Privacy Policy

This privacy policy explains how we collect, use and protect your personal data when you use our Pilates platform. The controller for the data processing is the person or entity listed in the imprint.

We process personal data strictly on the basis of the EU General Data Protection Regulation (GDPR) and applicable German data-protection law. The database and the file storage are located in Frankfurt, and that is also where signed-in pages are rendered. Exceptions to processing within the European Union concern, in particular, transfers to our AI provider, which stores data in the United States and in its default setting may also process it in other third countries, and a routing layer in front of the platform that checks your session cookie, on every page request, at whichever location is closest to your internet connection; they are described in sections 4 and 5.

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and objection — see section 6. You can request a machine-readable export of your stored data from your account settings at any time.

The controller within the meaning of Art. 4 no. 7 GDPR is the person listed in the imprint. You can reach us through the contact details provided there.

We have not appointed a data protection officer because the statutory thresholds under § 38 BDSG (at least 20 persons permanently engaged in automated processing) are not met. Please direct any data-protection enquiries to the email address shown in the imprint.

Processing of your account data, training content and all data required to provide the platform is carried out on the basis of Art. 6(1)(b) GDPR for the performance of our terms of service with you. On the same basis, the routing layer described in section 4 checks your sign-in on every page request and renews it when needed (session cookie), so that you stay signed in and protected pages are shown only to signed-in users. On this basis we also process the data of the further features you can use: your own exercises and share links (section 3), and your profile photo if you upload one.

Technical safeguards such as IP-based rate limiting, abuse prevention, security logging and the check that a request which changes data comes from our own website are based on Art. 6(1)(f) GDPR; our legitimate interest is the secure and abuse-free operation of the platform. On the same basis we log technical errors — for example a failed request or an interrupted plan generation — so that we can find and fix faults, and we measure reach and loading performance in the cookieless form described in section 4. You can object to processing based on legitimate interest at any time; see section 6.

Optional processing activities — in particular marketing emails — are carried out exclusively on the basis of Art. 6(1)(a) GDPR, following your prior, freely given and revocable consent. You can manage your consents in your account settings.

Where we are required by law to retain records — for example tax and commercial bookkeeping documents — the legal basis is Art. 6(1)(c) GDPR. On the same basis we handle your requests under section 6 — for example when we create your data export or carry out your deletion request (Art. 12(3) in conjunction with Art. 15 to 21 GDPR).

Account data: email address, sign-up and last-sign-in timestamps, and a display name of your choice. Signing in works exclusively through a one-time sign-in code or link, generated by our auth provider Supabase and sent to you by email (delivered via Resend, see section 4). A password is never set and therefore never stored — so there is no password that could be stolen, guessed or reused on other sites. If someone requests a sign-in code for an email address that has no account, we send that address one short email instead: that there is no account, and how to sign up. The sign-in page itself looks the same either way, so that nobody can use it to find out whether an address is registered. The address is not stored in our database for this; so that an address receives at most one such email an hour, our rate limiting counts a hash of the address (see technical access data). The legal basis is Art. 6(1)(b) GDPR: the email is a step taken at the request of the person who asked for the code, before any contract.

Profile data: language preference, first and last name (optional), role within your studio and training preferences such as preferred modalities, difficulty levels and teaching style.

Profile photo: you can optionally upload a profile photo; it is never required. We store the image file with our processor Supabase (see section 4) at an address that contains your internal user ID and a timestamp, but neither your name nor your email address. That address is not access-protected: anyone who knows it can retrieve the image without being signed in. We do not publish the address, and within the application your photo is shown only to you. You can remove the photo at any time from your profile page; we then delete the image file from storage. If you delete your account, it is removed together with the rest of your data (see section 6).

Training content: class plans, courses (a named, ordered set of class plans with a name and a description), personal exercise cues, favourites and ratings you create. Personal exercise cues are classified as confidential and are never transmitted to any AI provider — see section 4.

Calendar data: your appointments, class times, optional notes and links to class plans. Appointments marked as private are visible only to you and, where applicable, authorised studio administrators.

Workflow and audit data: review decisions, plan handoffs between teachers and teaching logs. This data is required to make approval and handoff processes in your studio traceable. In a studio, the owner can set how many class generations each Teacher may start per month, and sees by name how many each Teacher has started this month; the other members do not see these numbers. They are counted from our record of generations, which holds no class content.

GDPR records: for each optional consent we store whether it is granted and when it was last changed. For a deletion request we store when it was made, when the deletion is scheduled, and when it was withdrawn or carried out. The legal basis is Art. 6(1)(c) GDPR: we must be able to demonstrate a consent (Art. 7(1) GDPR) and to show that we handled your request in time (Art. 5(2), Art. 12(3) GDPR). The entry for a consent is deleted with your account; the entry for a deletion request remains afterwards. In it your user ID is replaced by a placeholder; the reference to your workspace stays, if you belonged to one.

Records of the Terms, the DPA and the privacy policy: when you accept the Terms of Service (AGB) including the Data Processing Agreement (AVV) and confirm that you act as a business owner or self-employed professional under § 14 of the German Civil Code (BGB) — at signup, or when we present a new version to you — we store one entry for each document you confirm (the Terms, the DPA and your confirmation under § 14 BGB), each with the version and the time. We store the same kind of entry for this privacy policy, at signup and when you later confirm the notice about a new version. It records which version we brought to your attention, not an acceptance. When we announce a changed version of the Terms after you accepted an earlier one, we also store when the notice of it was first shown to you in the application, with the version. This tells us whether the notice reached you at least six weeks before the changeover date; only then is the new version deemed accepted without your confirmation under § 13 of the Terms. We process the document, version and time to perform the contract (Art. 6(1)(b) GDPR): they show which version has applied to you since when, and whether we have to present a new one. The entries are included in your data export. They are kept for as long as your account exists and are deleted with it.

Technical access data: on every request our hosting provider Vercel (see section 4) briefly logs IP address, user-agent string and timestamp for security monitoring; for rate limiting we count requests per IP address, account, calendar subscription or – as a hash – email address with our provider Upstash (section 4). These logs are deleted on each provider's own deletion schedule for operational and security logs; our rate-limiting counters expire automatically: each counter is kept for about twice the time window it measures, and all counters expire at the latest one day after they were created. We do not use this data for profiling.

Waiting list signup: if you join our waiting list without an invite code, we store your email address, the category you selected (independent teacher or studio), your language preference, the exact wording of the consent statement shown to you, and the timestamp and IP address of both your signup and your confirmation. The legal basis is your consent under Art. 6(1)(a) GDPR. We use double opt-in: your signup only takes effect once you have explicitly confirmed it via a link in a confirmation email; the timestamp and IP address serve solely as evidence of that consent. We use this data only to send you an invite code once a place opens up — not for marketing on other topics. You can withdraw your consent at any time with effect for the future by sending an informal email to info@mypilatesflows.com; we will delete your entry without delay. Otherwise we delete your entry at the latest twelve months after the end of the closed beta. As an exception to this, entries that are first made after the end of the closed beta are deleted at the latest twelve months after the waiting-list sign-up.

Quality assurance of AI plan generation: a class plan you have published may be copied by our administrators into an internal reference corpus that we use to measure the quality of AI-generated plans over time. The copy contains the exercise sequence and the class settings (apparatus, level, duration, style, props); the plan's title, its description, teacher notes, personal exercise cues, client data and structured personal identifiers are never copied. Because the corpus is our record of quality over time, a copy is retained even after you delete the original plan. It is visible only to platform administrators and is not published. When an administrator has an AI result additionally assessed by a language model, we send the copy — exercise sequence and class settings — to our AI provider named in section 4; we do not pass the corpus on to any other recipient. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to tell whether our AI results are getting better or worse. You can object at any time under section 6. We then delete the stored copies of your plans; they are no longer used for any measurement.

Feedback: when you rate an AI generation with a thumbs up or down, with a comment if you wish, or report an exercise in the community library with a reason, we store that feedback with your user ID. Both are voluntary. If you have rated a generation and then publish the plan yourself, we also record which of the suggested exercises it no longer contains. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving plan generation and the exercise library; for a reported exercise that includes being able to ask you about it. Our administrators see your rating and comment together with the name of your workspace (if you work alone, that is your name), the plan's title and further details of the plan (apparatus, level, style), and the removed exercises. For a reported exercise, our administrators see your reason together with your name, your email address and the name of your workspace, so that they can check the report and ask you about it. From this we pass on to our AI provider only aggregated information — how often plans of a style were rated negatively, and which exercises were removed — never your comment. If you object to this under section 6, we delete your feedback.

Your own exercises and share links: exercises you create for your workspace are stored with your user ID. They are visible to the members of your workspace and to our administrators; the name of an exercise of your own can be sent to our AI provider during plan generation (sections 4 and 5). If the owner or a Head Teacher of your workspace contributes an exercise to the community — including one that you created — it is visible to all users after our review, without the name of the person who created it. Through a share link that you or a member of your workspace create for a class plan, anyone holding the link can read, without an account, the plan's title, its exercise sequence with the details of each exercise and the name of your workspace, and the date of the class where one is set — but not notes or personal exercise cues. If the owner of your workspace has added a logo, an accent colour or a website address, anyone holding the link sees those too (see the next paragraph). If you work alone, your workspace carries your name. We count how often the page is opened. A link expires and can be revoked before that. The legal basis is Art. 6(1)(b) GDPR.

Your workspace's logo and website: the owner of a workspace can optionally add a logo, an accent colour and a website address, which mark the workspace's class plans — on the teaching sheet and on the page a share link opens. There, anyone holding the link sees the logo, the accent colour and the website address without being signed in. We store the logo with our processor Supabase (see section 4) at an address that contains the workspace's internal ID but no name. That address is not access-protected: anyone who knows it can retrieve the image without being signed in. A logo is normally not personal data; if you work alone and use a photo of yourself as your logo, it is. If the workspace is deleted, we delete the logo with it. If you work alone and delete your account, the logo and the website address are removed together with the rest of your data (see section 6); in a studio, the logo stays with the studio when a member leaves. Course pictures: an owner or head teacher can optionally add a picture to a course. We store it with the same processor in the same public storage area as the logo, at an address that contains the workspace's and the course's internal IDs but no name; anyone who knows that address can retrieve the image without being signed in, and the members of your workspace see it on the courses pages. Please use pictures of the room or the apparatus, not of your clients. We delete the picture when you remove it or delete the course, and with the workspace. The legal basis is Art. 6(1)(b) GDPR.

Studio documents and their files: the owner of a studio can write documents for the studio's Teachers, share each one with everyone, with chosen roles or with named Teachers, attach blank PDF forms, and ask Teachers to confirm that they have read a version. We store each document with its published versions, the user ID of the owner who wrote or published it or uploaded a file, which Teachers it is shared with by name, and when a Teacher confirmed which version. We store attached PDF files with our processor Supabase (see section 4) in a storage area that is not publicly accessible; a Teacher the document is shared with downloads a file through a link that works for 60 seconds. Upload only the empty form: a filled-in form, a contract or anything with a client's name does not belong there. When the owner archives a document, we delete its files at once. If the workspace is deleted, we delete its documents, files and read confirmations with it. If you delete your account, we delete your read confirmations and take you off the documents shared with you by name; the documents and files the studio keeps no longer name you (see section 6). The legal basis is Art. 6(1)(b) GDPR.

Contact enquiries: when you write to us through the contact form, we process your name, your email address, the role you select and your message if you write one — the message is optional. We use these details solely to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at entering into a contract with us, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. Your details are not stored in our database: we receive them as an email sent through our processor Resend (see section 4), which stores email content and delivery logs in the USA and deletes them on its own retention schedule. We keep your enquiry in our email inbox for twelve months after receipt and then delete it. We carry out this deletion by hand; there is no automated deletion process. In addition, our email provider files every message in an archive: a copy of your enquiry stays there for one year after receipt, even if we remove it from the inbox earlier, and is then deleted automatically. You can object to processing based on legitimate interest under section 6.

Personal invitations: if we personally invite you to use the platform during the closed beta, we use your email address on the platform solely to send you an email with your personal invite code and a link to sign up. You do not have to give us an email address for this; we can also hand you the code in person. The email contains only this invitation. Your email address is not stored in our database: the email is sent through our processor Resend (see section 4), which stores email content and delivery logs in the USA and deletes them on its own retention schedule. The transfer to the USA rests on the basis set out in section 5. In our database the invite code is stored without your name or email address; it is linked to your account only once you use it to register. We send this email only if you have asked us in person for an invitation. The legal basis is Art. 6(1)(b) GDPR: the invitation is a pre-contractual step taken at your request.

Read-only workspaces: if your workspace's free trial ends without a subscription, a subscription ends, or payment for a subscription is not received within the period stated in our Terms, the workspace and its content remain stored but become read-only: the owner can still view, print and export the content; other members cannot use the workspace during that time, but keep access to their data export, their consents and account deletion. Twelve months after the workspace became read-only we delete it together with the content stored in it, unless it has been unlocked again by then. We announce the deletion by email to the owner 30 days and again 7 days in advance. Your right to request deletion of your account earlier (section 6) remains unaffected.

We rely on carefully selected processors to operate the platform. We have entered into a data processing agreement (DPA) pursuant to Art. 28 GDPR with each of them.

Supabase (Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) — database, authentication and file storage. The instance we use is in the eu-central-1 region (Frankfurt), where your data is stored and primarily processed. Supabase itself names four cases in which data leaves that region: the details of our own customer account with Supabase; support requests handled by a team located around the world; usage information such as logs; and stored files served through a global delivery network.

Anthropic Ireland, Limited (counterparty for customers in the European Economic Area; parent company: Anthropic, PBC, USA) — AI-assisted plan generation (Claude language models) and the quality measurement described in section 3. We use Anthropic under a contractual training opt-out: your inputs are not used to train or improve any model. Under Art. 50(2) of the AI Act (Regulation (EU) 2024/1689) we mark AI-generated class plans as such: visibly on the platform, on pages shared by link and in the print view, and as machine-readable metadata on those shared pages, in the print view and in the data export. The mark contains no personal data.

Upstash, Inc. (Delaware, USA) — Redis-based rate limiting to protect against abusive use. The database we use is hosted exclusively in the eu-central-1 region (Frankfurt); no replication outside the European Union takes place.

Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) — delivery of transactional email (e.g. signup confirmations, review notifications, contact enquiries). Data transmitted is processed solely for the purpose of delivering the relevant email and logging that delivery. Email is dispatched from the eu-west-1 region (Ireland); message content, delivery logs and account records are, however, stored on servers in the USA, as Resend does not offer data residency in the European Union.

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — hosting and content delivery. Server-side processing — API calls, the rendering of signed-in pages and all scheduled jobs — takes place exclusively in the fra1 region (Frankfurt). In front of it sits a routing layer that, on every page request, handles language redirection and checks your session cookie — renewing it when it has expired; it runs on the global Vercel edge network, at whichever location is closest to your internet connection. If you use the platform from outside the European Union, your session tokens are processed at that location; we do not store them there, but pass them to our Supabase instance in Frankfurt for validation. This routing layer reads no content: class plans, exercises and client data are processed exclusively in Frankfurt. Access logs are generated at the location that handles the request — for visits from outside the European Union, that includes locations outside the EU — and are deleted on Vercel's own schedule for operational and security logs; we set no retention period of our own for these logs. For anonymous audience measurement we also use Vercel Web Analytics, and for measuring loading performance in real browsers we use Vercel Speed Insights. Neither sets cookies and neither reads data stored on your device. Vercel Web Analytics receives from our application the path of the page you open; on a class shared by link, that path contains the link's share token. Both transmit a pseudonymous device identifier that Vercel derives from request data and rotates regularly; it is not used to identify you personally and is not combined across websites. The legal basis for both is legitimate interest under Art. 6(1)(f) GDPR — you can object under section 6.

Important notice regarding personal exercise cues: the personal cues stored in your account are never transmitted to Anthropic or any other AI provider at any stage. They are resolved server-side and inserted into the final result only after plan generation has completed — a property that is permanently enforced at the architectural level.

Stripe Payments Europe, Limited — payment processing for paid tiers via Stripe's hosted Checkout page. When you purchase a paid tier, we transmit the paying user's email address, the name of the relevant workspace and the internal identifiers of the workspace and the paying account — randomly assigned character strings without a name — to Stripe; your card details (currently the only payment method offered) are captured by Stripe itself and never reach our servers. On its Checkout page Stripe also collects your billing address (required), your business name and, if you provide one, your VAT ID; Stripe saves the name and address on the customer record its invoices refer to. We do not store these details in our database. Because we, as the provider, are established in Germany, Stripe Payments Europe, Limited is our counterparty within the Stripe corporate group for this data processing agreement. Under that agreement we transfer the data to Stripe, LLC (USA); Stripe may pass it on to other group companies and sub-processors worldwide. For processing the payment on our instruction Stripe is our processor; for fraud prevention, its own legal duties and the improvement of its own products, Stripe processes data as a controller in its own right, as section 2 of its data processing agreement states.

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — operates the mailbox that receives messages sent to our product addresses info@mypilatesflows.com, tanya@mypilatesflows.com and datenschutz@mypilatesflows.com. These include, in particular, objections under section 6 and withdrawal of waiting-list consent under section 3. According to IONOS's product information, email data is kept in data centres in Germany; we do not yet hold a contractual assurance of the place of processing. Messages received by this mailbox are additionally stored in IONOS's email archive; the retention period configured there is one year from receipt, after which IONOS deletes the copy automatically. The data processing agreement has been part of the IONOS contractual terms since 19 July 2022.

Sentry (Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) — error and performance monitoring. When a technical error occurs in the application, we send an error report to Sentry: the error message and stack trace, the path that was called without its query parameters — if it contains the token of a share link or a calendar subscription, we replace that with a placeholder before sending — the time, the browser or server environment, and the version of our application. When you are signed in and working in the application, one further item is added: your account identifier — the randomly assigned character string under which your account is held in our database. It contains neither your name nor your email address; to Sentry it is a pseudonym that can be attributed to a person only in our own database in Frankfurt. We transmit it for two reasons: it is the only way to see how many people an error affected, and the only way we can reach you through our own records should that be necessary. As part of this identification we never transmit an email address to Sentry. The Sentry SDK is configured so that IP addresses, cookies and the contents of form and API requests are not transmitted, and so that the query parameters of an address are removed before sending — in the error report, in the page-load measurements, in the recorded intermediate steps, and in the address of the referring page as well, so that a one-time sign-in link can never reach Sentry. Of the HTTP headers we transmit only the browser identification (User-Agent) and the address of the referring page without its query parameters; without the browser identification an error cannot be attributed to a browser or an operating system. Error reports from your browser do not go to Sentry directly but to an address on our own domain, and from there on to Sentry's EU region; that forwarding is done by our own server in Frankfurt. It passes on the error report alone — not your IP address, your cookies or the other headers of your request — and Sentry is additionally configured not to store IP addresses. The application's console output is not sent to Sentry. We use Sentry's EU region: error events, traces and source map files are stored exclusively in Frankfurt, Germany. All that remains in the USA is the administrative data of our own Sentry access (account, organisation and project settings, access tokens, usage statistics). We do not use session replay. The legal basis is our legitimate interest in the secure and error-free operation of the platform under Art. 6(1)(f) GDPR — you can object under section 6.

The majority of our processing takes place within the European Union. Transfers to third countries go to the providers named in section 4, Anthropic, Resend, Vercel and Stripe, and, in the cases named there, to Supabase. Resend, Vercel and Stripe process data in the USA. Anthropic stores data in the USA; in the default setting we use, Anthropic states that it may process a request in the USA, in selected countries in Europe and Asia, and in Australia. For Vercel, the routing layer described in section 4 is additional: it runs at whichever edge-network location is closest to your internet connection and processes your session tokens there. If you use the platform from outside the European Union, that may — depending on where you are — be a third country other than the USA. Upstash, Inc. and Supabase Pte. Ltd are domiciled outside the European Union; the instances we use are in the eu-central-1 region (Frankfurt). For Upstash that holds without exception, for Supabase with the exceptions named in section 4. Sentry (Functional Software, Inc., USA) stores error events exclusively in its EU region (Frankfurt); all that remains in the USA is the administrative data of our own access.

The data processing agreements published by the providers named in this section contain the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For Vercel, Upstash, Resend, Stripe (Stripe, LLC) and Sentry there is, in addition, the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR): these companies are on the Data Privacy Framework List of the U.S. Department of Commerce, which we last checked on 11 October 2026, and transfers to them rest primarily on that decision. We did not find Anthropic or Supabase on that list; for them the Standard Contractual Clauses alone apply. On request we will tell you where the providers publish their agreements, or send you a copy.

No other third-country transfers take place. In particular, we do not use any advertising networks, tracking pixels or social-media plugins, and no analytics service that sets cookies, reads data from your device or follows you across websites. The cookieless reach and performance measurement described in section 4 is the only measurement we carry out.

Right of access (Art. 15 GDPR): you have the right at any time to obtain a full copy of the personal data we hold about you. You can trigger a machine-readable JSON export directly from your account settings.

Right to rectification (Art. 16 GDPR): you can update your profile data, preferences and account details at any time directly in your settings, or contact us otherwise.

Right to erasure (Art. 17 GDPR): you can request deletion of your account directly from your settings. If a subscription that renews automatically is running for your workspace, please cancel it first under "Subscription & billing"; you can also request the deletion of your account by email at any time. If you are the owner of a studio that still has other teachers, please remove them first under "Members", as the studio would otherwise be left with no owner. The deletion request is executed automatically after a 30-day grace period. If you withdraw it in your settings within that period, the withdrawn request is kept, with the times it was made and withdrawn, for as long as your account exists; if your account is deleted later, your user ID in it is replaced by a placeholder as well. Personal data is then removed completely, with two exceptions: in shared records such as sharing links and review entries we only anonymise your link to them, to the extent that their retention is required to preserve the traceability of business processes; and a plan copied into the quality-assurance corpus described in section 3 is retained. The copy holds no identifier of your account. If you run the workspace as a solo teacher, we also remove the workspace identifier from it; for a studio that identifier stays. If you want that copy deleted as well, tell us and we will delete it. Records we are required to keep under tax law are not affected: if a paid tier was purchased for your workspace, the invoices remain stored with our payment provider Stripe, together with the paying user's email address and the name of the workspace (Art. 6(1)(c) GDPR).

Right to restriction of processing (Art. 18 GDPR): you can ask us to restrict processing of your data while disputed matters are being resolved.

Right to data portability (Art. 20 GDPR): you receive your data in a structured, commonly used and machine-readable format (JSON) via the account export mentioned above.

Right to object (Art. 21 GDPR): you can object at any time to processing of your data where we rely on Art. 6(1)(f) GDPR. This applies in particular to the cookieless reach and performance measurement described in section 4 and to the quality-assurance corpus described in section 3. An informal email to info@mypilatesflows.com is enough; you do not have to give a reason, and we will stop the processing concerned without delay.

Right to withdraw consent (Art. 7(3) GDPR): you can withdraw consents at any time with effect for the future. Processing carried out until withdrawal remains lawful.

Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data-protection supervisory authority about how we process your personal data. The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Postfach 10 29 32, 70025 Stuttgart (street address: Heilbronner Straße 35, 70191 Stuttgart), phone 0711 615541-0, email poststelle@lfdi.bwl.de, https://www.baden-wuerttemberg.datenschutz.de. Independently of this, you may also lodge a complaint with the supervisory authority responsible for your place of residence, your place of work, or the place of the alleged infringement.

My Pilates Flows has no client management. There are no client records, no fields for a birthday, a contact number or health details, and no feature for recording the complaints, injuries or physical restrictions of another person. An earlier feature of that kind was removed in full; the database tables behind it no longer exist. No processing of special categories of personal data within the meaning of Art. 9 GDPR is therefore provided for.

Personal data about other people can nevertheless end up in free-text fields that you fill in yourself — in particular the title, description and notes of a class plan, a flow's title within a class plan, the name of a saved flow, the name and description of a course, your own variation or wording on an individual step, the notes on an appointment, and the notes on a class diary entry. What you enter there is entirely your decision. These fields receive no special handling; they are processed as described in sections 3 and 4. One point deserves particular attention: the title, description and notes on a class plan are never transmitted to our AI provider — neither on the first generation nor on a regeneration — and are not copied into the reference corpus described in section 3 either. The same holds for the name and description of a course.

Please do not enter health data in these fields, and avoid entering the names of the people you teach wherever you can. This platform is not intended for health data within the meaning of Art. 9 GDPR: there is no feature for it, and we do not maintain the additional safeguards such processing would require.

Where you enter personal data about other people into these fields, you are the controller for that data within the meaning of Art. 4(7) GDPR; we process it on your behalf as a processor under Art. 28 GDPR. The basis is the data processing agreement (AVV) that you accept together with the Terms of Service. It is published on the AVV page.

We give the information in this section under Art. 26 and Art. 28 of Regulation (EU) 2023/2854 (Data Act). It concerns all data that you and your workspace store in the platform, including data without a personal reference. § 12 of our Terms of Service refers to this section.

Jurisdictions of the IT infrastructure used: the database, authentication and file storage are run by Supabase (Supabase Pte. Ltd, Singapore) in the eu-central-1 region in Frankfurt am Main. Server-side processing, the rendering of signed-in pages and all scheduled tasks are run by Vercel (Vercel Inc., USA) in the fra1 region in Frankfurt am Main; the upstream routing layer runs in Vercel's worldwide edge network. Rate limiting is run by Upstash (Upstash, Inc., USA) in the eu-central-1 region in Frankfurt am Main, error monitoring by Sentry (Functional Software, Inc., USA) in its EU region in Frankfurt am Main, and the email mailbox by IONOS SE in Germany. With the exceptions named in section 4, this infrastructure is located in Germany and is subject to the law of the European Union and of Germany; operators established in the USA or in Singapore are additionally subject to the law of their home state. Outside the European Union, data are processed by: Anthropic (contracting party Anthropic Ireland, Limited; parent company Anthropic, PBC, USA) for AI generation, with storage in the USA and, in the default setting, processing in other third countries as well; Resend (Plus Five Five, Inc., USA), which sends emails via Ireland and stores them in the USA; Stripe (Stripe Payments Europe, Limited, Ireland) for payment processing, with transfer to Stripe, LLC in the USA. Sections 4 and 5 give the details and exceptions.

Measures against access by governmental authorities of third countries to non-personal data: technically, we store the platform's content — class plans, exercises, notes and appointments — in Frankfurt am Main and choose a region in the European Union with every provider that offers one. We pass to providers outside the European Union only what their task requires: our AI provider receives no titles, descriptions or notes of class plans and no personal cues, and error reports contain no content of form or API requests. Connections to the platform and to the database are encrypted. Organisationally, on our side only the owner and the developer who supports her have access to the production systems. If an authority of a third country asks us for access to data or for its transfer, we examine the request, disclose data only where the law of the European Union or of Germany permits it, and inform the customer concerned beforehand where that is permitted. Contractually, the data processing agreements with the providers outside the European Union contain the European Commission's standard contractual clauses, which oblige the provider to examine requests from authorities, to challenge them where there are grounds to do so, and to notify us. By their wording these obligations apply to personal data; the providers store the remaining content together with it and on the same terms.

Procedures and formats for switching and data portability: every User downloads the data of their account in the account settings under "Data export" as one JSON file (UTF-8). The file is an object with the fields exportedAt (time of the export), schemaVersion (version of the structure) and one field per type of data, in particular user, memberships, preferences, plans (class plans with steps and flows), savedFlows, cues, diaryEntries, appointments, exerciseRatings, favourites, notifications, planShareLinksCreated, legalAcceptances and generations. Times are given in ISO 8601 format; exercises from the library appear with their identifier. We provide the data of the whole workspace — own exercises, configuration and the content of all members — to the owner of the workspace on request as a ZIP archive. It has four parts: manifest.json describes the archive (the format mypilatesflows.workspace-export, schemaVersion, the number of entries per type of data, the size of each other file and the data that are not included, each with its reason); workspace.json is an object with the fields workspace (name, kind and language of the workspace, and the tariff), members (the members with role, name and email address), exercises (own exercises with translations and spring settings), exerciseTiers, exerciseRules, plans (class plans with steps and flows), shareLinks (share links without their access key), reviews, handoffs, savedFlows, courses (the courses of the workspace, with name, description and colour), diaryEntries, appointments, exerciseRatings, favourites, generationFeedback, notifications, generations, documents (studio documents with their working copy, audience and settings), documentVersions (every published version of a document), documentRecipients (the teachers a document is shared with by name), documentConfirmations (read confirmations: who confirmed which version, and when) and documentFiles (the files attached to studio documents, with name, size and upload date), with times in ISO 8601 format (UTC); the folder avatars holds the members' profile photos as image files, named after the member's identifier, and the folder documentFiles the attached files as PDF files, named after the file's identifier. A member's personal cues, consents, accepted versions of the contract documents and preferences are not in the archive; they are in the export of that member's account. Known limitations: there is no programming interface for retrieval, the content of the Provider's exercise library is not part of the exports, the export of an account contains the profile photo only as an address, and the platform offers no import of data from other services.