Legal

Privacy Policy

Last updated: [DATE] · Draft — pending legal review, not yet in effect

This Privacy Policy describes how [BUSINESS LEGAL NAME] ("Sculpt Studio," "we," "us") collects, uses, and protects your information when you use this website.

1. Information we collect

Account information — when you create an account, we collect your email address and a securely hashed password, stored via Supabase, our authentication and database provider.

Payment information — all payment details (card numbers, billing information) are collected and processed directly by Stripe, our payment processor. We never receive or store your full card number on our own servers — we only keep a Stripe-generated customer/reference ID and a payment status.

Event & membership activity — we store which events you've RSVP'd to or bought tickets for, and your membership/subscription status.

2. How we use your information

We use your information to create and maintain your account; process membership billing and event ticket purchases; send you account-related and transactional emails (confirmations, receipts, event reminders); deliver video content restricted to active members; and keep this website secure.

3. Third-party service providers

We rely on the following third-party services to run this site. Each processes data on our behalf under their own privacy policies:

  • Supabase — authentication and database hosting (account info, RSVPs, membership status).
  • Stripe — payment processing (billing information, transaction records).
  • Cloudflare — video hosting and delivery (Cloudflare Stream).
  • Vercel — website hosting and infrastructure.

We don't sell your personal information to third parties.

4. Cookies

We use cookies necessary to keep you signed in and to remember basic site preferences. [Expand this section if analytics or marketing cookies are added later — none are currently in use beyond what's required for authentication.]

5. Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, or request a copy of the data we hold about you. To make a request, contact us at [CONTACT EMAIL]. We'll respond within a reasonable time as required by applicable law. [Confirm which specific laws — e.g. CCPA, GDPR — actually apply during legal review.]

6. Data retention

We retain account information for as long as your account is active. If you cancel your membership or request account deletion, we keep the minimum information required for legal, accounting, or fraud-prevention purposes (e.g. transaction records) and delete or anonymize the rest within [RETENTION PERIOD, e.g. 90 days].

7. Contact

Questions about this Privacy Policy or your data? Reach us at [CONTACT EMAIL] or [REGISTERED ADDRESS].