Privacy Policy

Welcome

At Open, we take your privacy seriously. This Privacy Policy explains how Middlepoint Solutions SL ("Open," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our platform.

1. Who This Policy Applies To

Open serves different types of users, and we handle their data differently:

• Studio Owners/Managers ("Business Users"): Yoga studios, fitness centers, and wellness businesses that use Open to manage their operations.
• Students/Members ("End Users"): Individuals who book and attend classes through studios using Open.
• Teachers/Instructors ("Teachers"): Professionals who teach classes at studios using Open.
• Urban Sports Club Members ("USC Members"): Members of Urban Sports Club who book classes at studios through the USC integration.
• Document Recipients: Individuals invited by a Studio to review, accept, or sign a document through the Platform, whether or not they have an Open account.

2. Information We Collect

2.1 Information from Business Users (Studio Owners)

Account Information:

• Full name
• Email address
• Phone number
• Business name and address
• Tax ID / VAT number (optional, for invoicing)
• Password (encrypted and hashed)

Business Information:

• Studio logo and photos (stored on Firebase)
• Business description
• Operating hours
• Location coordinates
• Room and class information
• Teacher profiles
• Pricing and ticket information

Payment Information:

• Stripe account connection details (we don't store your bank account numbers)
• Transaction history
• Subscription payment details

Usage Information:

• IP address
• Device type and operating system
• Browser information
• How you use the platform (via internal analytics)
• Error logs and crash reports (via Sentry)

2.2 Information About End Users (Students)

Required Information:

• Name
• Email address

Optional Information (may be required by individual studios):

• Phone number
• Date of birth
• Home address
• National ID / Tax ID (for invoicing)
• Profile photo (stored on Firebase)
• Teacher notes (optional notes for instructors about preferences or considerations)

Booking and Activity Data:

• Class bookings and attendance history
• Cancellations
• Ticket purchases and payment history (processed through Stripe)
• Device tokens for push notifications
• Campaign interaction data (email opens, link clicks, push notification taps)
• Marketing preferences and unsubscribe status
• Feedback and ratings

Technical Information:

• IP address
• Device information
• App version
• Location data (with your permission, to find nearby studios)

2.3 Information About Teachers

• Name
• Email address and phone number (optional)
• Profile photo and biography (optional, if marked as public)
• Payment information (provided by studios)
• Teaching schedule and class attendance

2.4 Urban Sports Club Integration Data

When USC members book classes through our platform, we receive:

• USC member name
• USC member ID
• Booking information (class, date, time, location)
• Check-in data

Important: Urban Sports Club remains the data controller for USC member data. We process this data on their behalf according to our API License Agreement with Urban Sports Club.

2.5 Electronic Document Signing and Acceptance

When a Studio sends a document for review, acceptance, or signature through the Platform, we may process:

• The document and other content uploaded by the Studio, including its title, description, version, and related metadata
• The recipient's name, email address, language preference, and any associated Studio client or partner identifiers
• Corrections that the recipient makes to their name or email address
• The status of the request, including when it was created, delivered, viewed, accepted, declined, voided, or expired
• The recipient's IP address, browser or device information, user-agent information, and relevant security logs
• The acceptance record or certificate and the completed document
• Information necessary to store, retrieve, and deliver the document and completed copy

Most recipient information is provided by the Studio. Some information may be provided or corrected directly by the recipient.

Documents uploaded by a Studio may contain personal data, including sensitive information, information about health, identity information, information concerning children, or information about other individuals. The Studio determines which documents and information are uploaded and is responsible for ensuring that it has an appropriate legal basis, provides all required notices, obtains any necessary permissions, and limits the information to what is necessary.

Open does not require this information as part of its standard account registration fields but may process it when it appears in content uploaded by a Studio.

2.6 Information We Don't Collect

• We do not store credit card numbers or full payment details (Stripe handles all payment processing)
• We do not require passport details, emergency-contact information, or similar information as standard account registration fields. A document uploaded by a Studio may nevertheless contain such information. In that case, Open processes it to provide the service on the Studio's instructions and subject to our Terms and applicable law.
• We do not send SMS messages
• We do not collect session data or tracking cookies beyond what's necessary for the platform to function

3. How We Use Your Information

3.1 To Provide the Service

• Create and manage your account
• Process bookings and payments
• Send booking confirmations and reminders (via Resend)
• Enable communication between studios and students
• Display class schedules and availability
• Manage waitlists
• Process refunds and cancellations
• Provide customer support
• Deliver document invitations and provide recipients with access to documents
• Record document views, acceptance, refusal, and other actions
• Create, store, and deliver acceptance records and completed copies
• Make request information and completed documents available to the relevant Studio
• Notify the Studio and recipient about document requests
• Maintain operational, security, fraud-prevention, and audit records

Messages necessary to deliver or complete a document request are service communications, not marketing communications. Recipients may not be able to opt out of those messages while a request remains active.

3.2 To Improve the Service

• Analyze usage patterns (using anonymized data only with Claude API)
• Fix bugs and technical issues (via Sentry error tracking)
• Develop new features
• Understand which features are most valuable
• Optimize platform performance

3.3 To Communicate With You

• Transactional emails (booking confirmations, reminders) - you cannot opt out of these
• Service updates and important notices
• Marketing communications about new features or promotions - you can opt out of these anytime
• Automated marketing campaigns configured by your studio (e.g., welcome series, class reminders, membership renewal reminders) — delivered via email, push notification, or in-app message. These campaigns are sent on behalf of and at the direction of your studio. You can opt out of marketing campaigns at any time via the unsubscribe link in emails or by adjusting your notification preferences.
• Respond to your questions and support requests

3.4 For Legal and Security Purposes

• Comply with legal obligations (tax laws, financial regulations)
• Prevent fraud and abuse
• Enforce our Terms of Service
• Protect our rights and property
• Respond to legal requests from authorities

4. How We Share Your Information

4.1 With Studios (for End Users)

Important: When you book classes at a studio using Open, that studio becomes the data controller for your booking information. Each studio only sees your interactions with their business.

Studios can see:

• Your name, email, and any information you provide during booking
• Your booking history at their studio only
• Your attendance and cancellations at their studio only
• Your feedback and ratings for their classes only
• Teacher notes you've provided

Studios cannot see:

• Your activity at other studios using Open
• That you even use other studios
• Your cross-studio profile or history

This isolation is by design to protect your privacy.

For a document sent by a Studio, that Studio can access the document, recipient details, request status, acceptance information, and completed copy. A recipient may receive or access a completed copy of the document.

4.2 With Payment Processors

We use Stripe to process all payments. When you make a purchase:

• Stripe collects and stores your payment information
• We only receive a token to process future transactions
• We never see or store your full credit card numbers
• Stripe's privacy policy applies: https://stripe.com/privacy

Payment fees:

• Stripe charges approximately 1.5% + €0.25 per transaction
• Open charges an additional fee:
  • Single payments: 1.0% + €0.30 for transactions under €50
  • Recurring payments: 2.9% + €0.30 for transactions under €50

4.3 With Service Providers

We share data with these trusted service providers who help us operate:

Service Provider	Purpose	Data Shared
Firebase (Google Cloud)	Application infrastructure and storage of images, uploaded documents, completed documents, and associated metadata	Account and Studio information, uploaded content, documents, completed documents, storage identifiers, and related metadata
Digital Ocean	Server hosting (EU region, Netherlands)	All platform data
Sentry	Error tracking and monitoring	Error logs, device info
Resend	Transactional, service, and campaign email delivery	Email addresses, recipient names, message content, document titles, secure access links, completed-document attachments, and delivery metadata
Expo (Expo Application Services)	Push notification delivery	Device tokens, notification content
Claude AI (Anthropic)	Analytics assistance	Anonymized, aggregated data only
Yandex Metrika	Web analytics and user behavior analysis	Anonymized usage data, page views
Verifactu (Spanish Tax Authorities)	Invoice submission for Spanish businesses	Invoice data (Spain only)

All service providers are contractually required to protect your data and use it only for the services they provide to us.

4.4 With Urban Sports Club

For USC members booking through our integration:

• We share booking and check-in data with Urban Sports Club
• This is governed by our API License Agreement with USC
• USC's privacy policy also applies: https://urbansportsclub.com/privacy

4.5 For Legal Reasons

We may disclose your information if required by law or if we believe it's necessary to:

• Comply with legal processes (court orders, subpoenas)
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or the public
• Prevent fraud or security issues

4.6 Business Transfers

If Open is acquired by or merges with another company, your information may be transferred to the new owner. We'll notify you before this happens.

4.7 With Your Consent

We may share your information with third parties when you explicitly consent to it.

5. Data Controller Roles

This is important for understanding who's responsible for your data:

5.1 When Open is the Data Controller

• For Business Users: We control how we use your studio account information.
• For End Users (cross-studio profiles): We control your central user account that lets you visit multiple studios.

5.2 When Studios are the Data Controllers

For End Users (bookings and class data): Studios control how they use your booking information. We process this data on their behalf as a "data processor."

This means:

• Studios decide what information to collect from you
• Studios decide how long to keep your information
• You should direct privacy requests to the studio
• We support studios in fulfilling your privacy rights

5.3 When Urban Sports Club is the Data Controller

For USC members, Urban Sports Club controls your membership data. We process booking data on their behalf.

5.4 Documents Sent by Studios

For personal data processed in connection with documents sent by a Studio, the Studio generally acts as the data controller and determines the purpose, legal basis, recipients, content, and retention period. Open generally acts as the Studio's data processor and processes the information on the Studio's instructions.

Open may act as an independent controller for limited information that it processes for Platform security, fraud prevention, legal compliance, service administration, and the establishment, exercise, or defence of legal claims.

6. International Data Transfers

Our primary infrastructure is in the European Union:

• Servers: Digital Ocean, EU region (Netherlands)
• Database: Hosted in EU

Some service providers process data outside the EU:

• Firebase/Google Cloud: May process data in US
• Stripe: May process data in US
• Sentry: May process data in US
• Resend: May process email addresses, message content, attachments, and delivery records in the US

When we transfer data outside the EU, we ensure appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where the destination country is deemed adequate by the EU
• Service providers' compliance with GDPR

7. How Long We Keep Your Information

7.1 Active Accounts

We keep your information as long as your account is active or as needed to provide services.

7.2 After Account Deletion

When you delete your account:

• Most data deleted: Within 30 days
• Transaction records: Kept for 7 years (required by financial regulations)
• Communication records: Kept for 3 years (for customer service purposes)
• Marketing data: Deleted immediately if you've withdrawn consent

7.3 Studio Data After Student Deletion

If you delete your account, studios you've visited will still have a record of your bookings and attendance. This is their business record and required for their financial and legal obligations.

7.4 Documents and Acceptance Records

Open stores document templates, document requests, completed documents, and acceptance records on the Studio's instructions until the Studio requests their deletion or the information is no longer necessary for the purpose for which it was collected.

Certain information may be retained for longer where required by law or reasonably necessary to establish, exercise, or defend legal claims, resolve disputes, prevent fraud, maintain Platform security, or enforce agreements.

Studios are responsible for establishing an appropriate retention period for the documents they send and for instructing Open when deletion is required. Copies already downloaded, received by email, or retained by a Studio or recipient are outside Open's control.

8. Your Privacy Rights (GDPR & Beyond)

You have strong privacy rights. Here's what you can do:

If your personal data appears in a document sent by a Studio, you should normally direct your privacy request to that Studio. Open will assist the Studio in responding where required by applicable data-protection law. You may also contact Open if you cannot identify or contact the relevant Studio.

Where processing is based on consent, withdrawing that consent affects future processing and does not affect processing that was lawful before withdrawal. Withdrawal of privacy consent does not by itself determine whether a separately accepted document or agreement remains valid or enforceable.

8.1 Access Your Data

• What it means: Get a copy of all personal data we hold about you
• How to do it: Email nik@openmanagerapp.com
• Response time: Within 30 days
• Cost: Free

8.2 Correct Your Data

• What it means: Fix inaccurate or incomplete information
• How to do it: Update in your account settings or email us
• Response time: Immediately in app, or within 30 days for complex requests

8.3 Delete Your Data ("Right to be Forgotten")

• What it means: Have your data deleted when it's no longer necessary
• How to do it: Settings → Delete Account, or email us
• Response time: Immediate for most data
• Exceptions: We may keep data required by law (e.g., transaction records for 7 years)

8.4 Restrict Processing

• What it means: Limit how we use your data
• How to do it: Email nik@openmanagerapp.com with your request
• When available: If accuracy is disputed, processing is unlawful but you don't want deletion, or we no longer need the data but you need it for legal claims

8.5 Data Portability

• What it means: Get your data in a common format (like CSV) to transfer to another service
• How to do it: Email nik@openmanagerapp.com
• What you'll receive: Your personal data in machine-readable format
• Response time: Within 30 days

8.6 Object to Processing

• What it means: Object to us processing your data for certain purposes
• How to do it: Email nik@openmanagerapp.com
• When available: For processing based on legitimate interests or for marketing

8.7 Withdraw Consent

• What it means: If processing is based on consent, you can withdraw it anytime
• How to do it: In account settings or email us
• Effect: We'll stop processing, but it doesn't affect processing done before withdrawal

8.8 File a Complaint

• What it means: If you're unhappy with how we handle your data, you can complain to a data protection authority
• Spanish Authority: Agencia Española de Protección de Datos (AEPD) - https://www.aepd.es
• Your local authority: You can also complain to the authority in your country

9. Data Security

We take security seriously and implement appropriate technical and organizational measures:

Technical Measures:

• Encryption in transit (HTTPS/TLS for all connections)
• Encryption at rest (database encryption)
• Password hashing (bcrypt)
• Access controls and authentication
• Regular security assessments
• Automated backup systems
• Secure cloud infrastructure (Digital Ocean EU, Firebase)

Organizational Measures:

• Limited access to personal data (only authorized personnel)
• Confidentiality commitments
• Incident response procedures
• Regular security training

However: No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You're responsible for keeping your password confidential.

10. Data Breach Notification

If we discover a data breach that's likely to pose a risk to your rights and freedoms:

• We'll notify the relevant data protection authority within 72 hours of becoming aware
• We'll notify affected users without undue delay
• We'll provide information about the breach, its likely consequences, and the measures we're taking

11. Cookies and Tracking

11.1 What Cookies We Use

• Essential Cookies: Required for the platform to function (login sessions, security)
• Analytics Cookies: Help us understand how the platform is used (via internal Ahoy analytics)
• Preference Cookies: Remember your settings and preferences

11.2 Cookie Consent

When you first visit our website or app, you'll see a cookie banner. You can:

• Accept all cookies
• Reject non-essential cookies
• Customize your preferences

You can change your cookie preferences anytime in your account settings.

11.3 Email Tracking

When studios send marketing campaigns through the Platform, emails may contain a small tracking pixel (a 1x1 transparent image) that records when the email is opened, and links may be routed through our tracking service to record clicks. This data is used to measure campaign effectiveness and is shared with the studio that sent the campaign.

You can disable image loading in your email client to prevent open tracking. You can also unsubscribe from marketing campaigns entirely using the unsubscribe link included in every campaign email.

11.4 Third-Party Cookies

Some service providers (like Firebase, Stripe) may set their own cookies. We don't control these cookies. Please review their privacy policies.

11.5 Do Not Track

We respond to Do Not Track (DNT) signals. If your browser has DNT enabled, we won't track your activity beyond essential functionality.

12. Children's Privacy

Open is not intended for children under 16 years old. We don't knowingly collect personal information from children under 16.

• If you're under 16: Please don't create an account or provide any personal information.
• If you're a parent: If you believe your child has provided information to us, please contact us at nik@openmanagerapp.com and we'll delete it immediately.
• Classes for children: If a studio offers classes for children, parents must create accounts on behalf of their children and are responsible for the information provided.

12.5 Photo Prohibition for Minors

For child safety and legal compliance, Open strictly prohibits uploading photos of any individual under 18 years old.

• Photos may only be uploaded for students aged 18 or older
• This applies regardless of parental consent
• Photos of minors will be deleted immediately if discovered
• Studios violating this policy may have their accounts suspended or terminated

13. Automated Decision-Making and Profiling

We use limited automated processing to deliver marketing campaigns configured by studios. This includes matching students to campaign audience criteria based on booking history, attendance, and membership status. This processing is used solely to deliver relevant communications from your studio and does not produce legal effects or similarly significant effects on you.

You can opt out of receiving marketing campaigns at any time via the unsubscribe link in campaign emails or by adjusting your notification preferences in the app.

Any decisions that significantly affect you (like account termination) are made by humans, not algorithms.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes take effect on the date stated in the updated version. Where applicable law requires advance notice or consent, we will provide it. This Privacy Policy describes how personal data is processed and is not itself a request for consent.

• We'll post the new policy on this page
• We'll update the "Last Updated" date at the top
• For material changes, we'll notify you by email or through a prominent notice in the app

We encourage you to review this policy periodically.

15. Contact Us

For privacy questions or to exercise your rights:

We'll respond to your request within 30 days (or let you know if we need more time).

For data protection complaints:

• Spanish Data Protection Authority (AEPD) - https://www.aepd.es
• Or your local data protection authority

16. Jurisdiction-Specific Information

16.1 European Union / European Economic Area

This Privacy Policy complies with the General Data Protection Regulation (GDPR). All the rights described in Section 8 apply to you.

Legal Basis for Processing (GDPR Article 6):

Purpose	Legal Basis	Your Rights
Provide the Service (bookings, payments, communications)	Performance of contract with you	You can request deletion after contract ends
Improve the Service (analytics, bug fixes, new features)	Legitimate interest	You can object to processing
Marketing communications from Open	Your consent	You can withdraw consent anytime
Studio marketing campaigns (automated emails, push notifications, in-app messages)	Legitimate interest of the studio (data controller) or consent, depending on studio's legal basis	You can opt out / unsubscribe at any time
Legal compliance (tax records, responding to authorities)	Legal obligation	Limited - required by law
Security and fraud prevention	Legitimate interest	You can object unless necessary for security

16.2 Norway

This Privacy Policy complies with the Norwegian Personal Data Act and GDPR (via EEA Agreement). You can contact the Norwegian Data Protection Authority (Datatilsynet) at https://www.datatilsynet.no

16.3 Spain

This Privacy Policy complies with Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

16.4 California (United States)

California Consumer Privacy Act (CCPA) Rights:

If you're a California resident, you have additional rights:

Right to Know: You can request that we disclose what personal information we collect, use, disclose, and sell (note: we don't sell your information).

Categories of Personal Information We Collect:

• Identifiers (name, email, phone, IP address)
• Commercial information (booking history, payment transactions)
• Internet activity (device info, usage patterns)
• Location data (with your permission)
• Professional information (for teachers)

Right to Delete: You can request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out of Sale: We do not sell your personal information to third parties for their marketing purposes.

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

How to Exercise Your Rights:

• Email: nik@openmanagerapp.com
• Subject line: "California Privacy Rights Request"
• We'll verify your identity and respond within 45 days

16.5 Other Jurisdictions

If you're in a country with specific data protection laws, those laws may give you additional rights. Please contact us to learn more.

17. Important Clarifications

We Do Not Sell Your Data

IMPORTANT: Open does not and will not sell your personal data to third parties for their own marketing purposes.

When we share data with service providers (like Firebase, Sentry, and Resend), this is only so they can provide services to us. They are contractually prohibited from using your data for their own purposes.

Mobile Communications

Phone numbers collected through our services will not be shared with third parties or affiliates for marketing or promotional purposes. Any phone number information will only be used to provide the services you request.

To opt out of push notifications: Go to your device settings and disable notifications for the Open app.

Aggregated Anonymous Data

Notwithstanding anything to the contrary, we may collect and use aggregated, anonymized data about platform usage that does not identify you personally. We use this "Aggregated Anonymous Data" to:

• Analyze industry trends
• Understand yoga/fitness booking patterns
• Develop new features
• Publish industry benchmarks and best practices
• Improve the platform

This aggregated data cannot be traced back to you and may be used indefinitely, even after you close your account.

Document Version: 3.1
Effective Date: October 12, 2025
Last Updated: July 17, 2026