Privacy Policy

1. What we collect

Account information. Your email address, display name, and profile details you choose to add. Authentication is handled by Supabase; we store the identifiers it returns, not your password.

Class activity. Classes you create, enrol in, and attend; attendance and watch time; messages sent in class chat; and post-class reviews you submit.

Live session data. When you join a live class, our video infrastructure processes your audio and video in real time to deliver it to other participants. Where a session is recorded, we store that recording.

Payment information. Payments are processed by Stripe, Inc. We do not receive or store your full card number. We retain transaction records, amounts, and payment status.

Technical data. IP address, browser and device type, and log data generated when you use the Service, including error reports.

Marketing and analytics data. Information collected through cookies and similar technologies, described in Section 8.

2. How we use it

We use this information to operate the Service — running classes, processing payments, sending transactional email, providing support, investigating violations of our Terms, and diagnosing and fixing problems. We also use aggregate activity data to understand what's working on the platform and to improve it.

We do not sell your personal information.

3. Live sessions and recordings

Live classes are visible and audible to everyone in the session. Assume that anything you say or show on camera is seen by other participants.

Where a class is recorded, the recording is stored and may be made available to enrolled students. Recordings are retained for the period stated in Section 6. You can request deletion of a recording in which you appear; see Section 9.

4. Who we share it with

We share personal information with service providers who help us operate basefloor, under agreements limiting their use of it:

• Supabase — authentication and identity.
• Stripe, Inc. — payment processing.
• LiveKit — live audio and video delivery.
• Cloudflare — file and recording storage.
• Render — application hosting.
• Resend — transactional email.
• Sentry — error monitoring.
• Amplitude — product analytics and session replay (see Section 8).

We also share information with teachers about students enrolled in their classes — name, and attendance — so they can run the class.

We may disclose information where required by law, to enforce our Terms, or to protect the rights and safety of users. If Smoshy Inc. is acquired or merges with another company, information may transfer as part of that transaction.

5. Where we store it

Our infrastructure is hosted in the United States. If you use basefloor from outside the US, your information is transferred to and processed in the US.

6. How long we keep it

We keep account information for as long as your account is active. After you close your account, we delete or anonymise personal information within 90 days, except where we're required to retain records for legal, tax, or accounting purposes — payment records in particular are retained as long as applicable law requires.

Session recordings are retained for 12 months from the date of the session unless deleted earlier at the request of a participant or the teacher.

7. Children's privacy

basefloor is an 18+ service. It is not directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us and we will delete it and terminate the account.

8. Cookies, analytics, and advertising

We use cookies and similar technologies for authentication, to remember your preferences, and to measure how the Service is used.

We use Amplitude for product usage analytics and session replay. When you are signed in, usage events (pages viewed, classes enrolled, sessions joined) are associated with your basefloor account so we can understand how the product is used. We may also record a replay of how the interface was used during a visit; anything you type into form fields is masked before it leaves your browser, and payment details are entered directly with Stripe and never reach Amplitude. We also use Google Analytics for aggregate site measurement.

We also use advertising and analytics technologies from Meta Platforms and LinkedIn, which set cookies and may build profiles used to show you ads for basefloor on their platforms and to measure whether those ads work. These providers act as independent controllers of the data they collect.

You can control cookies through your browser settings, and you can control ad personalisation through your Meta and LinkedIn account settings. Blocking essential cookies will prevent you from signing in.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent you've given. California residents have the additional rights described under the CCPA/CPRA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights, email [email protected]. We'll respond within the period required by applicable law. We may need to verify your identity first.

10. Security

We protect personal information with access controls, encryption in transit, and restricted administrative access. No system is completely secure, and we can't guarantee that your information will never be accessed by an unauthorised party.

11. Changes to this policy

We may update this policy. When we make material changes, we'll update the date at the top and notify account holders by email or in-product notice before the changes take effect.

12. Contact

Questions about privacy, or a request under Section 9? Email [email protected].

Smoshy Inc., Delaware, United States.