Privacy Policy
Last updated: 12 October 2026

This Privacy Policy explains how БОДИ КЮ ЕООД (“Aureli Studio”, “we”, “us”), 124 Hristo Botev St., entr. D, fl. 7, apt. 140, 6001 Stara Zagora, Bulgaria, collects, uses and protects personal data when you use the website www.aurelistudio.bg and the Aureli Studio mobile app for Android and iOS (together, the “Services”).

БОДИ КЮ ЕООД is the controller of your personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. 1. Data we collect

   • Account data (app): full name, email address, phone number and password. Passwords are stored only in encrypted (hashed) form by our authentication provider and are never visible to us. We also record the date and version of the Terms and Conditions you accepted at registration.
   • Membership data (app): the session packages assigned to you, remaining sessions, check-in history and notes added by studio staff.
   • Aureli Privileges (app): from your completed visits in the last 12 months, the app shows your level and the gifts it unlocks (such as a free class, a guest pass or Aureli merchandise), and we record when the studio hands a gift over to you.
   • Date of birth (app, optional): only if you add it in your profile, and only for your birthday gift. You can remove it at any time in Profile → Personal information.
   • Push notifications (app, optional): if you allow notifications, we store an identifier for your phone (push token), the app's language on it, the kinds of notifications you chose and a record of the notifications sent to you. We use them only to send you notifications about your bookings, your gifts and level, your package and news from the studio.
   • Crash and diagnostic data (app): error reports with device model, operating system and app version, used only to find and fix problems. These reports are not linked to your name or email.
   • Camera (app): used only by studio staff to scan the QR membership card at check-in. Images are processed on the device and are never stored or sent to us.
   • On your device only (app): your answers in the class quiz and how you felt after a class stay on your phone and are never sent to us.
   • Bookings: when you book a class through Setmore (on the website or in the app's Book tab), you enter your name, email and phone directly into Setmore. If you have an account in the app, we copy your bookings for the next two weeks from Setmore (the class or treatment, the date and time, and the instructor), matched to your account by your email or phone, so the app can show your upcoming session and remind you the evening before. Bookings of people without an account in the app are not copied.
   • Online sessions bought on the website (when offered): your name and email, used to send you the Google Calendar / Google Meet invitation. Payments are processed by Stripe; we never see your card details.
   • Contact form: your name, email, subject and message.
   • Website usage: anonymous, aggregated visit statistics (Vercel Analytics, without cookies). For cookies, see our Cookie Policy.

2. 2. Why we use your data and on what legal basis

   • To create and manage your account, show your membership card, packages, upcoming bookings and visit history, and record check-ins — performance of a contract (Art. 6(1)(b) GDPR).
   • To run Aureli Privileges: show your level and gifts and record the gifts you receive — performance of a contract.
   • To give you a birthday gift if you added your date of birth, and to send you the push notifications you allowed — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the date or turning notifications off.
   • To send account emails such as email verification and password reset — performance of a contract.
   • To send occasional reminder emails to existing clients about our classes — our legitimate interest (Art. 6(1)(f) GDPR). Every such email contains an unsubscribe link, and you can object at any time.
   • To keep the Services secure and working, including crash reports — our legitimate interest.
   • To keep accounting and tax records — compliance with a legal obligation (Art. 6(1)(c) GDPR).
   • To answer your enquiries — our legitimate interest, or steps taken at your request before entering into a contract.

   We do not sell your personal data, we do not show advertising, and we do not make decisions about you based solely on automated processing.

3. 3. Who we share data with

   We use the following service providers (processors), who process data only on our instructions and only for the purpose stated:

   • Supabase – Database and user authentication for the app
   • Sentry – Crash and error reporting for the app
   • Resend – Sending account and reminder emails
   • Setmore – Class booking; your upcoming bookings in the app
   • Stripe – Online payments on the website
   • Expo – Delivering push notifications to the app
   • Google – Calendar / Meet invitations for online sessions; app distribution via Google Play; delivering push notifications to Android phones (Firebase Cloud Messaging)
   • Apple – App distribution via the App Store; delivering push notifications to iPhones (Apple Push Notification service)
   • EmailJS – Delivering contact form messages
   • Vercel – Website hosting and anonymous analytics

   We may also disclose data when required by law or by a competent authority, or to establish, exercise or defend legal claims.

   Some of these providers are based outside the European Economic Area (for example, in the United States). In such cases, transfers are protected by the EU–US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.

4. 4. How long we keep your data

   • Account and membership data: for as long as your account exists. When you delete your account, it is removed from our database immediately; copies in encrypted backups are overwritten within 30 days.
   • Date of birth and notification settings: until you remove or change them, or delete your account. A phone's push notification identifier is deleted when you sign out on it, and automatically once the app is removed from it.
   • Bookings copied from Setmore: deleted a day after the booking has passed, and within 15 minutes when it is cancelled or moved in Setmore.
   • Crash reports: automatically deleted within 90 days.
   • Invoices and accounting records: for the period required by Bulgarian accounting and tax law (up to 10 years).
   • Contact form messages: for as long as needed to answer you, and no longer than 2 years.

5. 5. Deleting your account

   You can delete your account at any time in the app under Profile → Delete account. This is immediate and permanent. If you no longer have the app, see the account deletion page or email us at hello@aurelistudio.bg. The same page explains how to delete only some of your data without deleting your account.

6. 6. Your rights

   Under the GDPR you have the right to access your data, have it corrected or erased (all of it, or only some without deleting your account), restrict or object to its processing (including objecting to reminder emails at any time), receive it in a portable format, and withdraw any consent you have given. To exercise these rights, email us at hello@aurelistudio.bg. We will reply within one month.

   You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or with the supervisory authority in your EU country of residence.

7. 7. Security

   All data is transmitted over encrypted connections (HTTPS/TLS). Passwords are stored only in hashed form, database access is restricted so that each user can see only their own data, and only authorised studio staff can manage memberships. No system is completely secure, but we review and improve these measures regularly.

8. 8. Children and minors

   Clients under 18 may use the Services only with the consent of a parent or legal guardian. For children under 14, the account must be created and managed by a parent or legal guardian, who gives consent on the child's behalf (Art. 8 GDPR and the Bulgarian Personal Data Protection Act). We process minors' data only for the purposes described in this policy. If you believe we hold a child's data without such consent, please contact us and we will delete it.

9. 9. Cookies

   For information about cookies on the website, see our Cookie Policy.

10. 10. Changes to this policy

    We may update this Privacy Policy when our Services or the law change. The date at the top shows the latest version. If we make significant changes, we will let you know in the app or by email.

11. 11. Contact

    БОДИ КЮ ЕООД, 124 Hristo Botev St., entr. D, fl. 7, apt. 140, 6001 Stara Zagora, Bulgaria. Email: hello@aurelistudio.bg.