Privacy Policy

Last updated: 2 November 2026

This policy explains how YogaOS (the YogaOS mobile app and the web platforms Shala OS, Kula OS and Guru OS) collects, uses and protects information. YogaOS is provided by YogaOS Software Solutions, operating under Thousand Petaled Yoga Center LLC SOC, Dubai, UAE ("we", "us").

Two kinds of people use YogaOS: businesses (yoga studios, teacher-training academies and independent teachers, and their staff) and their clients and students. Each business decides what it records about its own clients; we process that information on the business's behalf to run the service.

Information we collect · How we use it · Connected accounts · Payments · AI features · Service providers · Sharing · Retention · Your rights · Security · Contact

Information we collect

From clients and students

Contact details: name, mobile number and email address.
Login details: your password, stored only in hashed (one-way encrypted) form. We never see your actual password.
Waiver: that you signed your studio's waiver, when, and the name you typed.
Classes and packages: bookings, cancellations, attendance, waitlists, packages, memberships and credit balances.
Course progress (teacher training): lessons completed, quiz answers and scores, training hours and enrolment.
Payments: what you bought, amounts, invoices and payment status. Card details are entered on Stripe's own page and are never seen or stored by YogaOS (see Payments).
Messages: messages you send to your studio or academy in the app, and, where your studio connects its WhatsApp Business number, your WhatsApp conversations with that studio.
Device information: a device token used only to send you notifications, your device type (iOS or Android) and your notification choices.
How you found the studio: if you enquire or buy through a studio's website, the page and campaign that brought you (for example "Instagram" or a Google ad), so the studio can see which marketing works.

From businesses and their staff

Staff names, emails, roles and login details (hashed passwords; optional passkeys).
Business details: name, address, tax registration, branding, schedules, prices and settings.
Records the business creates in YogaOS: enquiries, notes, invoices, expenses, payroll figures and marketing spend.
An activity log of actions taken by staff, kept so the business can see who changed what.

How we use information

To run the service: logging in, showing timetables, bookings, packages, courses and progress, and keeping each business's records.
To send notifications and emails you would expect: booking confirmations, reminders, waitlist spaces, payment receipts, payment reminders and waiver links. You can turn optional notifications off in the app.
To let your studio, academy or teacher manage their own business with your information: schedules, attendance, payments and follow-ups.
To keep YogaOS secure, fix problems and improve it.

We do not sell personal information, and we do not use it to show you advertising.

Connected accounts (WhatsApp, social media and Google)

A business can choose to connect its own accounts to YogaOS, such as its WhatsApp Business number, Facebook Page, Instagram account, Google Business Profile, LinkedIn page, TikTok account or YouTube channel. When it does:

Access tokens: we store the access token each platform gives us, encrypted on our servers, and use it only for that business's account.
We only act when staff do: YogaOS posts, publishes or sends a message only when a staff member of that business presses Publish or Send. It never posts on its own.
WhatsApp: when a studio connects its WhatsApp Business number, its one-to-one chats and contacts (including up to 180 days of history, if the studio agrees) are copied into YogaOS so its staff can see enquiries and reply in one place. Group chats are not copied.
What we read: only what is needed to show the business its connected account, its posts and their results. We do not use platform data for any other purpose, sell it or combine it with other businesses' data.
Disconnecting: a business can disconnect any account at any time in YogaOS or in the platform's own settings. We then delete the stored token, and the business can ask us to delete the copied data.

Use of each platform is also governed by that platform's own terms and privacy policy (Meta, Google, LinkedIn, TikTok).

Payments

When you pay online, the payment is taken on a page run by Stripe, in your studio's or academy's own Stripe account. Your card number is entered on Stripe's page and never reaches YogaOS. We receive only what is needed to record the sale: the amount, currency, payment status and a Stripe reference. If you choose to renew a package every month, Stripe stores your card to charge it each month until the renewal is stopped, and you can change your card through a secure Stripe link.

AI features

Some YogaOS features use an AI model to help staff, for example answering a staff question about the studio's own records or drafting a follow-up message. For this, the relevant records are sent to our AI provider (Anthropic) to produce the answer or draft. The provider does not use this data to train its models. AI drafts are never sent to clients automatically: a staff member reviews and approves every message.

Service providers

We use a small number of providers to run YogaOS, each only for its stated purpose:

Hostinger: web hosting and databases (servers in the United States), and sending email.
Google Firebase Cloud Messaging: delivering push notifications (device token only).
Stripe: taking card payments for the business, in the business's own Stripe account.
Cloudflare: storing and streaming course videos, where the business uses our video hosting.
Anthropic: the AI features described above.
Meta, Google, LinkedIn, TikTok: only when a business connects its own account to them (see above).

Your information is visible to the studio, academy or teacher you are linked to, because they need it to run your classes and enrolment. If you are linked to more than one, each sees only your activity with them. We share information with the providers listed above, and when the law requires it. We do not share it with anyone else.

Retention

We keep information while your account is active with a studio, academy or teacher. Invoices and payment records may be kept longer where tax law requires. When a business stops using YogaOS, it can ask us to export its data, and we delete it within 90 days of the request, apart from records we must keep by law.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Because your studio or academy manages your record, the quickest route is to contact them. You can also delete your app account yourself at yogaos.io/account-deletion.html, or write to us using the details below.

Children

If a studio or academy enrols someone under 18, the account is managed by a parent, guardian or the studio under that studio's own policies. YogaOS does not knowingly collect information directly from children without that oversight.

Security

Passwords are stored hashed. All traffic between the app, browsers and our servers is encrypted in transit. Your app login is kept in your device's secure storage (Keychain on iOS, encrypted storage on Android). Biometric login (Face ID, Touch ID, fingerprint) is handled entirely by your device: YogaOS only receives a yes or no. Access tokens for connected accounts are stored encrypted, and each business can see only its own records.

Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell businesses about important changes.

Contact

Questions about this policy or your information: info@yogaos.io, YogaOS Software Solutions, Thousand Petaled Yoga Center LLC SOC, Sports City, Dubai, UAE.