Privacy Policy

Last updated: 1 August 2026

1. Scope and roles

The Clase platform is operated by Brickell for Custom Software Design & Programming Company(شركة بريكل لتصميم وبرمجة البرمجيات الخاصة), a one-person company registered in the State of Kuwait (commercial registration no. 535931, licence no. 2025/18787). References to “Clase”, “we” or “us” in this policy mean Brickell. This policy covers the Clase platform: the Studio Dashboard (my.clase.app), the public Member Webapp (clase.app/<business>), the Clase iOS app, the clase.app website and related services (together, the “Services”). Two roles matter:

• Clase as processor.When a gym, studio or coach (a “Business”) manages its members through Clase, the Business decides what member data is collected and why — the Business is the data controller, and Clase processes that data on its behalf to run bookings, memberships, check-in, sales and notifications. Member questions about how a specific Business uses your data should go to that Business first.
• Clase as controller. For Business accounts, staff logins, platform subscriptions and billing, the clase.app website and demo requests, Clase decides how and why the data is used and is the controller.

2. Data we collect

Account and profile data

• Name, email address, phone number and country — for Business staff and Members.
• Login data: authentication identifiers, one-time codes and session tokens.

Booking and membership data

• Classes booked, attendance and check-ins (including walk-ins), waitlists, cancellations, memberships, packages and remaining credits.
• Purchases from a Business (products, packages) and their invoices.

Payment data

• Transaction metadata only: amount, currency, status (paid / failed / refunded), invoice references and the payment method type. We never collect or store card numbers — see section 4.

Communications data

• Delivery logs for transactional messages (email, WhatsApp, SMS): recipient, template used, delivery status and timestamps — plus your opt-out preferences.

Technical data

• Device and log information generated when you use the Services: IP address, browser or app version, and timestamps of requests — used for security, debugging and abuse prevention.

Wallet passes

• If you add a membership pass to Apple Wallet, we generate the pass from your name and membership details and register the device token Apple provides so the pass can be kept up to date.

3. How we use data

• To provide the Services: schedules, bookings, memberships, check-in, sales and reporting.
• To send transactional notifications about your bookings and account (section 6).
• To bill Businesses for their Clase subscription and add-ons.
• To secure the platform: authentication, access control, audit logs and abuse prevention.
• To improve the Services, using aggregated or de-identified usage information.
• To comply with legal obligations.

We do not sell personal data, and we do not use Member data to advertise third-party products.

4. Payment data

• Online payments are processed by a licensed third-party payment gateway. When you pay, you are redirected to the gateway’s secure, PCI-DSS-compliant payment pages — your card details are entered there, never on Clase, and are handled under the gateway’s own privacy policy.
• Clase receives back only the transaction outcome and reference needed to confirm your booking or purchase.
• Each Business connects its own gateway account by entering its API token in the dashboard. These tokens are sent over encrypted connections (TLS/HTTPS) and stored encrypted in a server-side secrets vault; they are used only by our backend and are never exposed to browsers, apps or other parties. Payments go directly to the Business’s own merchant account.

5. Who we share data with

• The Business you interact with. When you book with, buy from or join a Business, that Business sees your profile, bookings, attendance and purchase history with them — this is the point of the platform.
• Service providers who help us run the platform — such as cloud hosting and database infrastructure, payment processing (as described in section 4), and delivery of email, WhatsApp and SMS notifications. They process data only as needed to provide their service to us and are bound to protect it.
• Legal reasons. Where required by law, regulation or valid legal process, or to protect the rights, safety and security of Clase, our users or the public.
• Business transfers. If Clase is involved in a merger, acquisition or asset sale, data may transfer as part of that transaction under equivalent protections.

We never share one Business’s data with another Business.

6. WhatsApp, SMS and email

• We send transactional messages only — booking confirmations, cancellations, class reminders and payment receipts. We do not send marketing broadcasts through these channels.
• WhatsApp notifications are sent from a Clase-operated number using pre-approved templates. Reply STOP to any WhatsApp message to opt out and START to opt back in; your preference is stored and enforced before every send.
• Delivery status (sent, delivered, read, failed) is logged so Businesses can see whether their members were notified.

7. Security

• All traffic to and from the Services is encrypted in transit (TLS/HTTPS).
• Data is stored encrypted at rest on our hosting infrastructure.
• Secrets — including payment gateway tokens and messaging credentials — are kept in a dedicated encrypted vault, accessible only to backend services, never to client apps.
• Access is segregated per Business: row-level security and role checks ensure staff can only reach their own organisation’s data, and sensitive operations run through server-side procedures with their own permission gates.
• Administrative actions on our operator console are restricted to authorised Clase personnel and recorded in an audit log.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected parties and authorities as required by applicable law.

8. Retention

• Account, booking and purchase records are kept while your account or your Business’s subscription is active, and afterwards only as long as needed for legitimate purposes — resolving disputes, financial record-keeping and legal compliance.
• When a Business ends its subscription, its data is made available for export on request for a reasonable period, then deleted or anonymised in line with this policy.
• Message delivery logs and technical logs are retained for shorter operational periods.

9. Your rights

Subject to applicable law — including Kuwait’s Data Privacy Protection Regulation issued by CITRA — you may request:

• access to the personal data we hold about you;
• correction of inaccurate data;
• deletion of your data, where we have no overriding legal obligation to keep it;
• a copy of your data in a portable format;
• objection to or restriction of certain processing.

If your data is managed by a Business through Clase, we may redirect your request to that Business as controller, or assist them in fulfilling it. To exercise any right, contact us at the address in section 13; we may need to verify your identity first.

10. Where data is stored

Our infrastructure providers may store and process data on servers located outside Kuwait. Wherever data is processed, we apply the safeguards described in this policy and require our sub-processors to protect it to an equivalent standard.

11. Children

The Services are not directed at children. Businesses that accept members under 18 are responsible for obtaining any parental or guardian consent their own policies and local law require. If you believe a child’s data has been provided to us without appropriate consent, contact us and we will take reasonable steps to address it.

12. Changes to this policy

We may update this policy from time to time. For material changes we will give notice through the Services or by email before the change takes effect. The “Last updated” date above always reflects the current version.

13. Contact

Privacy questions and requests: support@clase.app.

Data controller for platform accounts and billing: Brickell for Custom Software Design & Programming Co. (شركة بريكل لتصميم وبرمجة البرمجيات الخاصة) · State of Kuwait · Commercial registration no. 535931 · Licence no. 2025/18787.