Privacy

Two different roles

TimiTomi is used by studios to run their own business, so we handle personal data in two different ways.

For the studio owners, admins and instructors who sign in to TimiTomi, we decide how the data is used. In data protection terms we are the controller.

For the customers who book classes with a studio, the studio decides how the data is used and we only act on the studio’s instructions. In data protection terms the studio is the controller and we are the processor, under the data processing agreement at timitomi.com/dpa. If you booked a class and want your data removed, contact the studio first.

What we hold about studio users

When someone from a studio creates an account or is invited to one, we hold:

• Name, email address and profile picture.
• For people who sign in with their Google account, the Google account identifier.
• For people who sign in with a code, the sign-in codes we send to their email address. A code works only once, and only for a short time.
• The role in the studio, and which studio the account belongs to.
• For instructors, the pay details the studio enters: pay rates, account holder name, IBAN, tax number and date of birth.
• Sign-in records, such as the date of the last sign in.

What we hold about studio customers

A studio’s customers give their details to the studio when they book. On the studio’s behalf we hold:

• Name, email address, phone number and profile picture.
• Bookings, class packs, memberships, credits and order history.
• A Stripe customer identifier. Card numbers are held by Stripe and never by TimiTomi.
• Acceptance of the studio’s terms, including which version was accepted, the date, the IP address and the browser used.
• Notes the studio writes about the customer.

What we hold about visitors of this website

When you visit timitomi.com we collect usage analytics: the pages you view, roughly where you visit from, and the kind of device and browser you use.

Tools that store cookies or similar identifiers on your device run only after you agree to them in the cookie banner. Analytics that store nothing on your device run without asking.

Why we hold it

To provide the service the studio pays for: taking bookings, tracking credits, running the schedule, calculating instructor pay and sending the messages a booking requires. The legal ground is the contract with the studio.

To take payment for the TimiTomi plan itself, and to keep the invoices and records Romanian tax law requires. The legal grounds are the contract and our legal obligations.

To keep the service secure, to find and fix faults, and to answer support requests. The legal ground is our legitimate interest in running a safe, working service.

To understand how the website and the product are used, and to measure our own advertising. Where this needs cookies or similar identifiers, the legal ground is your consent.

Who we share it with

We use the following companies to run the service. Each one receives only the data it needs for its part.

• Stripe, for taking payments. Card details go straight to Stripe.
• Postmark, for sending email.
• Vonage, for sending SMS.
• Nylas, for connecting an instructor’s Google or Outlook calendar, when the instructor chooses to connect one.
• Supabase, for the database and for storing uploaded images. The data lives in the European Union.
• Railway, for hosting the app.
• Cloudflare, for the network that carries traffic to the app.
• Google, for signing in when you choose to use your Google account, for Google Analytics on this website, and for Google Ads, which measures our own advertising on this website and in the app. Google Ads sets no cookies until you consent. When you create your studio, and when you first pay for a plan, we also send Google your email address in a coded form, so Google can connect the signup and the payment to the ad you came from.
• Meta, for measuring our own advertising on this website and in the app, only after you consent. When you create your studio, we also send Meta your email address in a coded form, so Meta can connect the signup to the ad you came from.
• OpenAI, for measuring the ads we run inside ChatGPT, only after you consent.
• PostHog, for product analytics and error reporting.
• Vercel, for hosting this website, and for visit counts that use no cookies.

We do not sell your data

We do not sell personal data. We use Google, Meta and OpenAI tools to measure our own advertising, only with your consent, and never with the data studios hold about their customers.

A studio can connect its own Google Analytics and its own Meta Pixel to its booking page. When it does, that studio decides what is sent and its own privacy notice applies.

Studios’ Stripe accounts

A studio sells through TimiTomi with its own Stripe account, connected to TimiTomi as a Stripe platform. When a studio connects a Stripe account it already has, Stripe gives TimiTomi read and write access to the whole account, including payments that did not come through TimiTomi. We use that access to run the studio’s checkout, refunds and memberships, keep its classes and prices in sync, prevent fraud, give support and meet our legal duties, and for nothing else. The legal ground is the contract with the studio and, for fraud prevention and security, our legitimate interest in running a safe platform.

A studio can remove this access at any time in its Stripe dashboard, under Settings, Authorized applications. What happens then is set out in the Terms. Payment records already in TimiTomi are kept for as long as the Terms and tax law require.

Where the data goes

The service’s data is stored in the European Union. Some of the companies listed above are in the United States. Where personal data reaches them, the transfer is covered by the EU-US Data Privacy Framework when the company is certified under it, and otherwise by the standard contractual clauses approved by the European Commission.

How long we keep it

We keep a studio’s data while the studio has an account with us, and for 90 days after the account is closed, so a studio that returns does not start from nothing. After that the data is deleted.

Invoices and other records we must keep for tax or accounting reasons are kept for as long as Romanian law requires.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to limit how we use it, object to how we use it, or ask to take it to another service. Where we rely on your consent, you can withdraw it at any time. Write to hello@timitomi.com and we will answer within one month.

If you are not happy with our answer, you can complain to a data protection authority. Ours is the Romanian authority ANSPDCP, at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania, www.dataprotection.ro. You can also complain to the authority of your own country.

Cookies

The first time you visit timitomi.com or app.timitomi.com, a banner asks what you allow, and your answer counts for both. Cookies the site needs in order to work, and analytics that store nothing on your device, run without consent. Google Analytics, PostHog, and the advertising tools of Meta and OpenAI run only after you say yes. The Google Ads tag runs for every visitor, but until you say yes it stores nothing on your device: it tells Google, without cookies, when a visit, a signup or a first payment happens, and it keeps the code of the ad you clicked in the page address when you move to the next page. You can change your answer at any time from the cookie settings link in the footer.

A studio’s booking page uses cookies needed for signing in and for the shopping basket, and any analytics the studio has connected itself. The studio’s own privacy notice covers those.

Automated decisions

We do not use your data for automated decisions that have a legal effect on you.

Changes

If we change this policy we will change the date at the top. If the change matters to you, we will tell you by email.