Privacy
This page states what is held, for how long, and what happens when somebody asks for it to be deleted. The retention periods below are not a description of the policy — they are the same numbers the deletion job enforces.
What is held
An instructor's account holds the sessions they teach, the clients who book them, and what those clients paid. A client who books gives a name, an email address and the details their instructor needs to teach them safely — which may include health information they choose to share, and a signed waiver.
Card numbers are never held here. Payments run through Stripe, which collects the card directly; the instructor is the merchant of record for their own sessions. What is kept is a record that a payment happened and for how much.
There are no passwords. Signing in sends a one-time link to an email address, and the link is stored only as a hash.
How long it is kept
- Client notes
- 24 months from when they were written. Long enough that a seasonal client's history survives an off-season, short enough to be a promise worth making.
- Signed waivers
- 5 years from signing. A waiver is evidence in exactly the situation it exists for, so it is kept past the last moment a claim could be brought rather than up to it.
- A waiver signed for a minor
- Until their 20th birthday, or 5 years, whichever is later. California pauses the clock on a claim until someone turns 18, so a guardian's signature for a nine-year-old stays relevant for about eleven years.
- Payment records
- Kept as long as tax and accounting rules require. This is the instructor's own record of what they earned.
Deletion is a scheduled job, not a manual pass. It runs daily and is alarmed on not running, because a purge that quietly stops looks exactly like one that has nothing to do.
Asking for deletion
Email hello@palaestral.com. A deletion request removes client notes, the personal details attached to bookings, and the person's own account record.
Two things are kept, and the response says so rather than implying everything went:
- Signed waivers, because deleting one would destroy the instructor's defence in precisely the scenario the waiver was signed for. They are kept for the periods above and then deleted.
- Payment records, because they are a completed transaction and the instructor's tax record.
Who else sees it
An instructor sees their own clients and nobody else's. Stripe processes payments and Amazon Web Services hosts the system and delivers its email. Nothing is sold, and nothing is shared for advertising.
Changes
If a retention period changes, this page changes with it — a test fails when the numbers here and the numbers the deletion job uses disagree.