Privacy Policy

01Who we are

Posture Yoga Center LLC, registered in the United Arab Emirates at Unit 10B, Building 4, Golden Mile Galleria Mall, Palm Jumeirah, Dubai, UAE (“POSTURE.”, “we”, “us”, or “our”), operates the POSTURE. website, the POSTURE. mobile app for iOS and Android, and related services (together, the “Services”). We are the data controller for the personal data described in this policy, unless stated otherwise.

We are licensed by the Dubai Department of Economy and Tourism (DET) in mainland UAE. This policy is designed to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”). Where other privacy laws apply to you (for example the EU or UK GDPR when you visit from those regions), we respect the rights those laws give you.

02Information we collect

Information you give us:

• Account and identity — first and last name, email address, phone number, password (stored in hashed form), date of birth and profile photo if you add one.
• Bookings and purchases — class and appointment bookings, attendance, memberships, packages, gift cards, vouchers, refunds and billing history.
• Payment information — payments are processed by our studio-management provider Mindbody and its payment processor (Stripe). We never store full card numbers; we may receive a token, limited card details (such as card type and last four digits) and the payment status.
• Wellness and health information (optional) — details you choose to share, such as injuries or pregnancy, so instructors can keep you safe. We only process this with your explicit consent.
• Waivers and contracts — the liability waiver and membership agreements you sign.
• Communications — messages, emails, WhatsApp conversations, support requests, feedback and survey answers.

Information collected automatically:

• Usage data — pages and screens you view, buttons you tap, classes you browse, bookings and purchases you make, and the date and time of each action.
• Device and connection data — IP address, approximate location derived from your IP (city/country), browser type, device model, operating system, app version, language and time zone.
• Identifiers — cookie identifiers on the website, an app-instance identifier, a push-notification token and, only if you allow tracking, your device advertising identifier (Apple IDFA or Google Advertising ID).
• Diagnostics — crash reports and performance data from the mobile app.

Device features the mobile app uses only with your permission:

• Camera and photo library — to take or choose a profile picture. Only the photo you select is uploaded.
• Calendar — to add a class you booked to your device calendar. Calendar data stays on your device and is not sent to us.
• Face ID / fingerprint — to sign in quickly. Biometric matching happens entirely on your device; we never receive your biometric data.
• Notifications — to send booking reminders and studio updates. You can turn these off in your device settings.

We do not collect your precise (GPS) location.

03How we use your data and our legal bases

Where we rely on consent you can withdraw it at any time, in the app or by contacting us. Withdrawing consent does not affect processing that took place before.

04Analytics, advertising and tracking

We use the following third-party tools to understand how people use POSTURE. and to measure our marketing:

Advanced matching (website). If you are signed in on our website and have allowed marketing cookies, the Meta Pixel can include your name, email address and phone number with the events it sends. These details are hashed (converted into an irreversible code) in your browser before they reach Meta, and Meta uses them only to match events to Meta accounts for ad measurement and audience building. Meta acts as an independent controller for this data under its own privacy policy.

Your tracking choices in the mobile app:

• iOS — we ask for permission through Apple’s App Tracking Transparency prompt. If you choose “Ask App Not to Track”, we do not send events to Meta, we do not access your advertising identifier, and Google ad signals stay off. You can change this anytime in iOS Settings › Privacy & Security › Tracking.
• Android — we ask once whether you allow personalised ads. You can change your answer anytime in the app under Menu › Privacy › Personalised Ads, and reset or delete your advertising ID in Android Settings › Google › Ads.
• If you decline, Firebase still records anonymous usage statistics and crash reports so we can run and improve the app, but advertising storage, ad user data and ad personalisation are disabled.

Cookies on our website. When you first visit, a banner asks for your choice. Analytics and marketing cookies are only set if you allow them, and you can change your choice at any time using “Cookie settings” in the website footer:

Until you consent, we use Google Consent Mode, which may send Google basic signals without cookies or identifiers (for example, that a page was viewed) to help us estimate overall traffic, and the Meta Pixel sends nothing. We also use strictly necessary cookies (for example to keep you signed in) that the website cannot work without. You can also block or delete cookies in your browser settings, opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout), and manage how Meta uses your activity in your Facebook or Instagram ad preferences.

We do not sell your personal data for money. We do share limited activity data with Meta and Google for advertising measurement as described above, which you can control with the choices in this section.

05Who we share your data with

• Mindbody — our studio-management platform, which stores your client profile, bookings, memberships and payment records on our behalf.
• Stripe — processes card payments through Mindbody.
• Google (Firebase, Google Analytics) — analytics, crash reporting and push notifications.
• Meta Platforms — ad measurement and audiences, as described in the previous section.
• Service providers — cloud hosting, content management, email and SMS delivery, WhatsApp (Meta) for support conversations, and IT security. They act on our instructions under contracts that protect your data.
• Authorities and advisers — when required by law, court order or to protect the rights, safety and property of POSTURE., our clients or others.
• Business transfers — a buyer or successor if POSTURE. is involved in a merger, acquisition or sale of assets, subject to this policy.

06International transfers

Some of our providers (including Mindbody, Stripe, Google and Meta) process data outside the UAE, for example in the United States or the European Union. When we transfer data abroad we rely on the safeguards permitted by the PDPL, such as contractual protections and the providers’ own data-transfer commitments.

07How long we keep your data

• Account, booking and membership data — for as long as your account is active, and deleted or anonymised after you ask us to delete your account.
• Transaction and payment records — for the period required by UAE tax and accounting law (generally at least 5 years).
• Health information — until you remove it or withdraw consent, or your account is deleted.
• Analytics data — Google Analytics retains event data for up to 14 months; cookie lifetimes are listed above.
• Crash reports — up to 90 days.
• Support conversations — up to 24 months after your last contact.

08How we protect your data

We use encryption in transit (HTTPS/TLS), hashed passwords, access controls and trusted, certified providers to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant authorities of a breach where required by law.

09Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data — most details can be edited in your profile.
• Delete your account and personal data.
• Restrict or object to processing, including processing for direct marketing and advertising.
• Withdraw consent at any time.
• Receive your data in a portable format.
• Lodge a complaint with the UAE Data Office or the data protection authority where you live.

To exercise these rights, email us at studio@thisisposture.com. We may ask you to verify your identity and will respond within 30 days.

You can request deletion of your account at any time, from the app or the website: Delete your account.

10Children

The Services are not directed at children under 13 and we do not knowingly collect their personal data. Users under 18 should use the Services with the involvement of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

11Changes to this policy

We may update this policy from time to time. We will change the effective date at the top of this page and, for significant changes, let you know through the app, by email or on the website.

12Contact us

Posture Yoga Center LLC, Unit 10B, Building 4, Golden Mile Galleria Mall, Palm Jumeirah, Dubai, UAE. Email: studio@thisisposture.com.