Privacy Policy for Zenbrio.School

1. Introduction

Zenbrio School of Energy Kinesiology ("we," "us," or "our") operates the website located at zenbrio.school (the "Site" or "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site, and it describes your privacy rights under applicable laws, including the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other applicable U.S. state privacy laws.

By using our Site, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Site.

Data Controller: Zenbrio School of Energy Kinesiology

Registered Address: 1725 Pearl St, Eugene, OR 97401

Contact Email: Sara@zenbrio.school

EU/UK Representative: Sara Mcrae, Sara@zenbrio.school

Data Protection Officer (if applicable): Sara Mcrae, Sara@zenbrio.school

2. Information We Collect

2.1 Information You Provide Directly

Contact details (name, email address, phone number, mailing address)
Account credentials (username, password)
Payment and billing information (processed via [payment processor name])
Content you submit (comments, uploads, support requests, survey responses)
Booking and scheduling details submitted through class or appointment bookings (name, email, phone number, selected class/session, date and time, number of participants, and any optional notes you provide)

2.2 Information Collected Automatically

Device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, time spent, click patterns
Cookies and similar technologies: See Section 6 below
Location data: Approximate location derived from IP address (and precise location only if you grant permission)

2.3 Information from Third Parties

Social media platforms (if you log in via a third-party account)
Analytics providers (e.g., Wix Analytics)
Advertising networks and partners

3. How We Use Your Information

We use collected information to:

Provide, operate, and maintain the Site
Process transactions and send related information
Respond to inquiries and provide customer support
Send administrative information, updates, and marketing communications (where permitted)
Personalize content and improve user experience
Monitor and analyze usage trends
Detect, prevent, and address technical issues, fraud, or security incidents
Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, we process your personal data under one or more of the following legal bases and when they apply:

Consent: Applies when you have given clear consent (e.g., marketing emails, non-essential cookies)

Contract: Applies when processing is necessary to perform a contract with you (e.g., order fulfillment)

Legal Obligation: Applies when ee must process data to comply with the law

Legitimate Interests: Applies when processing supports our legitimate business interests (e.g., fraud prevention, analytics) and does not override your rights

Vital Interests: Rarely applicable — to protect someone's life

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

5. How We Share Your Information

We do not sell your personal information for money. We may share information with:

Service providers who perform services on our behalf (hosting, analytics, payment processing, email delivery) under contractual confidentiality obligations
Business partners for co-branded offerings, with your consent where required
Legal and safety authorities when required by law, subpoena, or to protect rights, property, or safety
Successors in the event of a merger, acquisition, or asset sale
Advertising partners, where you have not opted out (see Section 9 on Do Not Sell/Share)

A current list of third-party processors/sub-processors is available upon request at sara@zenbrio.school

5.1 Error Tracking and Application Monitoring (Sentry)

We use Sentry (operated by Functional Software, Inc.), a third-party application monitoring and error-tracking service, to help us identify, diagnose, and fix bugs, crashes, and performance issues on our Site.

When an error or performance event occurs, Sentry may automatically collect technical data, including:

IP address
Browser type and version
Operating system
Device information
URL and page where the error occurred
Timestamps of the event
Stack traces and error logs (which may incidentally include portions of application state, such as usernames or account identifiers, if present in the code at the time of the error)
Session replay or breadcrumb data (user interactions leading up to an error), if enabled

Purpose and legal basis: This processing supports our legitimate interest in maintaining a secure, functional, and reliable Site (GDPR Art. 6(1)(f)). We configure Sentry to scrub or mask sensitive fields (such as passwords, payment details, and other clearly identifiable personal data) where technically feasible, and we limit data collection to what is reasonably necessary for debugging purposes.

Data location and transfers: Sentry may process and store data on servers located in the United States and/or the European Union, depending on our account configuration. Where data is transferred outside the EEA/UK, we rely on Sentry's Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) as the transfer mechanism.

Retention: Error and event data is retained by Sentry according to our configured retention settings (typically 30/90 days) before automatic deletion.

More information: You can review Sentry's own privacy practices at Sentry Privacy Policy.

5.2 Analytics (Wix Analytics)

We use Wix Analytics, a built-in analytics tool provided directly by Wix.com as part of our website platform, to understand how visitors use our Site. Wix Analytics is a first-party analytics tool operated by Wix — it is a separate product from Google Analytics, and we do not use Google Analytics (GA4) on this Site.

Wix Analytics may collect:

Traffic and visitor data (number of visitors, page views, traffic sources, referral channels)
Visitor behavior (pages viewed, time on page, session duration, clicks)
Sales and conversion data for e-commerce activity (revenue, conversion rate, abandoned carts, order and booking data), sourced from site transactions and CRM records
Approximate visitor location and device/browser type
For signed-in site members: account and login-related data via essential session cookies

Purpose and legal basis: For EEA/UK users, Wix Analytics traffic and behavioral reporting relies on Analytics cookies, which are only set after you consent via our cookie banner (see Section 6). Sales, People, and CRM-related reports rely on essential cookies (such as sign-in session cookies) and on server-side transaction data, which do not require separate cookie consent. For other users, we rely on our legitimate interest in understanding and improving Site performance.

Data source: Because Wix Analytics is Wix's own first-party tool, data is collected and processed as part of Wix's hosting infrastructure described in Section 5.3, rather than shared with an external analytics company.

Retention: Analytics data is retained by Wix according to our account's configured retention settings and Wix's standard data retention practices.

More information: Wix Analytics Privacy Information and Wix Privacy Policy.

5.3 Website Hosting and Infrastructure (Wix)

Our Site is built and hosted on the Wix.com website platform ("Wix"), which acts as our primary hosting provider and stores data on our behalf, including Site content, submitted forms, and certain visitor and customer data.

Wix operates a multi-cloud infrastructure model and relies on the following sub-processors to deliver hosting, storage, and content-delivery services:

Amazon Web Services (AWS) — cloud infrastructure and storage
Google Cloud Platform (GCP) — cloud infrastructure and storage
Fastly — content delivery network (CDN), used to cache and serve Site content quickly from servers located near you, and to help mitigate distributed denial-of-service (DDoS) attacks as well as Wix's own proprietary servers, which work alongside these providers to balance performance, redundancy, and reliability.
Wix and its infrastructure sub-processors process data solely to provide hosting, storage, and content-delivery services on our behalf, under Wix's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for international data transfers.
Data may be stored and processed in multiple countries depending on Wix's active data center and CDN configuration at any given time, including the United States and the European Union.
Wix maintains industry security certifications and undergoes regular independent audits (see Wix's Trust Center for current certifications, such as ISO 27001 and SOC 2).
A current list of Wix's sub-processors is maintained by Wix and available at Wix's sub-processor disclosure page (linked below); we review this list periodically and will update this Policy if the sub-processor landscape changes materially.

More information: Wix Privacy Policy, Wix Trust Center, and Wix Sub-processors List.

5.4 Internal Business Operations (Google Workspace)

We use Google Workspace (including Gmail, Google Drive, Google Docs, Google Calendar, and related tools) for our internal business operations, such as employee email, document storage, and collaboration.

If you contact us by email, submit a support request, or otherwise correspond with our team, that communication (and any personal data it contains) may be stored and processed within our Google Workspace environment.
Google Workspace is governed by our organization's agreement with Google, which incorporates the Google Workspace Data Processing Amendment, including the EU Standard Contractual Clauses for international data transfers.
Access to data within our Google Workspace environment is restricted to authorized personnel who need it to perform their job functions (e.g., customer support, sales, administration).
We do not use Google Workspace core services data for advertising purposes, consistent with Google's Workspace terms.

More information: Google Workspace Privacy Notice and Google Workspace Security Whitepaper.

5.5 Payment Processing (Wix Payments)

We use Wix Payments, provided by Wix.com Inc. / Wix.com Ltd., to process payments made through our Site.

When you make a purchase or payment, Wix Payments collects and processes:

Full name and billing address
Payment card details (card number, expiration date, CVV) or other payment method credentials (e.g., linked bank account, digital wallet information)
Transaction amount, currency, and date
Order and purchase history
Device and fraud-prevention signals (IP address, device fingerprint) used to detect and prevent fraudulent transactions

We do not directly collect, view, or store your full payment card number or card security code. Payment credentials are transmitted directly to Wix Payments through a secure, PCI DSS–compliant integration. We retain only limited transaction metadata (such as order ID, amount, status, and last four digits of the payment method) needed for order fulfillment, customer support, accounting, and refunds.

Purpose and legal basis: This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, completing the transaction you requested — and to comply with legal obligations such as tax and financial recordkeeping (GDPR Art. 6(1)(c)).

PCI DSS compliance: Wix Payments operates as a PCI DSS–compliant payment service provider, meaning card data is handled according to industry security standards for storage, transmission, and processing.

Fraud prevention and identity verification: Wix Payments may use payment and device data to screen for fraudulent or unauthorized transactions, which may involve automated risk-scoring. This helps protect both you and us from fraudulent charges.

Data transfers: Depending on your location and Wix's processing infrastructure, payment data may be transferred to and processed in countries outside your own, including the United States and/or the European Union. Where applicable, these transfers are governed by Wix's Data Processing Agreement and Standard Contractual Clauses.

Retention: Payment and transaction records are retained for as long as necessary to comply with applicable tax, accounting, anti-fraud, and financial regulations , after which they are securely deleted or anonymized.

More information: Wix Payments Privacy Policy and Wix Payment Services Terms.

5.5a Separate Invoicing (Stripe)

For certain classes, we do not collect payment at the time of booking. Instead, we send you a separate invoice after booking using Stripe, a third-party payment and invoicing service provided by Stripe, Inc. / Stripe Payments Europe, Ltd.

When we issue an invoice through Stripe, Stripe collects and processes:

Your name, email address, and billing address
Invoice details (amount owed, due date, description of the class or service, invoice status)
Payment card details or bank account information you provide when paying the invoice
Transaction and payment history
Device and fraud-prevention signals used to detect and prevent fraudulent transactions

We do not directly collect, view, or store your full payment card number or bank account credentials. Payment information is submitted directly to Stripe through its secure, PCI DSS–compliant platform. We retain only limited invoice metadata (such as invoice number, amount, due date, and payment status) needed for bookkeeping, customer support, and accounting.

Purpose and legal basis: This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, billing you for the class or service you booked — and to comply with legal obligations such as tax and financial recordkeeping (GDPR Art. 6(1)(c)).

Stripe's role: Stripe acts as an independent controller with respect to certain data it processes for its own regulatory, fraud-prevention, and compliance purposes (as is standard for payment processors), and as our processor for the invoicing services performed on our behalf.

Data transfers: Stripe may process and store data in the United States, the European Union, and other countries where Stripe operates. Where data is transferred outside the EEA/UK, Stripe relies on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms.

Retention: Invoice and payment records are retained for as long as necessary to comply with applicable tax, accounting, and financial regulations, after which they are securely deleted or anonymized.

More information: Stripe Privacy Policy.

5.6 Contact and Lead Forms (Wix Forms)

We use Wix Forms, a built-in form tool provided directly by Wix.com, to collect information you voluntarily submit through contact forms, inquiry forms, sign-up forms, and similar submissions on our Site.

Depending on the specific form, this may include:

Name, email address, and phone number
The content of your message or inquiry
Any additional fields we've added to a specific form (e.g., preferred contact method, subject/topic)

Purpose and legal basis: We use this information to respond to your inquiry, provide the service or information you requested, and maintain records of our correspondence. Processing is based on your consent (by voluntarily submitting the form) and, where applicable, our legitimate interest in responding to inquiries and operating our business (GDPR Art. 6(1)(a) and (f)).

Data handling: Form submissions are stored within our Wix account (see Section 5.3 for hosting details) and may be forwarded to our team's email inbox, which may be hosted via Google Workspace (see Section 5.4).

More information: Wix Privacy Policy.

5.7 Class and Appointment Scheduling (Wix Bookings)

We use Wix Bookings, a built-in scheduling tool provided directly by Wix.com, to manage class registrations, appointment scheduling, and related booking activity for our Site.

When you book a class or appointment, Wix Bookings collects and processes:

Name, email address, and phone number
Selected class, service, or appointment type, along with date, time, and session details
Number of participants or guests included in a booking
Booking status and history (confirmed, cancelled, rescheduled, no-show, waitlisted)
Payment or deposit information for paid bookings, handled via Wix Payments (see Section 5.5)
Mailing or service address, for bookings that require it (e.g., at-home services, equipment delivery, or shipping related to a class or session)
Any optional notes or information you choose to provide at the time of booking

Purpose and legal basis: We use this information to schedule, confirm, manage, and follow up on your bookings, including sending automated confirmation, reminder, and cancellation notifications. This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, providing the class or service you booked.

Retention: We retain booking records for as long as necessary to manage our class schedules, respond to inquiries about past bookings, and comply with our accounting and legal obligations, after which records are deleted or anonymized.

More information: Wix Privacy Policy.

5.8 SMS/Text Message Reminders

If you provide your phone number and opt in to receive text message reminders when booking a class or appointment, we (through Wix Bookings) will send you SMS communications related to that booking, such as confirmations, reminders, and rescheduling or cancellation notices.

Consent: SMS reminders are sent only if you affirmatively opt in at the time of booking. Opting in to SMS reminders is not a condition of purchasing any class or service.
Scope: We use text messaging solely for transactional, booking-related communications — not for marketing or promotional messages — unless you separately opt in to marketing texts.
Message and data rates: Message and data rates may apply based on your mobile carrier and plan.
Frequency: Message frequency varies based on your booking activity.
Opt-out: You may opt out of SMS reminders at any time by replying STOP to any text message, adjusting your notification preferences in your account, or contacting us at [privacy@yourcompany.com]. Reply HELP for assistance.
Carriers: We are not liable for delayed or undelivered messages, and mobile carriers are not liable for delayed or undelivered messages.

This SMS program is administered through Wix Bookings' built-in messaging functionality, which may rely on third-party telecommunications/SMS delivery providers engaged by Wix to transmit messages. Your phone number is not sold or shared with unaffiliated third parties for their own marketing purposes.

5.9 Site Member Accounts (Wix Members Area)

Our Site allows visitors to create a member account using Wix's built-in Members Area, which lets you log in, manage bookings, and access member-only content.

When you create a member account, we collect and store:

Name and email address
Password (stored by Wix in encrypted/hashed form — we do not have access to your plaintext password)
Profile information you choose to add (e.g., profile photo, bio)
Your booking history, form submissions, and other activity associated with your account
Login session data, including sign-in timestamps and authentication cookies necessary to keep you logged in

Purpose and legal basis: We use this information to operate your account, authenticate your sign-ins, and let you manage your bookings and preferences. Processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, providing the account and related services you signed up for.

Account deletion: You may request deletion of your member account and associated data at any time by contacting us at sara@zenbrio.school, subject to any records we are required to retain for legal, accounting, or dispute-resolution purposes.

More information: Wix Privacy Policy.

5.10 Email Newsletter and Blog Notifications

If you opt in to receive blog post notifications or newsletter emails, we will use your email address to send you those communications through Wix's built-in email marketing tools.

Consent: These emails are sent only if you affirmatively opt in (e.g., by subscribing via a sign-up form or checkbox). Subscribing is not required to use our Site or book a class.
Content: These emails may include new blog post announcements, updates, and other content you've signed up to receive. They are separate from the transactional booking confirmations and reminders described in Sections 5.7 and 5.8.
Unsubscribe: Every email includes an unsubscribe link, and we honor opt-out requests promptly, consistent with the CAN-SPAM Act. You may also unsubscribe by contacting us directly at [privacy@yourcompany.com].
Sender identification: Our marketing emails identify us as the sender and include our physical business address, as required by the CAN-SPAM Act.

More information: Wix Privacy Policy.

5.11 Embedded Google Reviews Widget

Our Site displays a Google Reviews widget, installed via the official Google Reviews app on the Wix App Market, that pulls and displays customer reviews from our Google Business Profile.

Installation: This app is installed through Wix's official App Market (rather than custom third-party code), meaning Wix mediates the connection between our Site and Google's review data on our behalf, alongside its other hosting services described in Section 5.3.
Review content: The reviews shown were submitted directly to Google by reviewers — not collected by us — and may include the reviewer's name, profile photo, star rating, and written review, as made available by Google's review platform. We do not control this content and are not responsible for its accuracy; requests to edit or remove a review should be directed to Google or the reviewer.
Visitor data from the embed: Depending on how the app renders reviews on our Site, Google may still automatically collect limited technical data about your visit (such as IP address, browser type, and device information) when the widget requests review data, independent of any other Google tool described in this Policy.
Legal basis: For EEA/UK visitors, if the widget sets non-essential cookies, it is only loaded after you consent via our cookie banner (see Section 6). Where the widget loads without setting cookies, we rely on our legitimate interest in showcasing customer feedback.
Google's role: Google acts as an independent controller (not our processor) with respect to any data it collects through this integration, since it processes that data for its own purposes as part of its review platform.

More information: Google's Privacy Policy and Wix App Market Terms.

6. Cookies and Tracking Technologies

We use cookies and similar technologies (pixels, web beacons, local storage) to:

Operate essential Site functions
Remember preferences
Analyze traffic and usage
Deliver relevant advertising

Cookie Categories with purpose:

Strictly Necessary: Core site functionality, Requires Consent (EU/UK): No
Performance/Analytics: Usage statistics, Requires Consent (EU/UK): Yes
Functional: Preferences, personalization, Requires Consent (EU/UK): Yes
Advertising/Targeting: Ad personalization, retargeting, Requires Consent (EU/UK): Yes

Visitors from the EEA/UK are presented with a cookie consent banner allowing granular opt-in before non-essential cookies are set, in compliance with the GDPR and ePrivacy Directive. You can manage cookie preferences at any time via [link to cookie settings tool] or through your browser settings.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law (e.g., tax, accounting, or litigation holds). When data is no longer needed, we securely delete or anonymize it.

8. Your Privacy Rights

8.1 Rights for EEA/UK/Swiss Residents (GDPR)

You have the right to:
Access a copy of your personal data
Rectify inaccurate or incomplete data
Erasure ("right to be forgotten"), subject to certain exceptions
Restrict processing under certain conditions
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests or for direct marketing
Withdraw consent at any time
Lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority)
To exercise these rights, contact us at [privacy@yourcompany.com]. We will respond within one month as required by GDPR Art. 12.

8.2 Rights for California Residents (CCPA/CPRA)

California residents have the right to:
Know what personal information is collected, used, shared, or sold
Delete personal information we've collected (subject to exceptions)
Correct inaccurate personal information
Opt out of the sale or sharing of personal information and targeted advertising
Limit use of sensitive personal information
Non-discrimination for exercising these rights
To submit a request, contact: sara@zenbrio.school . We will verify your identity before fulfilling requests.

8.3 Other U.S. State Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain processing. Contact us to exercise these rights regardless of your state of residence.

9. Children's Privacy (COPPA)

Our Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). If we learn we have collected such information without consent, we will delete it promptly. Parents who believe their child has provided information to us may contact sara@zenbrio.school to request deletion.

10. International Data Transfers

If you are located outside of Israel and your information is transferred to and processed in Israel, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Addendum, where applicable
Adequacy decisions, where applicable

11. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you, without human review.

13. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. The "Last Updated" date at the top reflects the most recent revision.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Zenbrio School of Energy Kinesiology

1725 Pearl St, Eugene, OR 97401

Email: sara@zenbrio.school

EU/UK residents may also contact our representative at sara@zenbrio.school or lodge a complaint with their local supervisory authority.