Privacy Policy

1Overview

StudioFlare ("we," "us," or "our") is a studio management platform. This Privacy Policy describes how we collect, use, store, and share information about you and your students when you use our platform at studioflare.io and related subdomains.

By using StudioFlare, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, you should not use the platform.

As a studio operator, you are the data controller for your students' and parents' information — you determine how that information is collected and used within your studio. StudioFlare acts as a data processor, handling that information on your behalf in accordance with your instructions and this policy.

2Information We Collect

2.1 Account Information (Studio Admins)

When you register as a studio administrator, we collect:

• Name and email address
• Studio name and chosen subdomain (slug)
• Phone number (optional)
• Password (stored as a one-way cryptographic hash)
• Email verification status and account creation timestamp

2.2 Parent & Student Information (Entered by Studio)

Studio administrators enter information about their students and families through the platform. This may include:

• Parent name, email, and phone number
• Student names, dates of birth, age, and grade
• Medical information, allergies, and emergency contacts (as entered by parents)
• Student photos (uploaded for check-in purposes)
• Registration and enrollment records
• Waiver and form signatures, with timestamps and IP addresses

2.3 Payment Information

All payment processing is handled by Stripe, Inc. StudioFlare does not store full credit card numbers or bank account details. We may retain limited payment metadata such as the last four digits of a card, card brand, and Stripe customer/payment IDs for billing reference purposes.

2.4 Usage & Technical Information

We automatically collect certain technical information when you use the platform:

• IP address and general geographic location (country/region)
• Browser type, operating system, and device type
• Pages visited, features accessed, and timestamps
• Session identifiers for active visitor analytics (anonymized, stored in memory only)
• Error logs and diagnostic information

2.5 Communications

If you contact us via email or through the in-platform support form, we retain the content of your messages along with your contact information and studio details to provide support and improve our service.

3How We Use Information

We use the information we collect to:

• Provide and operate the Service — process registrations, manage subscriptions, send transactional emails, and enable all platform features;
• Authenticate and secure accounts — verify identities, detect unauthorized access, and enforce our Terms of Service;
• Process payments — facilitate subscription billing and pass payment details to Stripe for processing;
• Send communications — deliver account notifications, verification emails, billing reminders, and support responses;
• Send SMS messages — when you use our SMS features, we transmit your messages through Twilio on your behalf;
• Improve the platform — analyze usage patterns, diagnose issues, and develop new features using aggregated and anonymized data;
• Comply with legal obligations — respond to lawful requests from government authorities and fulfill our legal obligations.

We do not use your data or your students' data for advertising, nor do we sell personal information to any third party.

4Information Sharing

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

4.1 Service Providers

We share data with trusted third-party providers who assist in operating the platform:

• Stripe — payment processing and Stripe Connect for studio payouts
• Twilio — SMS message delivery
• Resend — transactional email delivery
• DigitalOcean — cloud infrastructure and database hosting
• Cloudflare — DDoS protection, CDN, and bot detection

These providers are contractually obligated to use your data only to provide services to us and may not use it for their own purposes.

4.2 Legal Requirements

We may disclose information if we believe in good faith that disclosure is required by law, to protect the rights or safety of StudioFlare, our users, or the public, or to respond to a valid legal process such as a court order or subpoena.

4.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business transaction, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the platform before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information in other circumstances with your explicit prior consent.

5Student Data

Student data entered into the platform — including names, ages, medical notes, emergency contacts, and photos — is owned by the studio operator and their families. StudioFlare processes this data solely to provide the studio management features you have configured.

We do not access, analyze, share, or monetize student data beyond what is strictly necessary to operate the platform. We do not use student data to train machine learning models or for advertising purposes.

Studio operators are responsible for obtaining appropriate consent from parents and guardians before entering student information into the platform, including compliance with the Children's Online Privacy Protection Act (COPPA) and any applicable state laws.

6Cookies & Tracking

StudioFlare uses the following types of cookies and local storage:

• Authentication tokens — stored in localStorage to keep you logged in across sessions. These are essential for the platform to function.
• Cloudflare cookies — used by Cloudflare Turnstile to distinguish humans from bots during account registration and login.
• Preference cookies — used to remember your UI preferences (e.g., dismissed onboarding prompts).

We do not use third-party advertising cookies or tracking pixels. You can disable cookies in your browser settings, but doing so may prevent you from logging in or using core platform features.

7Data Security

We implement industry-standard security measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Passwords stored as one-way bcrypt hashes (never in plaintext)
• JWT-based authentication with token expiration
• Cloudflare bot protection and DDoS mitigation
• Regular database backups on DigitalOcean's managed infrastructure
• Email verification for studio admin accounts

Despite these measures, no security system is impenetrable. We cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you as required by applicable law.

8Data Retention

We retain your account information and studio data for as long as your account is active. If you cancel your subscription or your account is terminated:

• Your data is retained for up to 15 days to allow for data export or account reactivation;
• After 15 days, your data may be permanently and irreversibly deleted from our systems;
• Some data may be retained longer if required by law or for legitimate business purposes (e.g., billing records for tax compliance).

We are not liable for any loss of data resulting from account termination or the expiration of the retention period. You are strongly encouraged to export your data before closing your account.

9Your Rights & Choices

Depending on your location, you may have certain rights regarding your personal data:

• Access — request a copy of the personal data we hold about you;
• Correction — request that we correct inaccurate or incomplete data;
• Deletion — request deletion of your personal data, subject to our retention obligations;
• Portability — request your data in a portable format;
• Opt-out of non-essential emails — unsubscribe from marketing communications at any time using the link in those emails.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Note that certain data — such as billing records and fraud prevention data — may be retained regardless of deletion requests where retention is required by law.

10Children's Privacy

StudioFlare's platform is intended for use by adults operating studios. We do not knowingly collect personal information directly from children under 13. Student information entered into the platform is submitted by the studio operator and/or the child's parent or guardian, not by the child directly.

Studio operators are responsible for ensuring they have appropriate parental consent before entering any information about minors into the platform and for complying with COPPA and all applicable laws governing the collection of children's data.

11Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of the platform after changes are posted constitutes your acceptance of the revised policy.

12Contact Us

If you have questions, concerns, or requests related to this Privacy Policy, please contact us:

StudioFlare
Email: [email protected]

We will make every effort to respond to your inquiry within 5 business days.