep you agree to the international transfer of your data, protected by the safeguards described in our DPA.
Retention
We retain account and studio data for as long as the account is active. After deletion we keep anonymized usage records for up to 12 months for security analysis, and financial records for the period required by tax law (typically 5 years in the US and Brazil).
Your rights
Under GDPR and LGPD you have the right to access, rectify, port, and erase your personal data, to object to or restrict processing, and to withdraw consent at any time. ClassKeep provides self-serve data export and account deletion in your account settings (studio admin) and student profile (student). For all other requests, write to privacy@classkeep.app.
Contact
Privacy questions and requests: privacy@classkeep.app. We respond within 30 days.