Data Processing Agreement (DPA)

Categories of data subjects whose personal data is processed

People you write about in free-text fields, above all the participants in your classes.

Categories of personal data processed

The text you write into free-text fields, in particular:

• the title, description and notes of a class plan
• a flow's title within a class plan
• the name of a saved flow
• your own variation or wording on an individual step
• the notes on an appointment
• the notes on a class diary entry
• notes made when a class plan is handed over or reviewed

What you enter there is entirely your decision. Names and short remarks about teaching are typical. The platform has no client management and no fields for a birthday, a contact number or health details.

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Sensitive data is not intended. The platform has no feature for it and no additional safeguards. Please do not enter health data, and avoid the names of the people you teach wherever you can.

The following applies to all free text:

• It is not sent to our AI provider. The only exception is the name of an exercise you create yourself.
• Within the platform it is visible only to signed-in members of your workspace and to people you give a link to. The two people named in Annex III also have access to the systems.

Nature of the processing

Storing, displaying, changing and deleting within the platform. When you initiate it, also: printing a class plan, sharing a class plan via a link, providing your appointments via a personal calendar link, and sending email notifications to members of your workspace, which may contain the title of a class plan and a note on a handover or review.

Purpose(s) for which the personal data is processed on behalf of the controller

Providing the planning functions you use: creating, editing and sharing class plans and flows, managing appointments and keeping a class diary. We do not process this text on your behalf for any other purpose.

Duration of the processing

For as long as the usage contract runs, and afterwards until the data is deleted. You can change or delete individual entries yourself where the platform provides for it. What applies after a subscription or the usage contract ends is set out in Part A, A.6, and § 5 of the Terms of Service.

For processing by (sub-) processors, also specify subject matter, nature and duration of the processing

The sub-processors and their tasks are listed in Annex IV. Of these, the free text is processed by Supabase (stores it in Frankfurt for as long as it exists), Vercel (runs, in Frankfurt, the application that reads and writes it) and Resend (delivers the email notifications). Sentry receives technical error data from the application, but no request content. Upstash, Stripe and IONOS do not receive the free text; Anthropic receives only the name of an exercise you create yourself.

What we process under our own responsibility is not part of this agreement. Section 3 of the privacy policy describes it; one example is the internal reference corpus for quality assurance.

Physical access and access to systems

• We operate no servers and no data centres of our own. Physical access is secured by the providers in Annex IV.
• Two people can access the production systems: Tanya Keating and the person who supports her as a developer. That person acts only on her instructions and is bound to confidentiality in writing.
• Sign-in works without a password, with a code or link sent by email. A password cannot be stored.
• Pages that are not public cannot be reached without signing in.

Access to data

• Every request first checks the sign-in and then whether the record belongs to the workspace of the person asking. The platform answers a request for someone else's record as if the record did not exist.
• In addition, rules in the database restrict direct access to a person's own workspace.
• Administrative functions are open only to approved accounts and check the permission on every call.
• Anyone who has a link to a class plan or calendar that you created can read its content without signing in. You can revoke any link.

Transfer

• The connection to the platform is always encrypted. The connection between the application and the database is encrypted as well.
• The platform sets security rules for the browser, including a Content-Security-Policy and protection against being embedded in other sites. It rejects write requests coming from other websites.
• The application and the database run in Frankfurt. Only Vercel's upstream routing layer runs at the location closest to the request; it checks the session on every request.

Input

• Every input is checked before it is stored.
• Class plans, flows, appointments and diary entries record which account created them.
• Which version of the contract documents an account accepted, and when, is stored.
• We keep no log of who has read an entry.

Separation

• Every record belongs to exactly one workspace, and every query is limited to the workspace of the person asking.
• Development and production run in separate environments with separate databases.

Pseudonymisation and anonymisation

• Free text is not sent to the AI provider (Annex II). Automated tests prevent this from changing unnoticed.
• When an account is deleted, we replace its identifier in the remaining entries of the workspace with a neutral identifier.
• The application does not encrypt content itself in addition to what the providers do.

Availability and resilience

• The platform runs in one region (Frankfurt). There is no second location that takes over in an outage.
• A rate limit protects against abusive use. If the service behind it cannot be reached, the platform stays usable and limits only roughly.
• Errors and outages are reported to us automatically. This monitoring does not detect access that causes no error.

Recoverability

• Supabase backs up the database automatically, at least daily. The database can be restored from these backups.
• Files in file storage (profile photographs) are not included in these backups.
• Deleted data remains in these backups until they are overwritten.
• The program and the database structure can be restored in full from version control.

Regular review

• Automated checks run on every change to the program. They fail, for example, when a new data field relating to a person has no deletion rule, or when free text could end up in a request to the AI.
• Tests of the most important flows run before every release, followed by a test against the live platform.
• We check the database's access rules automatically in the development environment and by hand in production.
• We hold no certifications.

Control of our own processors

• We use only the providers in Annex IV. A data processing agreement is in place with each of them.
• Each provider receives only the data it needs for its task.
• We use a new provider only after the notice under Part A, A.5.

Description of the specific technical and organisational measures to be taken by the processor to be able to provide assistance to the controller.

Requests from the people concerned

• You can change or delete most entries yourself. Every user can download their own data as a file in the settings.
• If you need further help to answer a request, write to info@mypilatesflows.com. We help you without undue delay.
• If a person concerned contacts us directly, we pass the request on to you and do not answer it ourselves (Clause 8).

Personal data breaches

• If we learn of a breach that affects your data, we report it to you without undue delay by email to the address of your account, with the information required by Clause 9.2. We supply what is still missing afterwards.
• Your contact is Tanya Keating, info@mypilatesflows.com.

We use the following sub-processors to provide the platform. They are the same providers described in section 4 of the privacy policy. The contracting entity and transfer safeguard stated for each are taken from the published data processing agreements of the providers. We last checked the EU-U.S. Data Privacy Framework entries on the U.S. Department of Commerce's Data Privacy Framework List on 11 October 2026.

The controller has authorised the use of the following sub-processors: