Privacy and data

This article is a plain-language overview of how we handle your data. For the legal text, see the privacy policy.

What we collect

When you use MoveMentors, we store:

Account data

• Your name (display name, can be a pseudonym).
• Your email address.
• A hashed password (never plaintext).
• Account type (student, mentor, studio, admin).
• Date you signed up.

Profile data (mentors and studios)

• The bio you wrote.
• Photos you uploaded.
• Locations you added.
• Cancellation policy you set.
• Payment methods you configured (the public-facing handles are encrypted at rest; bank account numbers, etc).

Booking data

• Which classes you booked.
• Dates of sessions.
• Party size and additional attendees' names.
• Payment method, amount, status.
• For Stripe payments: the Stripe charge ID (no card numbers).

Behavioural data

• Pages you visited (for analytics and bug detection).
• Search queries (to improve directory ranking).
• Devices you used (browser type, screen size; for layout debugging).

Communications

• Messages between you and other users via the platform.
• Booking confirmation and notification emails sent to you.

What we DO with this data

Run the platform

The obvious one. We use your account data to log you in, your booking data to confirm and remind you, your messages to deliver them, your profile data to render your profile.

Improve the platform

Aggregate data tells us what is working. "75% of bookings happen via mobile" informs the mobile experience. We do not run experiments on individual users without consent (we are not a giant ad-tech machine).

Communicate with you

Booking confirmations, notifications, support replies, occasional product updates. You can opt out of optional emails in notification preferences.

Pre-fill forms

We pre-fill your name and email on booking forms because you would type the same thing anyway. We do not share your data with hosts beyond what is needed to facilitate the booking.

Comply with the law

If we are served with a valid legal process (subpoena, court order), we respond. We do not voluntarily share with law enforcement absent legal compulsion or imminent safety threats.

What we NEVER do

Sell your data

We do not. To anyone. Ever. This is a core commitment of the business.

Share with advertisers

We do not run ad-targeting on third-party networks based on your data. We do not have a Facebook Pixel or similar firing on every page (we do use Google Analytics in aggregate; you can block it via your browser).

Read your messages for marketing

Messages between users are accessible to our admin team for moderation purposes if reports are filed, but we do not scan them for advertising signals.

Store credit card numbers

Stripe handles cards. We see only the Stripe charge ID (a token, not the card data).

Cookies

We use cookies for:

• Session cookie: keeps you logged in. HttpOnly, Secure (in production), SameSite=Lax. Lifetime: 30 days from last activity.
• Locale cookie: remembers your language preference. Lifetime: 1 year.
• Cart cookie: stores incomplete bookings (so you can come back and finish). Lifetime: 7 days.
• Analytics cookies: from Google Analytics. You can decline these (we honour Do-Not-Track and offer an opt-out).

We do not set tracking cookies for cross-site advertising.

Third-party services

We use these third-party services that necessarily see some of your data:

• Stripe: card payment processing. They see card data, billing info, and transaction details.
• Resend: transactional email delivery. They see email addresses and email content (delivery purposes).
• Sentry: error monitoring. They see anonymous error logs that may include the URL you were on when an error happened.
• Supabase: storage (for images, certifications). They store the files at rest in encrypted form.
• Google Places: address autocomplete. They see queries you type into address fields.
• Google / Apple Calendar: if you opt into calendar sync. They receive your schedule.

Each is a reputable provider with their own privacy commitments. None of them are paid for access to your data; they are paid for the service.

Your rights

Depending on your jurisdiction:

GDPR (EU) and similar regimes (UK GDPR, California CCPA, Brazil LGPD, etc)

You have the right to:

• Access: a copy of all data we hold about you.
• Rectify: correct data that is wrong.
• Erase: delete your data (with some limits; we may retain transaction records for financial / legal compliance).
• Port: receive your data in a machine-readable format.
• Object: opt out of specific processing.
• Restrict: pause processing while a dispute is resolved.

To exercise any right, email support@movementors.com with the request. We respond within 30 days; usually much faster.

Data export

Available now: a basic export at /settings/data-export that includes your account data, bookings, and reviews as JSON.

A fuller export (including messages, behavioural data, etc) is available on request via email.

Data deletion

See Deleting your account for the full process.

Data retention

When you delete your account, we anonymise booking records (replace your name and email with "Deleted user") rather than deleting them outright. The booking record itself stays for the financial-records retention period.

International transfers

Your data is stored on servers in the United States (Vercel, Supabase US regions). If you are accessing from another region, your data crosses borders.

For EU users, we operate under the Standard Contractual Clauses (SCCs) for transfers outside the EEA. Stripe, Resend, etc all have their own compliance with EU privacy law.

Security

We do what is industry-reasonable:

• HTTPS everywhere.
• Passwords hashed with bcrypt.
• Sensitive fields (payment handles, certifications) encrypted at rest with AES-256-GCM.
• Database access restricted to a least-privileged role.
• Regular security audits.
• A bug-bounty program coming soon.

If you discover a security vulnerability, email security@movementors.com. We respond to security reports quickly and reward responsible disclosure.

Breach notification

If we suffered a data breach affecting your account, we would notify you via email within 72 hours of discovering it, in line with GDPR. We have never had a notifiable breach to date.

Common questions

Can I see what data you have about me without emailing? The basic export is at /settings/data-export. For fuller access, email support.

Can I prevent my name from showing on the host's CRM? Not directly. If you booked with a host, your name and email are visible to them as part of the booking record. You can sign up under a pseudonym (we do not enforce real names).

Can I make my reviews anonymous? No. Reviews are tied to real accounts. You can delete a review you made if you want it removed.

Will you sell my data if you get acquired? The commitment to never sell user data is built into our terms. An acquirer would inherit those terms or have to renegotiate them with users.

Next steps

• Deleting your account: how to leave the platform fully.
• Community guidelines: rules for behaviour.
• The privacy policy for the legal text.