Sitz Privacy Policy

1. What we collect

From Hosts:

• Email address (used for magic-link or Google sign-in — we don't store passwords)
• Business name and venue address
• Class schedule, pricing, and pack information you create
• Stripe Connect account details (handled by Stripe; we store only your Stripe account ID and its connection status, never your bank details or card numbers)
• Subscription and billing status (handled by Stripe; we don't store your card number)

From Clients (people booking classes):

• Name, email address, and optionally a phone number, provided at the time of booking
• Which classes/packs you've booked or purchased, and your booking status (confirmed, waitlisted, cancelled, attended)
• If you pay for a class or pack, your payment is processed directly by Stripe on behalf of the Host's connected account — Sitz does not receive or store your card details.

Automatically:

• Basic technical data needed to operate the Service securely, including IP address (used, for example, to apply rate limits that prevent abuse of public booking pages). If you consent to analytics, Google Analytics collects page paths, referring sites, campaign parameters, approximate location, browser/device information, and a small set of signup and activation events. Google Analytics uses first-party cookies to distinguish visits. We do not intentionally send names, email addresses, or business details to Analytics

We load analytics and set analytics cookies only after you consent. We do not use tracking cookies for advertising, and we don't sell personal information to anyone.

2. How we use it

• To create and manage bookings, send confirmation emails and class reminders (via Resend), and generate calendar invites
• To let Hosts manage their schedule, roster, and packs
• To process subscription billing (Sitz's own fee) and to support Stripe Connect payments between Hosts and their Clients
• To sign Hosts in securely, including via Google when a Host chooses that option
• To detect and prevent abuse (e.g., rate limiting on public booking endpoints)
• To communicate with you about your account or respond to support requests
• To understand which marketing sources lead to signups and activated businesses, using consent-based analytics without advertising cookies

3. Who we share it with

We share data only with the service providers we use to run Sitz, and only as needed to provide the Service:

• Supabase — hosts our database and authentication
• Google — if you choose Google sign-in, Google confirms your identity and shares your name and email with us; if you consent to analytics, Google Analytics also processes website usage, campaign, device, and approximate-location data
• Stripe — processes all payments (both Sitz's subscription fees and Host-Client class/pack payments)
• Resend — sends booking confirmation and reminder emails on our behalf
• Vercel — hosts the application
• Sentry — receives technical error reports when something goes wrong in the application, so we can diagnose and fix it. These reports can include your IP address and details of the request that failed. We do not send Sentry session recordings, and we don't use it to track your activity
• cron-job.org — triggers our scheduled reminder job on a timer; it does not receive or store any personal data, it only calls a protected endpoint

We don't share personal information with anyone else, and we don't sell it.

4. Data retention

We keep booking, client, and business records for as long as your account is active, plus a reasonable period afterward for legal, tax, and dispute-resolution purposes. You can request deletion of your data by contacting us (see below), subject to records we're required to keep by law (e.g., payment records).

5. Your choices

• Analytics is optional. You can decline it or change your choice at any time using the Analytics settings control on the site.
• Hosts can update or delete class, pack, and business information directly in the dashboard.
• Clients, who don't have accounts, can contact the Host directly to update or cancel a booking, or email us at the address below to request that we delete their booking information.

6. Security

We rely on Supabase's database-level access controls (row-level security) so that each Host can only see their own business's data, and on Stripe for all payment handling — Sitz never sees or stores card numbers. No system is 100% secure, but we take reasonable steps to protect your information.

7. Children's privacy

Sitz accounts (Hosts) must be 18 or older. Client bookings can be made on behalf of a minor attending a class (e.g., a parent booking a kids' art class), but we don't knowingly collect personal information directly from children under 13 for the purpose of creating an account, since Clients don't create accounts at all.

8. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

9. Contact

Questions about this policy, or requests to access/delete your data: support@sitz.app