1. Overview
Yogaanvesha ("we", "us") operates a discovery marketplace that connects seekers with yoga schools and retreats. This Privacy Policy explains how we handle personal data when you visit our website, create an account, book a retreat, or contact us. It applies to all users, seekers, school owners, and visitors.
2. Data We Collect
Account information
- Name, email address, password (hashed), and profile details.
- Role (seeker, school owner, admin) and account preferences.
- For schools: business name, location, contact details, and uploaded verification documents.
Booking & payment information
- Booking dates, participants, room type, add-ons, and special requests.
- Payment amount, currency, and status. Card details are entered directly into our payment processor (Stripe), we never see or store your full card number.
Communications
- Contact-form submissions, inbox messages between seekers and schools, and support requests.
- Notification preferences and unsubscribe status.
Usage data
- Pages viewed, listings shortlisted, search filters, and referring URLs.
- Device, browser, approximate location (from IP), and log data used for security and debugging.
3. How We Use Data
- Provide the service: accounts, listings, bookings, messaging, and reviews.
- Process payments, refunds, and cancellations.
- Send transactional emails (booking confirmations, cancellations, approval status, password resets).
- Send optional alerts you've opted into, newsletter, price-drop alerts, new-lead notifications.
- Personalize discovery: shortlist, compare, and recommendations.
- Detect fraud, enforce our Terms, and keep the platform safe.
- Improve the product through aggregate analytics and error monitoring.
- Comply with legal obligations.
We do not sell your personal data.
4. Legal Bases for Processing
Where GDPR or similar laws apply, we rely on: contract (to provide bookings and accounts), consent (for marketing emails and non-essential cookies), legitimate interests (security, product improvement, fraud prevention), and legal obligation (tax, accounting, lawful requests).
6. Third-Party Sharing
We share the minimum data needed to run the service. Our current processors and partners include:
- Stripe, payment processing, refunds, and fraud checks. Stripe receives your name, email, payment amount, and card details you enter into their form.
- Resend (via Lovable Emails), transactional and marketing email delivery. Receives your email address and the content of the message being sent.
- Supabase, our managed database, authentication, and file storage provider.
- Firecrawl, website-scraping service used only to help us pre-fill public information about yoga schools during onboarding. Not used on seeker data.
- Mapping providers, for map tiles on location pages. Your IP is visible to the tile provider when a map loads.
- The school you book with, receives your name, email, booking details, and any special requests you provide.
- Authorities, where required by law, court order, or to protect rights and safety.
We may share aggregated, de-identified data (e.g., total bookings per tradition) that cannot reasonably identify you.
7. Publicly Sourced School Data
To build a useful discovery experience, we compile information about yoga schools from publicly available sources (school websites, public listings). This is business data, school name, location, tradition, published pricing, public photos, and contact details.
If you are a school owner and wish to claim, correct, or remove your listing, email schools@yogaanvesha.com or use the "Claim this listing" link on your school page.
8. Data Retention
- Account data: kept while your account is active, and up to 24 months after closure for legal and accounting purposes.
- Booking and payment records: retained for the period required by tax and accounting law (typically 6–10 years).
- Support and contact messages: up to 24 months.
- Analytics logs: up to 13 months in identifiable form.
9. Security
We use encryption in transit (HTTPS), encryption at rest for our database and file storage, role-based access controls, row-level security policies, and audit logging on privileged actions. No system is perfectly secure, if you suspect a vulnerability, please report it to security@yogaanvesha.com.
10. International Transfers
Yogaanvesha serves users worldwide, and our processors may store data in the EU, US, or other regions. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.
11. Your Rights
Subject to local law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your account and associated personal data.
- Export a copy of your data in a portable format.
- Object to or restrict certain processing.
- Withdraw consent for marketing emails at any time via the unsubscribe link or your account settings.
- Lodge a complaint with your local data protection authority.
To exercise any right, sign in and use the tools in your account settings, or email privacy@yogaanvesha.com. We respond within 30 days.
12. Children's Privacy
Yogaanvesha is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to This Policy
We may update this policy as the service evolves. Material changes will be announced on the site or by email. The "Last updated" date at the top always reflects the current version.
14. Contact Us
For privacy questions, data requests, or complaints, email privacy@yogaanvesha.com or reach us through our contact page.