Ulumi is scheduling, check-in and payments software for small yoga, pilates and dance studios, made by Marsik Labs LLC ("we", "us"). This policy explains what information Ulumi handles, why, and the choices you have. It covers the Ulumi app, ulumi.app and the booking and payment pages that studios share with their students.
Who is who
A studio that uses Ulumi (the "Studio") decides which students it adds and how it runs its classes. For student information, the Studio decides how it is used and we are its service provider: we process that information on the Studio's behalf and only to provide Ulumi to it, keep it secure, support it, and meet legal obligations. For Studio owner and instructor accounts, we decide how information is used.
Information we collect
- Studio owners and instructors: name, email address, phone number if you add one, studio name, and the schedule and settings you create. For owners, when and which version of our Terms you accepted.
- Students: name, phone number or email, class bookings, attendance, class credits and payment history, entered by the Studio or by the student on a Studio's booking page. Students do not create Ulumi accounts.
- Student payments: card and wallet payments are handled by Square and go to the Studio's Square account. Our payment integration does not give us full card numbers; we receive a confirmation, the amount and a receipt link. Payments by Venmo, Zelle, Cash App or cash are recorded by the Studio by hand.
- Ulumi subscription: when a Studio owner subscribes, Square processes the card and we keep the subscription status and Square's customer and subscription references. We do not receive full card numbers.
- Text messages: if a student agrees, we send class and payment texts through Twilio. We keep delivery records, opt-out status, and proof of consent: when the student agreed and which wording they saw. We do not currently send promotional texts.
- Technical data: server logs with IP address, device type and requested pages, kept by our hosting provider to keep Ulumi secure and working, and error reports (the error message, page and device type, with no personal details) that we keep for 30 days to find and fix bugs.
- Messages to support: what you write in Help and feedback, with your studio, the screen you were on and your device.
Ulumi is not designed for health information. Please do not enter medical details such as injuries, pregnancy or conditions. Ulumi is not a HIPAA-covered service.
Cookies and similar technology
We use only what Ulumi needs to work: your sign-in session is stored in your browser or app (cookies or local storage), and a small note of the last screen you visited is kept for the length of your visit so that support requests can include it. We do not use advertising or cross-site tracking, so there is nothing for a Do Not Track or Global Privacy Control signal to turn off.
How we use it
- To run Ulumi: schedules, bookings, check-in, credits and payment records.
- To send messages a student has opted in to, such as booking reminders and payment receipts.
- To bill Studios for their Ulumi subscription.
- To answer support requests, protect the service and fix problems.
- To meet legal and tax obligations.
We do not sell personal information. We do not use student information for advertising and we do not share it with anyone for their own marketing.
Summary numbers
We use aggregated, de-identified numbers, such as how many Studios use Ulumi and the total amount of payments they process, to run, support and improve the service. These numbers cannot reasonably be used to identify any person.
Who can see what
A Studio's owner and instructors can see that Studio's student list, bookings and attendance. Students see their own bookings, credits and payment pages only; Ulumi does not show one student's name or details to another.
Text message terms
Texts are sent only to students who gave their number to a Studio and agreed to receive them. Message frequency varies. Message and data rates may apply. Reply STOP at any time to stop texts, or HELP for help. Mobile information and opt-in data are not shared with third parties for marketing or promotional purposes.
Who we share it with
A small set of providers help us run Ulumi: Supabase (database and sign-in), Vercel (hosting), Square (payments and our subscription billing), Twilio (text messages), Resend (email) and Google Workspace (our email). They process information for us, and some, such as payment and messaging providers, may also process information under their own privacy notices for things like fraud prevention and legal compliance. We may disclose information if the law requires it or to protect people's safety. If Ulumi is ever sold or merged, information moves to the new owner under this same policy.
How long we keep it
We keep information while a Studio's account is active. An owner can delete the whole account at any time in the app (Settings, then Delete account), and any Ulumi subscription is cancelled automatically. If a Studio cancels or is suspended for non-payment, its data stays available for export for 30 days. When an owner deletes the account, we delete or de-identify personal information from our active systems: the Studio's students, classes, bookings and logins. Backup copies, where they exist, expire on our providers' normal schedule. Proof of text-message consent is deleted with the Studio's other student data, so a Studio that needs to keep it should export it first.
Some records are kept on purpose after deletion, with studio and student names and contact details removed. Where feasible we remove direct identifiers, though some transaction references may still be linkable to a person by the payment provider:
- Payment records (amount, date, method and the payment provider's reference): up to 7 years, for tax, accounting and dispute purposes.
- Messages sent to support: up to 24 months.
- Internal access logs: up to 12 months.
An instructor who deletes their own account removes their login; the students and classes they managed move to the Studio owner.
Security
We use providers that encrypt data in transit and at rest, and we limit access to what the service needs. No system is perfectly secure. If a security incident affects a Studio's data, we will tell the Studio without undue delay and as required by applicable law.
Your choices and rights
- Students: the Studio decides how student information is used, so ask the Studio first to see, correct, export or delete your information. If you contact us, we will pass your request to the Studio. Reply STOP to any text to stop texts at once.
- Owners and instructors: you can see and correct your details in Settings, delete your account in the app, and ask us to export Studio data.
- State privacy laws: residents of some US states have rights to access, correct, delete and receive a copy of their personal information. Email us and we will respond within 45 days. We may ask you to confirm your identity first, for example by replying from the email address on the account.
Children
Ulumi is for adults who run studios and for adults booking classes. Studios may enroll children, but the parent or guardian should be the contact and the one who books and pays. We do not knowingly collect information directly from children under 13. A Studio that enrolls a minor is responsible for having the parent or guardian's permission. If you believe a child has given us information directly, email us and we will delete it.
Changes
If we change this policy we will update the date above and tell Studio owners by email about meaningful changes.
Ulumi is a product of Marsik Labs LLC, Fort Lauderdale, Florida. Questions: support@ulumi.app.