This policy explains how Andrii Melnyk ("we", "us") handles personal data when you use Claseha (the "Service"). We are the data controller within the meaning of the EU General Data Protection Regulation (GDPR).
1. Who we are
Data controller: Andrii Melnyk. Contact: contact@claseha.com. We process your data in the European Union using Cloudflare infrastructure.
2. What data we collect
We collect the minimum data required to run the Service:
- Account data: name, email, phone number, hashed password, role (owner/trainer/member), language preference.
- Usage data: classes you create or book, gym you belong to, timestamps.
- Technical data: IP address, user agent, and request metadata processed by Cloudflare for security and reliability.
- Optional analytics and marketing data if you consent (see Cookie Policy).
3. Purposes and legal basis
- Provide the Service — Art. 6(1)(b) GDPR (contract).
- Security, fraud prevention, and service integrity — Art. 6(1)(f) GDPR (legitimate interests).
- Email verification and account communications — Art. 6(1)(b) GDPR (contract).
- Analytics and marketing — Art. 6(1)(a) GDPR (consent), which you can withdraw at any time.
4. Who we share data with
We use the following processors, each under a data processing agreement:
- Cloudflare, Inc. — hosting, edge network, database (processes data in the EU).
- Cloudflare Web Analytics — cookieless, anonymous aggregate traffic counts (no personal data, no consent required).
- Resend, Inc. — transactional email delivery (EU region).
- Google LLC — analytics, only if you consent.
- Meta Platforms Ireland Ltd. — advertising pixel, only if you consent.
5. International transfers
Where processors transfer data outside the European Economic Area, transfers rely on Standard Contractual Clauses adopted by the European Commission and additional safeguards where required.
6. Retention
We retain account data for as long as your account is active. You can delete your account at any time by contacting us, after which personal data is deleted within 30 days unless we are legally required to keep it longer (e.g. tax records).
7. Your rights
You have the following rights under the GDPR. To exercise them, email us at contact@claseha.com:
- Access — ask what data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data.
- Restriction — ask us to limit how we process your data.
- Portability — receive your data in a portable format.
- Objection and withdrawal of consent — at any time, without affecting lawfulness of prior processing.
You can also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.
8. Changes to this policy
We may update this policy from time to time. We will announce material changes on this page and by email at contact@claseha.com where appropriate.