Privacy

Two different roles

TimiTomi is used by studios to run their own business, so we handle personal data in two different ways.

For the studio owners, admins and instructors who sign in to TimiTomi, we decide how the data is used. In data protection terms we are the controller.

For the customers who book classes with a studio, the studio decides how the data is used and we only act on the studio’s instructions. In data protection terms the studio is the controller and we are the processor, under the data processing agreement at timitomi.com/dpa. If you booked a class and want your data removed, contact the studio first.

What we hold about studio users

When someone from a studio creates an account or is invited to one, we hold:

• Name, email address and profile picture.
• The Google account identifier, because signing in to TimiTomi is done through Google.
• The role in the studio, and which studio the account belongs to.
• For instructors, the pay details the studio enters: pay rates, account holder name, IBAN, tax number and date of birth.
• Sign-in records, such as the date of the last sign in.

What we hold about studio customers

A studio’s customers give their details to the studio when they book. On the studio’s behalf we hold:

• Name, email address, phone number and profile picture.
• Bookings, class packs, memberships, credits and order history.
• A Stripe customer identifier. Card numbers are held by Stripe and never by TimiTomi.
• Acceptance of the studio’s terms, including which version was accepted, the date, the IP address and the browser used.
• Notes the studio writes about the customer.

What we hold about visitors of this website

When you visit timitomi.com we collect usage analytics: the pages you view, roughly where you visit from, and the kind of device and browser you use.

Tools that store cookies or similar identifiers on your device run only after you agree to them in the cookie banner. Analytics that store nothing on your device run without asking.

Why we hold it

To provide the service the studio pays for: taking bookings, tracking credits, running the schedule, calculating instructor pay and sending the messages a booking requires. The legal ground is the contract with the studio.

To take payment for the TimiTomi plan itself, and to keep the invoices and records Romanian tax law requires. The legal grounds are the contract and our legal obligations.

To keep the service secure, to find and fix faults, and to answer support requests. The legal ground is our legitimate interest in running a safe, working service.

To understand how the website and the product are used, and to measure our own advertising. Where this needs cookies or similar identifiers, the legal ground is your consent.

Who we share it with

We use the following companies to run the service. Each one receives only the data it needs for its part.

• Stripe, for taking payments. Card details go straight to Stripe.
• Postmark, for sending email.
• Vonage, for sending SMS.
• Nylas, for connecting an instructor’s Google or Outlook calendar, when the instructor chooses to connect one.
• Supabase, for the database and for storing uploaded images. The data lives in the European Union.
• Google, for signing in, and for Google Analytics on this website.
• Meta, for measuring our own advertising on this website, only after you consent.
• OpenAI, for measuring the ads we run inside ChatGPT, only after you consent.
• PostHog, for product analytics and error reporting.
• Vercel, for hosting, and for visit counts that use no cookies.

We do not sell your data

We do not sell personal data. We use Google, Meta and OpenAI tools to measure our own advertising, only with your consent, and never with the data studios hold about their customers.

A studio can connect its own Google Analytics and its own Meta Pixel to its booking page. When it does, that studio decides what is sent and its own privacy notice applies.

Where the data goes

The service’s data is stored in the European Union. Some of the companies listed above are in the United States. Where personal data reaches them, the transfer is covered by the EU-US Data Privacy Framework when the company is certified under it, and otherwise by the standard contractual clauses approved by the European Commission.

How long we keep it

We keep a studio’s data while the studio has an account with us, and for 90 days after the account is closed, so a studio that returns does not start from nothing. After that the data is deleted.

Invoices and other records we must keep for tax or accounting reasons are kept for as long as Romanian law requires.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to limit how we use it, object to how we use it, or ask to take it to another service. Where we rely on your consent, you can withdraw it at any time. Write to hello@timitomi.com and we will answer within one month.

If you are not happy with our answer, you can complain to a data protection authority. Ours is the Romanian authority ANSPDCP, at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania, www.dataprotection.ro. You can also complain to the authority of your own country.

Cookies

The first time you visit timitomi.com, a banner asks what you allow. Cookies the site needs in order to work, and analytics that store nothing on your device, run without consent. Google Analytics, PostHog, and the advertising tools of Meta and OpenAI run only after you say yes. You can change your answer at any time from the cookie settings link in the footer.

A studio’s booking page uses cookies needed for signing in and for the shopping basket, and any analytics the studio has connected itself. The studio’s own privacy notice covers those.

Automated decisions

We do not use your data for automated decisions that have a legal effect on you.

Changes

If we change this policy we will change the date at the top. If the change matters to you, we will tell you by email.