Privacy Policy

2.1 Account Registration

When you create an account, we collect:

We use this to create and manage your account, verify your identity, and send transactional emails (account confirmation, password reset).

2.2 Subscription Data

We record your subscription plan (B2C: monthly or annual; B2B: per-seat monthly or annual, or Enterprise), activation date, and renewal date to provide access to content. For every payment that settles we also keep a payment record — the amount charged, tax, the Stripe processing fee, the settlement date and Stripe's identifiers — as accounting evidence and, where you signed up through a referral partner, as the basis of that partner's commission.

VAT on your subscription is charged at the rate of the country you live in, as you choose it when you subscribe (for a special tax territory, as your billing address shows). To determine and evidence that country we record, for each completed checkout: the country and any special tax territory you selected, the country of the billing address entered at checkout, the country VAT was charged for, the country of your card or bank account, the country your internet connection was in when the checkout started, and — if that connection was in another country than the one you chose — that you confirmed your choice, and whether at signup or at checkout. We store countries and territories only — not your address and not your IP address.

Where subscriptions are not yet available in your country or territory, you can join a waitlist. We then store your email address and country (and territory), on the basis of your consent (Art. 6(1)(a) GDPR), to send you one notification when they become available. You can withdraw at any time by writing to us.

If you ask us to call you back about a subscription for a studio, gym or hotel, we store the kind and name of the place, its city, its number of Reformers and the phone number or email address you give, to contact you about an offer (steps prior to a contract, Art. 6(1)(b) GDPR). You do not need an account for this. If the request came through a partner's website, we note that partner.

After your first payment we may ask once how you found us and whether you would like to tell us anything. Answering is optional; skipping it is also recorded, so we do not ask again. We use the answers to understand which channels bring members and to improve the service (legitimate interest, Art. 6(1)(f) GDPR). Please do not include health information in your message.

Legal basis: Contract (Art. 6(1)(b) GDPR); the payment record is retained under our statutory accounting obligation (Art. 6(1)(c) GDPR, §132 BAO), the country record under our VAT record-keeping obligation (Art. 6(1)(c) GDPR, Art. 63c of Implementing Regulation (EU) No 282/2011).

2.3 Usage and Progress Data

While you use the Service, we record:

• Which videos you have watched and how many times
• The audio language you listened to a class in (the original voice-over or a translated one)
• Your session completion status per video
• Your last watched timestamp per video
• Fitness goals you set (weekly sessions, weekly minutes)
• Your activity streak (current and longest)
• Videos you have marked as favourites

Purpose: To power your personal dashboard, progress tracking, and personalised recommendations. The shared account of a studio or hotel kiosk has no individual dashboard; goals, favourites and streaks are not collected for it (see § 2.5). If you sign in on a studio's tablet with your own account, see § 2.5a.

Legal basis: Contract (Art. 6(1)(b) GDPR) — this data is core to the service you signed up for.

We also count, across all accounts, how often each audio language is played and finished, so we can decide which languages to offer next. These counts are only ever looked at in total, never per person. Legal basis for this count: our legitimate interest in improving the classes (Art. 6(1)(f) GDPR); you can object at any time (see Section 6).

2.4 Activity Logs

We log the following events with a timestamp, your IP address, and browser/device identifier (User-Agent):

• Login
• Logout
• Session start / session end

Purpose: Security monitoring, abuse prevention, and session integrity.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) — to protect the platform and our users from unauthorised access.

Retention: 90 days. Logs older than this are deleted automatically.

2.5 B2B / Hotel Guest Users

If you access the Service via a hotel or partner kiosk, your usage may be tracked under a shared account. The following data is recorded per session:

• Video watched, seconds watched, completion status
• Audio language of the class
• Timestamp
• At studios that offer sign-in with your own account (see § 2.5a): each visit to the tablet, meaning when it started and ended, how it ended (for example after a few minutes without use) and which functions were used, such as filters, search, favourites, music or the audio language, with the class where a function concerns one. A visit is not linked to a person unless they sign in with their own account.

This data is shared in aggregated, anonymised form with the hotel/partner for analytics purposes. Individual guest data is not shared with the hotel.

Legal basis: Legitimate interests of the hotel partner to understand service usage, and our legitimate interest in understanding how the Service is used on shared tablets so we can improve it.

2.5a Your Own Account on a Studio Tablet

At participating studios you can choose “Login” on the studio's tablet and confirm on your own phone. The tablet then shows your first name, your favourites and your statistics, and the classes you favourite or complete there are saved to your account. The studio's tablet keeps playing classes under the studio's own access; your account needs no subscription for this.

For every such sign-in we record: your account, the studio, its location, the tablet, when the sign-in started, when it was last active, when it ended and why. A sign-in ends, for example, when you tap “Done”, when the tablet has not been touched for about 10 minutes (a class that keeps playing counts as use for up to 75 minutes), after three hours at the latest, when the page on the tablet is reloaded, when you sign in on another tablet, or when the studio turns the feature off. While you are signed in we also record your visit to the tablet: when it started and ended, how it ended, and which functions you used, such as filters, search, favourites, music, the audio language or your statistics, with the class where a function concerns one. We use these records to provide the feature, to keep your sign-in bound to that one tablet, to detect misuse (for example, many different accounts on one tablet in a short time), and to understand how the feature is used so we can improve it. For your own account, including these records, we (Calla Ref GmbH) are the controller, not the studio.

What the studio sees: only aggregated, anonymous usage of its own tablets — never your name, email address, sign-ins or history. Your account is not tied to one studio and works at every participating studio. If a studio stops working with us, your own history stays in your account.

Who at CALLA can see it: authorised staff can look up an individual's sign-in records for support, to correct data or to investigate misuse. Every such lookup is itself logged.

Without a subscription of your own, your account does not play classes on your own devices. If you later subscribe, it is the same account and your history stays.

Legal basis: Performance of our contract with you for your favourites and progress (Art. 6(1)(b)); our legitimate interest in keeping shared tablets secure and preventing misuse for the sign-in record and the staff access log (Art. 6(1)(f)); our legitimate interest in understanding how the feature is used so we can improve it for the record of your visits (Art. 6(1)(f)). You can object at any time (see Section 6).

2.6 Voluntary Feedback

After a class, and from your profile page, we may invite you to answer a short optional feedback form. The form is hosted by Tally (see Section 4) and opens in a new tab. Answering is entirely voluntary and nothing changes for your account if you ignore or close it.

If you do open the form, the link carries three technical values so that we can make sense of your answer: your account ID (a random identifier, not your name or email address), the ID of the classyou had just finished, and how many classes you had completed at that point. We never pass your name, email address or payment data to the form. Anything else in a response is only what you type into it yourself.

Legal basis: Our legitimate interest in improving the classes and the app (Art. 6(1)(f)). You can object at any time, and you can ask us to delete your responses — see Section 6.

Business accounts are not shown this form at all.

When you cancel your membership, you can optionally choose one reason, related follow-up answers, how long you have used a reformer, and write a comment or what would have made you stay. We store these answers to understand why members leave. You can skip every question; cancellation never depends on answering. Stripe receives a standardised cancellation reason when provided, never your free-text answers.

We also store the offer type, outcome, whether you are in a trial, and the subscription and payment identifiers needed to apply an offer and enforce its one-time limit. An eligible offer is saved before it is sent to your browser. Leaving without accepting or cancelling keeps that same offer available while it remains eligible. Accepting the offer or cancelling through the app uses your one-time allowance. This includes app cancellation after an offer was saved but its response did not reach your browser. Cancelling through Stripe's backup billing page does not itself use this allowance.

Legal basis: Performance of your contract for the offer and its one-time limit (Art. 6(1)(b)); our legitimate interest in improving the service for the optional answers (Art. 6(1)(f)).

2.7 Follow-up by our team

Our staff review lists of accounts that may need a personal follow-up: a failed payment, a trial or demo ending, an unfinished checkout, a cancellation during the trial, a contract due for renewal, a signup through a referral partner, or a personal account used the way a studio uses it (business e-mail domain, two or more tablets in use at once, at least 12 classes in 30 days). The lists are produced automatically from your account, subscription and usage data; a person decides whether to contact you, and nothing about your access or price is decided automatically. We may note who looks after your account, a short note, and whether the follow-up is done or postponed.

Legal basis: our contract with you for payment and contract matters (Art. 6(1)(b) GDPR); otherwise our legitimate interest in looking after customers and offering a suitable plan (Art. 6(1)(f) GDPR). We contact you about offers by phone or e-mail only with your consent where the law requires it. You can object at any time, including to direct marketing (Art. 21(2)); we then stop following up, except for payment and contract matters, and keep a note of your objection.

2.8 Business contact persons and payment reminders

For a business contract we process the name and e-mail address of the billing contact named in a business contract, which we receive from the contract itself. We use them to send the payment link, a notice before each payment is due, payment reminders and notices that access was paused or restored under the contract. We keep a record of which reminders were sent and when, the payment method chosen (card or bank transfer), any pause our team agreed, and whether access is paused for an unpaid invoice.

Legal basis: the performance of the contract with the business (Art. 6(1)(b) GDPR) and, for the contact person, our legitimate interest in managing that contract (Art. 6(1)(f) GDPR). Recipients: Stripe (payment processing; the billing contact becomes the e-mail address of the business's Stripe customer record) and Resend (sending the e-mails). You can object to this processing at any time (Art. 21 GDPR); payment and contract matters continue to be handled under the contract.

Automated contract check: when our team sets up a signed business contract, the contract file is read by an AI model (Claude, provided by Anthropic) to fill in the setup form and to compare the finished setup against the contract before anything is sent. The contract contains the names, e-mail addresses, phone numbers and positions of the business's contact person and signatory. A member of our team reviews every value and makes the decision; nothing is decided automatically. We delete the uploaded file 30 days after it was uploaded (the signed contract is kept in our document storage as before); we keep the values read, the quoted contract passages and the warnings with the contract record. Anthropic keeps what it receives only for a limited period under its data processing terms. Legal basis: the performance of the contract with the business (Art. 6(1)(b) GDPR) and our legitimate interest in setting up contracts accurately (Art. 6(1)(f) GDPR). Recipient: Anthropic (USA), which does not use the contract to train its models.

Business playback measurement and recovery

For business accounts with measurement enabled, Calla Ref GmbH records actual advancing playback intervals, including short previews, against a pseudonymous account, verified tablet, video and playback session. We use these records to verify service delivery, investigate missing measurements and support usage-based agreements where agreed. They describe a shared tablet's playback, not the identity of an individual guest. Paused time and seeking are not treated as playback. Uncertain or missing records require review.

The tablet stores pending records locally in IndexedDB so they can survive reloads and temporary connection failures. This essential measurement and recovery storage is separate from optional marketing analytics. The queue is limited to 20 MiB per site; normal retries cover 14 days. Unacknowledged records are kept for recovery instead of silently deleted when they become too old or the queue is full. Browser storage removal or device loss can still destroy unsent records. Signing into a different account does not transfer their attribution. No passwords or playback access tokens are stored in these records. A temporary, tab-scoped session storage reference holds pseudonymous account, subscription, tablet, video and session identifiers to reconnect playback after a reload. This reference is used only when it matches the current account and playback identity, and is kept in tab-scoped session storage.

Legal basis: Our legitimate interests in reliable business service delivery, accurate accounting and resolving usage discrepancies (Art. 6(1)(f) GDPR); necessary statutory accounting retention follows Art. 6(1)(c) GDPR and §132 BAO. Business owners can request an assisted export or erasure review using the contact in §6.