Privacy Policy

The short version: we collect the little we need to hold your mat, teach your class and keep a record that you agreed to the waiver. We do not sell your personal information, we do not share it for advertising, and we never see your card number.

This Privacy Policy is v1.0, effective August 17, 2026; the version identifier stored with your consent record is 2026-08-17. It explains how Delvir Limited Liability Co., a Wyoming limited liability company doing business as Sunroom Yoga (“the Studio,” “we,” “us”), handles personal information at sunroom.yoga and in our live online yoga classes (“Classes”). It works with our Terms of Service, our Liability Waiver and our Refund & Cancellation Policy.

1. What we collect

• Your email address. Required. It is how you are identified — there are no accounts and no passwords — and how every confirmation, reminder and replay link reaches you.
• Your name. Optional, and used so an instructor can greet you by name and so a guest booking can be matched to its host.
• Booking and purchase records. Which Classes you booked, attended, rescheduled or cancelled; your seat; which pass you bought, what it cost, its credits and their expiry; refunds; and the identifiers our payment processor gives us for the transaction.
• Practice Notes. Optional free text you may submit at booking — injuries, goals, what your body is doing lately. This can include health information. Share only what you want your teacher to know, and leave it blank if you would rather not. We are not a healthcare provider and this is not a medical record.
• Waiver-consent records. Every seat creates its own record containing the document versions you agreed to, the date and time, your email, the name you gave, the Class, your IP address and your browser user-agent string. We keep these because they are the proof that consent was given, and they are never edited afterward.
• Your time zone. Detected by your browser so the schedule shows your local times, and stored with your record so emails show the right time.
• Email delivery logs. Which message we sent you, when, and whether it was delivered.
• Basic technical logs. Our hosting provider records standard request information such as IP address, timestamp, page requested and user agent, for security and reliability.
• Class participation. Classes are recorded so registrants receive the Replay for about 7 days. If your camera or microphone is on, your image or voice may be captured. Both are optional — see the Waiver. The video platform we use also collects its own information under its own privacy policy.

We never receive your full card number. Payment is handled entirely by Stripe, our payment processor, on its own pages. Card data never touches our servers; we receive only a confirmation, the amount, and non-sensitive identifiers such as the last four digits or a transaction reference.

What we do not collect: passwords, government identifiers, precise geolocation, biometric identifiers, or your contacts. We do not use advertising cookies, tracking pixels, cross-site trackers, or third-party advertising analytics.

2. Why we use it

• To sell you a Class or pass, take payment and send you a receipt.
• To hold your seat, send confirmations, reminders, join links and Replay links.
• To manage credits, expiries, cancellations, reschedules and guest passes.
• To let an instructor read your Practice Notes before your Class and teach to them.
• To answer your emails and handle refund requests.
• To keep and, if ever necessary, produce proof that you agreed to the Waiver and Terms — this is a legal-defense purpose and the reason we store an IP address with consent.
• To keep the site working and secure, prevent fraud and abuse, and fix problems.
• To meet tax, accounting and other legal obligations.

We use this information for the purposes above and for compatible purposes. We do not use it to build advertising profiles, and we do not make automated decisions about you that produce legal or similarly significant effects.

3. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising — for money or for anything else. We have not done so in the preceding 12 months, and we do not sell or share the personal information of anyone, including anyone under 16. Because there is nothing to opt out of, an opt-out-preference signal such as Global Privacy Control changes nothing about how we treat you; we honor it as a request all the same.

4. Who we disclose it to

We use a small number of service providers, who may process personal information only on our instructions, only to do the job we hired them for, and never for their own purposes:

• Payment processing — takes your payment and holds your card data (Stripe).
• Email delivery — sends your confirmations, reminders and receipts.
• Hosting and database — runs the site and stores the records described above.
• Live-class video platform — hosts the Class itself and its recording, under its own privacy policy.

We may also disclose personal information: to our accountants, insurers and lawyers where reasonably needed; when required by law, subpoena or valid legal process; to establish, exercise or defend legal claims — including responding to a payment dispute or chargeback with your booking and consent records; to protect the rights, safety or property of anyone, including in an emergency; and to a successor if the business is merged, financed, acquired or sold, in which case this Policy continues to apply to information transferred until it is replaced by a policy you are told about.

5. How long we keep it

• Waiver-consent records: kept for as long as we may need them to establish or defend a legal claim — generally at least seven (7) years after the Class they relate to, and longer where a claim, an investigation or a minor’s tolling period requires it. These records are append-only and are the one category we will not delete on request while that need lasts.
• Purchase and refund records: kept as long as tax, accounting and chargeback-response rules require, generally seven (7) years.
• Booking history and Practice Notes: kept while you are an active customer and for up to three (3) years after your last Class, then deleted or de-identified — earlier on request.
• Class recordings: the Replay is made available to registrants for about 7 days; masters are deleted or retained only as long as needed for a business or legal reason.
• Email logs and technical logs: generally up to twenty-four (24) months.

6. Your privacy rights

Wherever you live in the United States, we will honor the following requests, free of charge, and we will not treat you differently — worse prices, worse service, fewer classes — for making one:

• Know / access. What we collect about you, where it came from, why we use it, who we disclose it to, and a copy of it in a portable format.
• Delete. Deletion of your personal information, subject to the exceptions in section 5 and in law (for example, we keep waiver-consent, purchase and tax records).
• Correct. Correction of inaccurate personal information — an email address, a name, a Practice Note.
• Opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; the answer to such a request will say so.
• Limit the use of sensitive personal information. We do not use sensitive personal information for any purpose other than delivering the service you asked for.
• Appeal. If we decline a request, you may appeal by replying to our decision; we will respond in writing with our reasoning within the time your state’s law allows, and tell you how to contact your state attorney general.

California (CCPA/CPRA). California residents have the rights above, including the right to know the categories of personal information we collected (identifiers, commercial information, internet activity, and — if you provide it — health-related information you choose to share in Practice Notes), the categories of sources (you, your browser, and our payment processor), our business purposes (section 2), and the categories of third parties we disclose to (section 4). We have not sold or shared personal information in the preceding 12 months. You may use an authorized agent; we will ask for proof of their authority and may still verify your identity directly.

Virginia, Colorado, Connecticut, Utah and other states. Residents of Virginia, Colorado, Connecticut, Utah, and any other state whose consumer privacy law applies to us have the equivalent rights that law gives them — access, correction, deletion, portability, opt-out of sale/targeted advertising/profiling, and, where provided, an appeal. We apply this section to everyone in the United States rather than sorting people by state.

How to make a request. Email hello@sunroom.yoga from the address you booked with, and tell us what you want. Because we have no accounts, control of that email address is how we verify you; if we cannot verify a request, we will tell you why rather than hand your information to the wrong person. We respond within 45 days and may extend once where the law allows.

7. Children

The Studio is for adults. The site and the Classes are not directed to children, and we do not knowingly collect personal information from anyone under 18, or from anyone under 13 within the meaning of the Children’s Online Privacy Protection Act. If you believe a child has given us personal information, write to hello@sunroom.yoga and we will delete it promptly.

8. Security

We keep the amount of information we hold deliberately small, which is the strongest protection available. In addition: the site is served over encrypted connections (HTTPS); data is stored with reputable providers that encrypt data in transit and at rest; card data never reaches our systems; private links are cryptographically signed and can be invalidated on request; access to production data is limited to people who need it. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your information, we will notify you and the authorities as the law requires.

9. Where your information is handled

We are a United States company serving customers in the United States, and information is stored on servers in the United States. Our team and some of our service providers operate from outside the United States, so your personal information may be accessed or processed from other countries whose data-protection laws differ from those of your state. Wherever it is handled, we apply this Policy to it.

10. Marketing email

Everything we send you as part of a booking — confirmations, receipts, reminders, class changes, Replay links — is transactional and is not marketing. We send promotional email only if you separately opt in, and every promotional message will carry an unsubscribe link and our postal address. You can also opt out any time by writing to us.

11. Changes to this Policy

If we change this Policy we will update the effective date and version identifier above, and for material changes we will tell you by email or with a notice on the site. Changes apply going forward.

12. Contact

Delvir Limited Liability Co. (Wyoming), doing business as Sunroom Yoga. Privacy questions and requests: hello@sunroom.yoga. Postal address: 30 N Gould St, Ste R, Sheridan, WY 82801.