1. Our Commitment to Your Studio and Trainees

At Shala (“we,” “our,” or “us”), we recognize that yoga studios, teacher training academies, and holistic wellness institutes operate on relationships of deep trust, community, and personal transformation. We are committed to safeguarding the privacy and intellectual property of studio owners, lead trainers, and trainees who utilize our compliance, curriculum auditing, and learning management platform (the “Platform”).

2. Information We Collect

We collect information necessary to administer vocational training programs, verify curriculum compliance, and provide customer support:

Account & Profile Information: Full name, email address, profile avatar, role hierarchy (studio owner, lead trainer, or trainee), and studio affiliation.
Schedule & Attendance Synchronization: When you connect your booking platform or synchronize an external calendar (Google Calendar, iCal, Apple, or Outlook), we ingest class schedules, start times, durations, assigned teacher profiles, and student check-in records strictly to calculate contact and non-contact educational hours.
Coursework & Educational Progress: Video lecture watch duration, guided book reflection responses, written essay submissions, worksheet uploads, and instructor evaluation rubrics.
Diagnostic & Support Telemetry: When you submit a bug report or feedback request through Shala Assistant, we may capture environmental telemetry (browser type, device screen dimensions, route pathname, recent client/server console activity, and an optional viewport screenshot) to diagnose technical errors.

3. Passkeys and Biometric Data Disclaimer

Shala supports 1-Touch Passkey sign-ins utilizing the modern WebAuthn and FIDO2 standards (such as Apple Touch ID, Face ID, or Android Biometrics).

Important Notice: Shala never collects, processes, transmits, or stores your biometric data (fingerprint or facial scan). All biometric authentication is executed strictly by your device's local operating system hardware. Your device communicates only a signed cryptographic validation token to our servers.

4. Automated Curriculum & Study Assistance Disclosures

Shala utilizes secure language processing services (Google Cloud / Gemini API) to power optional study check-ins (“Review with Shala”), generate mid-video comprehension checkpoints, and provide chapter transcripts.

Zero Public Training Policy: Your studio's proprietary curriculum, trainee reflection responses, video materials, and internal communication are never used to train public foundation models.
100% Lead Trainer Controlled: Automated study check-ins are completely optional and configurable by your studio. All comprehension check outputs serve strictly as study aids for instructors and trainees; final grading, certification, and competency sign-offs remain entirely under the discretion of the studio's Lead Trainer.

5. Student Video Practicum Privacy & Local Portfolio Ownership

Trainees record and upload practice-teaching videos from their own phone or computer (we recommend recording in your device's Camera app first so a local copy is saved to your Camera Roll or personal teaching portfolio).

To protect student privacy and avoid storing personal home recordings on cloud servers indefinitely, submitted practicum videos remain accessible for faculty and student review throughout the active cohort and are automatically purged from our streaming infrastructure (Mux) once a concluded cohort is archived or 30 days after the cohort's end date, whichever comes first (while unsubmitted draft uploads expire after 7 days). Verified contact hours, written feedback, rubrics, and Lead Trainer sign-off records are retained permanently in the student's graduation transcript.

6. Multi-Tenant Data Isolation & Security

Shala enforces strict PostgreSQL Row-Level Security (RLS) policies at the database layer. A studio owner or trainer has access exclusively to data originating from their authenticated studio instance. Trainees have access strictly to their own enrolled cohorts, attendance logs, and coursework.

7. Third-Party Infrastructure Providers

We partner with enterprise-grade infrastructure providers to deliver Shala services:

Supabase: Encrypted relational database hosting (PostgreSQL) and file storage.
Stripe: PCI-DSS Level 1 compliant payment processing and subscription billing.
Mux: Encrypted on-demand video streaming, signed playback delivery, and automated closed-caption processing.
Resend: Secure transactional email delivery for passwordless magic sign-in links and cohort reminders.
Google Cloud: OAuth authorization and Gemini generative API processing.
GitHub: Issue tracking and customer feedback resolution pipelines.

8. Governing Registry & Regulatory Export Data

Curriculum compliance records exported for the Yoga Alliance or Pilates National Certification Program (NPCP) contain the minimal information required by governing registries to authenticate graduation status. You retain full ownership and export rights over your curriculum blueprints and student audit lineage at all times.

9. Contact Our Data Governance Team

If you have questions regarding this Privacy Policy, wish to request data erasure under GDPR/CCPA, or need assistance regarding your studio records, please reach out to our team at:

Email: privacy@shala.co