Version 1.0 - September 2026

The Studio Online - Privacy Policy

Last updated: 10 September 2026

1. Who We Are

The Studio Online (thestudioonline.co.uk) is operated by Heidi Gardner, trading as The Studio Online, a sole trader based at Crabmill Lane, Norley, Frodsham, WA6 8JN ("we", "us", "our"). We're the data controller for the personal data described in this policy. We're registered with the Information Commissioner's Office (ICO) under registration number ZC239646.

Questions about this policy or how we handle your data: contact@thestudioonline.co.uk.

2. The Data We Collect

If you're a Subscriber

• Account details: name, email address, encrypted password

• Payment information, handled directly by Stripe - we don't store your full card details

• Subscription and usage data: which Instructors you're subscribed to, billing history

• Ratings and feedback you leave for Instructors

• Anything you send us, like support queries

• Technical data: IP address, device and browser type, cookie data (see Section 6)

If you're an Instructor, we additionally collect

• The identity and bio information you provide when applying

• Your qualifications and certifications, including primary certification and REPs/CIMSPA membership where applicable

• Proof of insurance (public liability and professional indemnity) and expiry dates

• Payout details via Stripe Express

• Your city, for matching to subscribers

• Content you upload - videos, class descriptions and related materials

Health-related information

We don't ask for health information. If you choose to mention an injury, condition or other health detail in the feedback you leave an Instructor, that Instructor and our team can see it. We only process it because you've chosen to share it, and you can ask us to remove it at any time. There's no need to include medical details in feedback.

3. How We Use Your Data

We use your data to:

• Provide and manage your account and subscription(s)

• Process payments and, for Instructors, payouts

• Match Instructors to subscribers by location

• Communicate with you about your account, classes, or Platform updates

• Vet and approve Instructor applications

• Improve the Platform

• Meet our legal and regulatory obligations

Our lawful bases for this are: performance of our contract with you (running your subscription or Instructor account), our legitimate interests (running and improving the Platform, preventing misuse), your consent (where you've opted in to marketing), and legal obligation (for example, tax and accounting records).

4. Who We Share Your Data With

We share data with the third parties who help us run the Platform:

• Stripe - payment processing and, for Instructors, payouts

• Mux - hosting and delivering class content

• Resend - account and transactional emails

• Klaviyo - marketing emails

• Vercel - hosting the Platform

• Supabase - database and backend infrastructure, including storing your account and profile data

Your Instructor

If you subscribe to an Instructor, that Instructor can see your first name, your progress through their classes, and any rating or feedback you leave them. Instructors are contractually required to use this only to run their classes on the Platform, to keep it confidential, and not to contact or market to you off the Platform.

We don't sell your personal data, and we only share what each provider needs to do their job.

5. International Transfers

Some of the providers listed above may process data outside the UK, for example in the US. Where that happens, we make sure appropriate safeguards are in place, such as Standard Contractual Clauses or the provider's own UK/EU adequacy arrangements.

6. Cookies

We currently use only strictly necessary cookies - the ones that keep you signed in and let the Platform function. These don't require your consent under UK law, but we tell you about them anyway.

We don't yet use analytics or marketing cookies. If we add them in future, our cookie banner will ask for your consent first, and this section will be updated to say what they are and why.

You can control or delete cookies through your browser settings at any time.

7. How Long We Keep Your Data

We keep your data for as long as you have an active account, and for a reasonable period afterward to meet legal, accounting or dispute-resolution needs - typically up to 6 years for financial records, in line with UK tax requirements. We delete or anonymise data we no longer need.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Correct inaccurate data

• Ask us to delete your data

• Restrict or object to certain processing

• Receive your data in a portable format

• Withdraw consent at any time, where we rely on it

To exercise any of these, email contact@thestudioonline.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

9. Children's Privacy

The Studio Online is an adults-only platform. We don't knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we'll remove it.

10. Security

We use reasonable technical and organisational measures to protect your data, including relying on Stripe for secure payment handling. No system is completely secure, but we take this seriously.

11. Changes to This Policy

We may update this policy as the Platform develops. We'll post the updated version here with a new "last updated" date.

12. Contact Us

Questions, requests or complaints about your data: contact@thestudioonline.co.uk.