Privacy Policy · Classat

Who this notice covers

This Privacy Policy applies to the Classat mobile application, the Classat website, Classat One, and related customer support services operated by Classat (“Classat”, “we”, “us”, or “our”).

Classat acts as the controller of the customer personal data described here. Independent studios also process the limited booking information they receive in order to deliver your class and record attendance.

Personal data we collect

We collect data directly from you, from your use of Classat, and from service providers that help us complete an action you request.

Account data: mobile number, verification status, name, preferred language, optional gender, and marketing preference.
Booking data: selected studio, class or trainer, session time, waitlist activity, booking status, entry code, check-in, cancellation, attendance, and no-show status.
Wallet and transaction data: credit balance and ledger entries, pack or plan purchases, amounts paid in Saudi riyals, payment method category, transaction identifiers, receipts, renewal status, and refunds.
Content you provide: ratings, review text, support messages, and any information you choose to send when contacting us.
Device and notification data: device push token, operating-system platform, notification preference, and basic technical information needed to deliver and secure the service.
On-device preferences: district and browse preferences may remain on your device. Classat does not request continuous or background precise location access for marketplace browsing.

How we use personal data

Create and secure your account using phone verification.
Show eligible sessions and trainers, process bookings and waitlists, manage credits, and issue tickets and receipts.
Let a studio or trainer confirm your booking and check you in.
Send service messages you request or enable, such as booking reminders, waitlist offers, credit-expiry reminders, and renewal notices.
Provide support, investigate errors, prevent abuse, resolve disputes, process refunds, and keep required audit and accounting records.
Send Classat news and offers only when you have opted in, and stop when you withdraw that choice.
Improve reliability and understand service performance using operational records. Classat does not use third-party advertising or cross-app tracking.

Our legal bases

Depending on the activity, Classat processes personal data because it is necessary to perform the service agreement with you, to comply with a legal obligation, to protect the service and the rights of customers and partners where permitted, or because you have given consent.

Optional marketing, notifications, calendar access, and device permissions are based on your choice. You may withdraw them without losing access to the core browsing and booking service, although a feature that depends on a permission may stop working.

Who receives personal data

We share only what is reasonably needed for the purpose described. Recipients may include:

The studio for a marketplace booking: your display name, booking details, entry code, and attendance status. Studios do not receive your phone number or wallet information.
The assigned Classat One trainer: your first name, session and entry details, and the service location only when needed for that session. Trainers do not receive your phone number, wallet, or payment information.
Infrastructure and authentication providers, including Supabase, that host data and help verify accounts and operate the service.
Notification delivery providers, including Expo and the device platform, when you enable push notifications.
A payment provider when real payments are enabled. Payment credentials are handled by that provider; Classat is designed to receive transaction status and reference data rather than full card details.
Map, calendar, or messaging services when you choose to open directions, add a booking to your calendar, or contact support. Those services process data under their own notices.
Authorities, advisers, insurers, or transaction counterparties when disclosure is required by law or reasonably necessary to protect legal rights, safety, or the service.

International transfers

Some service providers may process personal data outside the Kingdom of Saudi Arabia. Where a transfer is subject to the Saudi Personal Data Protection Law, Classat will use the lawful transfer mechanism and safeguards required for that transfer and limit it to the data needed for the stated purpose.

Retention and deletion

We keep personal data only while it is needed for the purpose collected, to provide the service, and to meet legal, accounting, tax, fraud-prevention, dispute, and audit obligations. Different records have different retention periods. Booking, payment, refund, credit-ledger, and audit records may need to be retained after account closure, with access restricted and direct identifiers removed or minimized where appropriate.

Signing out removes local customer data and asks the service to remove the registered push token. You can request server-side account and personal-data deletion through the dedicated Account deletion page. We may verify that the request comes from the phone number attached to the account. We will explain any record that must be retained by law or for an unresolved transaction or claim.

Your choices and rights

Subject to the Saudi Personal Data Protection Law and applicable exceptions, you may have the right to:

Be informed about how your personal data is collected and used.
Access your personal data and request a readable copy.
Correct, complete, or update inaccurate personal data.
Request destruction of personal data when the applicable conditions are met.
Withdraw consent for processing based on consent, including marketing.

Security

Classat uses technical and organizational safeguards designed to protect personal data, including encrypted connections, phone verification, role-based access, row-level database controls, restricted staff and partner views, and audit logging for sensitive actions. No system can promise absolute security, so we also maintain processes to investigate and respond to suspected incidents.

Children

Classat is not directed to children who cannot lawfully enter the service agreement or provide the required consent. If you believe a child has provided personal data without valid authorization, contact us so we can investigate and take appropriate action.

Changes and contact

We may update this notice when the service or our data practices change. We will publish the revised date and provide an additional notice where required. Questions, rights requests, and privacy complaints can be sent to privacy@classat.fit. You may also use the Account deletion page for deletion requests.