Privacy Policy
1. About this policy
Classfill (“Classfill”, “we”, “us”) is an online dashboard for independent Pilates, reformer and group-class studios. Studios upload exports from their booking system, and Classfill turns them into dashboards and a monthly report.
This policy explains how we handle personal information under the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We choose to follow the APPs and the Notifiable Data Breaches scheme even where the small business exemption might apply to us.
2. Who is responsible for member information
Our customers are studios. Each studio decides which exports it uploads and why. The studio collected its members’ information in the first place, and Classfill stores and processes that information on the studio’s behalf so it can see its own dashboards and reports.
- The studio is responsible for telling its members (in its own privacy policy or collection notice) that their booking, attendance and payment information may be analysed using third-party software such as Classfill, and for having any consent it needs.
- We use a studio’s member information only to provide Classfill to that studio. We do not sell it, use it for marketing, contact members, or combine it with other studios’ data.
- Members with a question about their information should usually contact their studio first. We will help the studio respond, and you can also contact us directly (section 10).
3. What we collect
Studio account information
Names, email addresses and roles of studio staff who have a Classfill login, the studio’s name and settings, and sign-in and security records.
Information in studio exports
Booking-system exports can include member names, email addresses, phone numbers, class bookings and attendance (including late cancels and no-shows), memberships, class packs and payment amounts. Classfill keeps only the columns it needs to calculate the studio’s figures, such as class dates, times, instructors, capacity, attendance status, membership or pack type and payment amounts, plus a member identifier (usually the email address) so visits and payments can be linked to the same person. Columns we don’t use, such as phone numbers, are discarded on upload.
Classfill does not need health information. Please don’t upload injury notes, medical questionnaires or similar fields. If an export contains them, they are not imported.
Payment information
Subscriptions are paid on a secure page hosted by Stripe. Stripe collects card details directly and we never see or store full card numbers. We receive confirmation of payment and the billing details entered at checkout.
Contact and website information
If you email us, we keep the email and your contact details. When you visit the site, our hosting provider automatically receives technical information such as your IP address, browser type and the time of your visit.
4. How we use it
- To provide Classfill: importing exports, calculating figures, and showing the studio’s dashboards and monthly reports.
- To run the studio’s account, including sign-in, billing and support.
- To keep Classfill secure and fix problems.
- To meet our legal obligations.
Some features, such as the list of members whose visits are slipping, highlight patterns for the studio to look at. They are prompts for the studio, and Classfill does not make decisions about members.
We may email studio contacts about their account, their subscription and important changes to Classfill. We may also send occasional product updates, which you can opt out of at any time.
5. Written summaries
The monthly report includes a short written summary. All figures are calculated by Classfill’s own code. To draft the summary text, we send the studio’s aggregated monthly figures (for example total revenue, average class fill, number of new intro clients and month-on-month changes) to OpenAI through its API. These figures are totals and averages for the whole studio. They do not include member names, email addresses, phone numbers or any row-level member data.
Under OpenAI’s API terms, data sent through the API is not used to train its models unless the customer opts in, and we have not opted in. OpenAI may keep requests for a limited period for abuse monitoring. OpenAI processes this information outside Australia, mainly in the United States.
6. Where information is stored and who we share it with
Studio data is stored in Australia, in our database provider’s Sydney region. We use these service providers, who handle information only to provide their services to us:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage for studio accounts and uploaded data | Australia (Sydney) |
| Netlify | Website hosting | United States and global delivery locations |
| Stripe | Subscription payments | Australia, the United States and other countries where Stripe operates |
| OpenAI | Drafting the written summary from aggregated studio figures only (section 5) | United States |
| Microsoft 365 | Email with Classfill | Australia or overseas |
| Google Fonts | Delivering the website’s font to your browser | United States and global locations |
Because some providers operate outside Australia, some information (mainly website, email and billing information) may be handled overseas. We take reasonable steps to make sure these providers handle it consistently with the APPs. We do not sell personal information, and we only otherwise disclose it if the studio asks us to or the law requires or allows it.
7. Security
Each studio’s data is kept separate with database access rules, so staff can only see their own studio. Data travels over encrypted connections, and access is limited to what is needed to run and support the service. No online service can be completely secure, but we take reasonable steps to protect information from misuse, loss and unauthorised access.
8. How long we keep it
We keep a studio’s data while it has a Classfill account. If a studio ends its pilot or subscription, we delete its uploaded data within 30 days, unless it asks us to keep it for a little longer while it decides, or the law requires us to keep something. A studio can ask us to delete its data, or a particular upload, at any time by emailing jacob@classfill.com.au. Backups are cleared on our database provider’s normal backup cycle. Billing records are kept as long as tax law requires.
9. Cookies
This website does not use advertising or analytics cookies. The Classfill app uses your browser’s storage to keep you signed in. Stripe sets its own cookies on its payment page.
10. Access, correction and questions
You can ask for access to the personal information we hold about you, or ask us to correct it. Studio staff can update most account details themselves. Members should usually ask their studio, since the studio controls its exports, but you can also email jacob@classfill.com.au and we’ll work with the studio. We will confirm your identity first, there is no charge, and we aim to respond within 30 days.
11. Data breaches
If we suspect information has been lost or accessed without authorisation, we will act quickly to contain it and assess the risk. If a breach is likely to cause serious harm, we will notify the affected studios, the affected individuals and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
12. Complaints
If you’re concerned about how we have handled personal information, email jacob@classfill.com.au. We will look into it and aim to reply in writing within 30 days. If you’re not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au or on 1300 363 992.
13. Changes
We will update this policy when Classfill or its providers change, and post the current version here with its effective date. We will tell studios about significant changes.