Privacy Policy
Last updated: 24 September 2026

This Privacy Policy explains how БОДИ КЮ ЕООД (“Aureli Studio”, “we”, “us”), 124 Hristo Botev St., entr. D, fl. 7, apt. 140, 6001 Stara Zagora, Bulgaria, collects, uses and protects personal data when you use the website www.aurelistudio.bg and the Aureli Studio mobile app for Android and iOS (together, the “Services”).

БОДИ КЮ ЕООД is the controller of your personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. 1. Data we collect

   • Account data (app): full name, email address, phone number and password. Passwords are stored only in encrypted (hashed) form by our authentication provider and are never visible to us. We also record the date and version of the Terms and Conditions you accepted at registration.
   • Membership data (app): the session packages assigned to you, remaining sessions, check-in history and notes added by studio staff.
   • Crash and diagnostic data (app): error reports with device model, operating system and app version, used only to find and fix problems. These reports are not linked to your name or email.
   • Camera (app): used only by studio staff to scan the QR membership card at check-in. Images are processed on the device and are never stored or sent to us.
   • Bookings: when you book a class through Setmore (on the website or in the app's Book tab), you enter your name, email and phone directly into Setmore.
   • Online sessions bought on the website (when offered): your name and email, used to send you the Google Calendar / Google Meet invitation. Payments are processed by Stripe; we never see your card details.
   • Contact form: your name, email, subject and message.
   • Website usage: anonymous, aggregated visit statistics (Vercel Analytics, without cookies). For cookies, see our Cookie Policy.

2. 2. Why we use your data and on what legal basis

   • To create and manage your account, show your membership card, packages and visit history, and record check-ins — performance of a contract (Art. 6(1)(b) GDPR).
   • To send account emails such as email verification and password reset — performance of a contract.
   • To send occasional reminder emails to existing clients about our classes — our legitimate interest (Art. 6(1)(f) GDPR). Every such email contains an unsubscribe link, and you can object at any time.
   • To keep the Services secure and working, including crash reports — our legitimate interest.
   • To keep accounting and tax records — compliance with a legal obligation (Art. 6(1)(c) GDPR).
   • To answer your enquiries — our legitimate interest, or steps taken at your request before entering into a contract.

   We do not sell your personal data, we do not show advertising, and we do not make decisions about you based solely on automated processing.

3. 3. Who we share data with

   We use the following service providers (processors), who process data only on our instructions and only for the purpose stated:

   • Supabase – Database and user authentication for the app
   • Sentry – Crash and error reporting for the app
   • Resend – Sending account and reminder emails
   • Setmore – Class booking
   • Stripe – Online payments on the website
   • Google – Calendar / Meet invitations for online sessions; app distribution via Google Play
   • Apple – App distribution via the App Store
   • EmailJS – Delivering contact form messages
   • Vercel – Website hosting and anonymous analytics

   We may also disclose data when required by law or by a competent authority, or to establish, exercise or defend legal claims.

   Some of these providers are based outside the European Economic Area (for example, in the United States). In such cases, transfers are protected by the EU–US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.

4. 4. How long we keep your data

   • Account and membership data: for as long as your account exists. When you delete your account, it is removed from our database immediately; copies in encrypted backups are overwritten within 30 days.
   • Crash reports: automatically deleted within 90 days.
   • Invoices and accounting records: for the period required by Bulgarian accounting and tax law (up to 10 years).
   • Contact form messages: for as long as needed to answer you, and no longer than 2 years.

5. 5. Deleting your account

   You can delete your account at any time in the app under Profile → Delete account. This is immediate and permanent. If you no longer have the app, see the account deletion page or email us at hello@aurelistudio.bg.

6. 6. Your rights

   Under the GDPR you have the right to access your data, have it corrected or erased, restrict or object to its processing (including objecting to reminder emails at any time), receive it in a portable format, and withdraw any consent you have given. To exercise these rights, email us at hello@aurelistudio.bg. We will reply within one month.

   You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or with the supervisory authority in your EU country of residence.

7. 7. Security

   All data is transmitted over encrypted connections (HTTPS/TLS). Passwords are stored only in hashed form, database access is restricted so that each user can see only their own data, and only authorised studio staff can manage memberships. No system is completely secure, but we review and improve these measures regularly.

8. 8. Children and minors

   Clients under 18 may use the Services only with the consent of a parent or legal guardian. For children under 14, the account must be created and managed by a parent or legal guardian, who gives consent on the child's behalf (Art. 8 GDPR and the Bulgarian Personal Data Protection Act). We process minors' data only for the purposes described in this policy. If you believe we hold a child's data without such consent, please contact us and we will delete it.

9. 9. Cookies

   For information about cookies on the website, see our Cookie Policy.

10. 10. Changes to this policy

    We may update this Privacy Policy when our Services or the law change. The date at the top shows the latest version. If we make significant changes, we will let you know in the app or by email.

11. 11. Contact

    БОДИ КЮ ЕООД, 124 Hristo Botev St., entr. D, fl. 7, apt. 140, 6001 Stara Zagora, Bulgaria. Email: hello@aurelistudio.bg.