Privacy Policy

The short version: we collect the little we need to hold your mat, teach your class, run a membership if you take one, and keep a record of what you agreed to. We do not sell your personal information, we do not share it for advertising, and we never see your card number.

This Privacy Policy is v1.4, effective September 29, 2026; the version identifier stored with your consent record is 2026-09-29. It explains how Delvir Limited Liability Co., a Wyoming limited liability company doing business as Sunroom Yoga (“the Studio,” “we,” “us”), handles personal information at sunroom.yoga and in our live online yoga classes (“Classes”). It works with our Terms of Service, our Liability Waiver and our Refund & Cancellation Policy.

1. What we collect

• Your email address. Required. It is how you are identified — there are no accounts and no passwords — and how every confirmation, reminder and replay link reaches you.
• Your name. Optional, and used so an instructor can greet you by name and so a guest booking can be matched to its host.
• Google sign-in information. Optional. If you choose to sign in with Google, Google tells us the email address on that account, that Google has verified it, and — if you have them — your name and profile picture. We use that email address to find the bookings and passes already held under it, and nothing else. We never receive your Google password, and we ask Google for no other access to your account.
• Booking and purchase records. Which Classes you booked, attended, rescheduled or cancelled; your seat; which pass you bought, what it cost, its credits and their expiry; refunds; and the identifiers our payment processor gives us for the transaction.
• Practice Notes. Optional free text you may submit at booking — injuries, goals, what your body is doing lately. This can include health information. Share only what you want your teacher to know, and leave it blank if you would rather not. We are not a healthcare provider and this is not a medical record.
• Waiver-consent records. Every seat creates its own record containing the document versions you agreed to, the date and time, your email, the name you gave, the Class, your IP address and your browser user-agent string. We keep these because they are the proof that consent was given, and they are never edited afterward.
• Membership and billing records. If you take a Sunroom Membership: which plan, the price, the billing dates, each renewal charge, the credits granted and their expiry, whether the membership is running or cancelled, and the identifiers our payment processor gives us for the subscription and its invoices.
• Auto-renewal consent records. Starting a Membership creates its own record containing the exact auto-renewal wording you were shown, the plan, the price, the billing frequency, the version of the disclosure and of the Terms, the date and time, your email, the name you gave, your IP address and your browser user-agent. Automatic- renewal law requires us to be able to show what you were told and that you agreed to it, so these records are never edited afterward.
• Your time zone. Detected by your browser so the schedule shows your local times, and stored with your record so emails show the right time.
• Email delivery logs. Which message we sent you, when, and whether it was delivered.
• Basic technical logs. Our hosting provider records standard request information such as IP address, timestamp, page requested and user agent, for security and reliability.
• The sr_ref referral cookie. A first-party, functional cookie set only when you follow a member’s referral link (/r/{code}). It stores the referral code so, if you take your first class, the right member gets the credit. It lasts 90 days, is never used for advertising or tracking across other sites, and the first link you follow is the one that counts.
• Class participation. Classes are recorded so registrants receive the Replay for about 7 days, after which the master recording is deleted. If your camera or microphone is on, your image or voice may be captured. Both are optional — see the Waiver. Recording and hosting is handled by a third-party video and recording provider acting as our processor, which also collects its own information under its own privacy policy.

We never receive your full card number. Payment is handled entirely by Stripe, our payment processor, on its own pages. Card data never touches our servers; we receive only a confirmation, the amount, and non-sensitive identifiers such as the last four digits or a transaction reference.

What we do not collect: passwords, government identifiers, precise geolocation, biometric identifiers, or your contacts. We do not use advertising cookies, tracking pixels, cross-site trackers, or third-party advertising analytics.

2. Why we use it

• To sell you a Class or pass, take payment and send you a receipt.
• To hold your seat, send confirmations, reminders, join links and Replay links.
• To manage credits, expiries, cancellations, reschedules and guest passes.
• To run a Membership if you take one — to charge it each month, grant and roll over its classes, tell you when a payment fails or a price changes, and cancel it when you ask.
• To keep and, if ever necessary, produce proof of what you were told about automatic renewal and that you agreed to it. This is a legal-obligation and legal-defense purpose, and it is the reason we store an IP address with that consent too.
• To let an instructor read your Practice Notes before your Class and teach to them.
• To answer your emails and handle refund requests.
• To keep and, if ever necessary, produce proof that you agreed to the Waiver and Terms — this is a legal-defense purpose and the reason we store an IP address with consent.
• To keep the site working and secure, prevent fraud and abuse, and fix problems.
• To meet tax, accounting and other legal obligations.

We use this information for the purposes above and for compatible purposes. We do not use it to build advertising profiles, and we do not make automated decisions about you that produce legal or similarly significant effects.

3. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising — for money or for anything else. We have not done so in the preceding 12 months, and we do not sell or share the personal information of anyone, including anyone under 16. Because there is nothing to opt out of, an opt-out-preference signal such as Global Privacy Control changes nothing about how we treat you; we honor it as a request all the same.

4. Who we disclose it to

We use a small number of service providers, who may process personal information only on our instructions, only to do the job we hired them for, and never for their own purposes:

• Payment processing — takes your payment and holds your card data (Stripe). If you hold a Membership, it also keeps your card on file so the monthly renewal can be charged, and it runs the billing portal where you update or remove it.
• Email delivery — sends your confirmations, reminders and receipts.
• Hosting and database — runs the site and stores the records described above.
• Google sign-in — if you use it, Google handles the sign-in itself and tells us the verified email address on the account, under its own privacy policy. Signing in is always optional; every link we email you keeps working without it.
• Live-class video and recording provider — hosts the Class and makes the recording, acting as our processor, under its own privacy policy. We instruct it to delete the master recording once the replay window closes.

We may also disclose personal information: to our accountants, insurers and lawyers where reasonably needed; when required by law, subpoena or valid legal process; to establish, exercise or defend legal claims — including responding to a payment dispute or chargeback with your booking and consent records; to protect the rights, safety or property of anyone, including in an emergency; and to a successor if the business is merged, financed, acquired or sold, in which case this Policy continues to apply to information transferred until it is replaced by a policy you are told about.

5. How long we keep it

• Waiver-consent records: kept for as long as we may need them to establish or defend a legal claim — generally at least seven (7) years after the Class they relate to, and longer where a claim, an investigation or a minor’s tolling period requires it. These records are append-only and are the one category we will not delete on request while that need lasts.
• Auto-renewal consent records: kept for three (3) years after the Membership they relate to ends. That is the retention period the automatic-renewal laws expect of us, and it is a legal-obligation and legal-defense exception to deletion for as long as it runs. Like waiver-consent records, these are append-only.
• Membership, purchase and refund records: kept as long as tax, accounting and chargeback-response rules require, generally seven (7) years.
• Booking history and Practice Notes: kept while you are an active customer and for up to three (3) years after your last Class, then deleted or de-identified — earlier on request.
• Class recordings: the Replay is made available to registrants for about 7 days; the master recording is deleted once that window closes.
• Email logs and technical logs: generally up to twenty-four (24) months.

6. Your privacy rights

Wherever you live in the United States, we will honor the following requests, free of charge, and we will not treat you differently — worse prices, worse service, fewer classes — for making one:

• Know / access. What we collect about you, where it came from, why we use it, who we disclose it to, and a copy of it in a portable format.
• Delete. Deletion of your personal information, self-serve, at any time: open “Delete my account” at the bottom of your account page (or write to hello@sunroom.yoga). It cancels any Membership that day, removes your saved payment details at our payment processor, releases upcoming seats, erases your name, email address, time zone, Practice Notes and email delivery logs, removes any waitlist entry, and ends every sign-in link we ever sent you; we email you a confirmation. What stays is the exceptions in section 5 and in law: waiver-consent and auto-renewal-consent records, and purchase, refund and tax records with your contact details removed.
• Correct. Correction of inaccurate personal information — an email address, a name, a Practice Note.
• Opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; the answer to such a request will say so.
• Limit the use of sensitive personal information. We do not use sensitive personal information for any purpose other than delivering the service you asked for.
• Appeal. If we decline a request, you may appeal by replying to our decision; we will respond in writing with our reasoning within the time your state’s law allows, and tell you how to contact your state attorney general.

California (CCPA/CPRA). California residents have the rights above, including the right to know the categories of personal information we collected (identifiers, commercial information, internet activity, and — if you provide it — health-related information you choose to share in Practice Notes), the categories of sources (you, your browser, and our payment processor), our business purposes (section 2), and the categories of third parties we disclose to (section 4). We have not sold or shared personal information in the preceding 12 months. You may use an authorized agent; we will ask for proof of their authority and may still verify your identity directly.

Virginia, Colorado, Connecticut, Utah and other states. Residents of Virginia, Colorado, Connecticut, Utah, and any other state whose consumer privacy law applies to us have the equivalent rights that law gives them — access, correction, deletion, portability, opt-out of sale/targeted advertising/profiling, and, where provided, an appeal. We apply this section to everyone in the United States rather than sorting people by state.

How to make a request. Email hello@sunroom.yoga from the address you booked with, and tell us what you want. Because we have no accounts, control of that email address is how we verify you; if we cannot verify a request, we will tell you why rather than hand your information to the wrong person. We respond within 45 days and may extend once where the law allows.

7. Children

The Studio is for adults. The site and the Classes are not directed to children, and we do not knowingly collect personal information from anyone under 18, or from anyone under 13 within the meaning of the Children’s Online Privacy Protection Act. If you believe a child has given us personal information, write to hello@sunroom.yoga and we will delete it promptly.

8. Security

We keep the amount of information we hold deliberately small, which is the strongest protection available. In addition: the site is served over encrypted connections (HTTPS); data is stored with reputable providers that encrypt data in transit and at rest; card data never reaches our systems; private links are cryptographically signed and can be invalidated on request; access to production data is limited to people who need it. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your information, we will notify you and the authorities as the law requires.

9. Where your information is handled

We are a United States company serving customers in the United States, and information is stored on servers in the United States. Our team and some of our service providers operate from outside the United States, so your personal information may be accessed or processed from other countries whose data-protection laws differ from those of your state. Wherever it is handled, we apply this Policy to it.

10. Marketing email

Everything we send you as part of a booking — confirmations, receipts, reminders, class changes, Replay links — is transactional and is not marketing. We send promotional email only if you separately opt in, and every promotional message will carry an unsubscribe link and our postal address. You can also opt out any time by writing to us.

11. The pre-launch waitlist

Before we’re open for booking, the front page may instead invite you to join a waitlist so we can tell you when classes go live. If you sign up:

• What we collect. Your email address, and your name if you choose to give it. We also store a salted hash of the IP address the signup came from (never the raw address) and your browser user-agent, for fraud and abuse prevention — the same purpose as our technical logs in section 1.
• Why. Solely to notify you when Sunroom opens for booking. This is our first list-style email rather than a one-off transactional receipt, so we treat it accordingly: a CAN-SPAM-compliant postal address and an unsubscribe link on every message, described below.
• Consent — double opt-in. Submitting the form does not put you on the list. We first send a confirmation email; only clicking the link in that email confirms your address. If you never click it, we hold the address unconfirmed and do not add you to any list we would mail beyond a small number of confirmation reminders.
• Retention. We keep waitlist records until we launch and finish notifying the list, or until you unsubscribe or ask us to delete your entry, whichever comes first.
• Never sold or shared. Waitlist addresses are held for this purpose only. They are never sold, shared, rented or used for advertising, and they are never disclosed to anyone outside the service providers named in section 4 that keep the site and its email running.
• How to unsubscribe. Every waitlist email carries an unsubscribe link. You can also reply STOP to any waitlist email, or write to hello@sunroom.yoga, and we will remove you promptly.

12. Changes to this Policy

If we change this Policy we will update the effective date and version identifier above, and for material changes we will tell you by email or with a notice on the site. Changes apply going forward.

13. Contact

Delvir Limited Liability Co. (Wyoming), doing business as Sunroom Yoga. Privacy questions and requests: hello@sunroom.yoga. Postal address: 30 N Gould St, Ste R, Sheridan, WY 82801.