Privacy Policy for Zenbrio.School

Last Updated 8/14/2026

1. Introduction

Zenbrio School of Energy Kinesiology ("we," "us," or "our") operates the website located at zenbrio.school (the "Site" or "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site, and it describes your privacy rights under applicable laws, including the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other applicable U.S. state privacy laws.

By using our Site, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Site.

Data Controller: Zenbrio School of Energy Kinesiology

Registered Address: 1725 Pearl St, Eugene, OR 97401

Representative: Sara Mcrae

To contact us about this Privacy Policy, exercise your privacy rights, or request access, correction, or deletion of your personal information, please use our Contact Us form.

2. Information We Collect

2.1 Information You Provide Directly

Contact details (name, email address, phone number, mailing address)
Account credentials (username, password)
Payment and billing information (processed via Wix Payments)
Content you submit (comments, uploads, support requests, survey responses)
Booking and scheduling details submitted through class or appointment bookings (name, email, phone number, selected class/session, date and time, number of participants, and any optional notes you provide)

2.2 Information Collected Automatically

Device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, time spent, click patterns
Cookies and similar technologies: See Section 6 below
Location data: Approximate location derived from IP address (and precise location only if you grant permission)

2.3 Information from Third Parties

Social media platforms (if you log in via a third-party account)
Analytics providers (e.g., Wix Analytics

3. How We Use Your Information

We use collected information to:

Provide, operate, and maintain the Site
Process transactions and send related information
Respond to inquiries and provide customer support
Send administrative information, updates, and marketing communications (where permitted)
Personalize content and improve user experience
Monitor and analyze usage trends
Detect, prevent, and address technical issues, fraud, or security incidents
Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, we process your personal data under one or more of the following legal bases and when they apply:

Consent: Applies when you have given clear consent (e.g., marketing emails, non-essential cookies)

Contract: Applies when processing is necessary to perform a contract with you (e.g., order fulfillment)

Legal Obligation: Applies when we must process data to comply with the law

Legitimate Interests: Applies when processing supports our legitimate business interests (e.g., fraud prevention, analytics) and does not override your rights

Vital Interests: Rarely applicable — to protect someone's life

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

5. How We Share Your Information

We do not sell your personal information for money. We may share information with:

Service providers who perform services on our behalf (hosting, analytics, payment processing, email delivery) under contractual confidentiality obligations
Business partners for co-branded offerings, with your consent where required
Legal and safety authorities when required by law, subpoena, or to protect rights, property, or safety
Successors in the event of a merger, acquisition, or asset sale

We do not use advertising networks, ad tech partners, or targeted/behavioral advertising on our Site, and we do not share personal information for cross-context behavioral advertising purposes.

A current list of third-party processors/sub-processors is available upon request.

5.1 Error Tracking and Application Monitoring (Sentry)

We use Sentry, a third-party application monitoring and error-tracking service, to help us identify, diagnose, and fix technical issues on our Site.

When an error occurs, Sentry may collect limited technical and diagnostic information — such as your device and browser type, the page where the issue occurred, and technical details needed to understand what went wrong. We configure Sentry to avoid capturing sensitive personal information where feasible, and we limit this collection to what's reasonably necessary for troubleshooting. If we ever enable optional features that record more detailed user interactions (such as session recordings), we will disclose that separately and apply additional safeguards.

Purpose and legal basis: This supports our legitimate interest in maintaining a secure, functional, and reliable Site (GDPR Art. 6(1)(f)).

Retention and transfers: Sentry retains this data only as long as necessary for troubleshooting purposes, consistent with our data minimization practices, and applies appropriate safeguards (such as Standard Contractual Clauses) for any international data transfers.

More information: Sentry Privacy Policy.

5.2 Analytics (Wix Analytics)

We use Wix Analytics, a built-in analytics tool provided directly by Wix.com as part of our website platform, to understand how visitors use our Site. Wix Analytics is a first-party analytics tool operated by Wix — it is a separate product from Google Analytics, and we do not use Google Analytics (GA4) on this Site.

Wix Analytics may collect:

Traffic and visitor data (number of visitors, page views, traffic sources, referral channels)
Visitor behavior (pages viewed, time on page, session duration, clicks)
Sales and conversion data for e-commerce activity (revenue, conversion rate, abandoned carts, order and booking data), sourced from site transactions and CRM records
Approximate visitor location and device/browser type
For signed-in site members: account and login-related data via essential session cookies

Purpose and legal basis: For EEA/UK users, Wix Analytics traffic and behavioral reporting relies on Analytics cookies, which are only set after you consent via our cookie banner (see Section 6). Sales, People, and CRM-related reports rely on essential cookies (such as sign-in session cookies) and on server-side transaction data, which do not require separate cookie consent. For other users, we rely on our legitimate interest in understanding and improving Site performance.

Data source: Because Wix Analytics is Wix's own first-party tool, data is collected and processed as part of Wix's hosting infrastructure described in Section 5.3, rather than shared with an external analytics company.

Retention: Analytics data is retained by Wix according to our account's configured retention settings and Wix's standard data retention practices.

More information: Wix Analytics Privacy Information and Wix Privacy Policy.

5.3 Website Hosting and Infrastructure (Wix)

Our Site is built and hosted on the Wix.com website platform ("Wix"), which acts as our primary hosting provider and stores data on our behalf, including Site content, submitted forms, and certain visitor and customer data.

To operate its platform reliably and securely, Wix relies on established cloud infrastructure and content-delivery providers. Wix processes data under its own Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for international data transfers, and maintains recognized security certifications (such as ISO 27001 and SOC 2).

A current list of Wix's infrastructure sub-processors is maintained by Wix and available on Wix's website; we review this list periodically and will update this Policy if the sub-processor landscape changes materially.

More information: Wix Privacy Policy and Wix Trust Center.

5.4 Internal Business Operations (Google Workspace)

We use Google Workspace (including Gmail, Google Drive, Google Docs, Google Calendar, and related tools) for our internal business operations, such as employee email, document storage, and collaboration.

If you contact us by email, submit a support request, or otherwise correspond with our team, that communication (and any personal data it contains) may be stored and processed within our Google Workspace environment.
Google Workspace is governed by our organization's agreement with Google, which incorporates the Google Workspace Data Processing Amendment, including the EU Standard Contractual Clauses for international data transfers.
Access to data within our Google Workspace environment is restricted to authorized personnel who need it to perform their job functions (e.g., customer support, sales, administration).
We do not use Google Workspace core services data for advertising purposes, consistent with Google's Workspace terms.

More information: Google Workspace Privacy Notice and Google Workspace Security Whitepaper.

5.5 Payment Processing (Wix Payments)

We use Wix Payments, provided by Wix.com Inc. / Wix.com Ltd., to process payments made through our Site.

When you make a purchase or payment, Wix Payments collects and processes:

Full name and billing address
Payment card details (card number, expiration date, CVV) or other payment method credentials (e.g., linked bank account, digital wallet information)
Transaction amount, currency, and date
Order and purchase history
Device and fraud-prevention signals (IP address, device fingerprint) used to detect and prevent fraudulent transactions

We do not directly collect, view, or store your full payment card number or card security code. Payment credentials are transmitted directly to Wix Payments through a secure, PCI DSS–compliant integration. We retain only limited transaction metadata (such as order ID, amount, status, and last four digits of the payment method) needed for order fulfillment, customer support, accounting, and refunds.

Purpose and legal basis: This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, completing the transaction you requested — and to comply with legal obligations such as tax and financial recordkeeping (GDPR Art. 6(1)(c)).

PCI DSS compliance: Wix Payments operates as a PCI DSS–compliant payment service provider, meaning card data is handled according to industry security standards for storage, transmission, and processing.

Fraud prevention and identity verification: Wix Payments may use payment and device data to screen for fraudulent or unauthorized transactions, which may involve automated risk-scoring. This helps protect both you and us from fraudulent charges.

Data transfers: Depending on your location and Wix's processing infrastructure, payment data may be transferred to and processed in countries outside your own, including the United States and/or the European Union. Where applicable, these transfers are governed by Wix's Data Processing Agreement and Standard Contractual Clauses.

Retention: Payment and transaction records are retained for as long as necessary to comply with applicable tax, accounting, anti-fraud, and financial regulations , after which they are securely deleted or anonymized.

More information: Wix Payments Privacy Policy and Wix Payment Services Terms.

5.5a Separate Invoicing (Stripe)

For certain classes, we do not collect payment at the time of booking. Instead, we send you a separate invoice after booking using Stripe, a third-party payment and invoicing service provided by Stripe, Inc. / Stripe Payments Europe, Ltd.

When we issue an invoice through Stripe, Stripe collects and processes:

Your name, email address, and billing address
Invoice details (amount owed, due date, description of the class or service, invoice status)
Payment card details or bank account information you provide when paying the invoice
Transaction and payment history
Device and fraud-prevention signals used to detect and prevent fraudulent transactions

We do not directly collect, view, or store your full payment card number or bank account credentials. Payment information is submitted directly to Stripe through its secure, PCI DSS–compliant platform. We retain only limited invoice metadata (such as invoice number, amount, due date, and payment status) needed for bookkeeping, customer support, and accounting.

Purpose and legal basis: This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, billing you for the class or service you booked — and to comply with legal obligations such as tax and financial recordkeeping (GDPR Art. 6(1)(c)).

Stripe's role: Stripe acts as an independent controller with respect to certain data it processes for its own regulatory, fraud-prevention, and compliance purposes (as is standard for payment processors), and as our processor for the invoicing services performed on our behalf.

Data transfers: Stripe may process and store data in the United States, the European Union, and other countries where Stripe operates. Where data is transferred outside the EEA/UK, Stripe relies on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms.

Retention: Invoice and payment records are retained for as long as necessary to comply with applicable tax, accounting, and financial regulations, after which they are securely deleted or anonymized.

More information: Stripe Privacy Policy.

5.6 Contact and Lead Forms (Wix Forms)

We use Wix Forms, a built-in form tool provided directly by Wix.com, to collect information you voluntarily submit through contact forms, inquiry forms, sign-up forms, and similar submissions on our Site.

Depending on the specific form, this may include:

Name, email address, and phone number
The content of your message or inquiry
Any additional fields we've added to a specific form (e.g., preferred contact method, subject/topic)

Purpose and legal basis: We use this information to respond to your inquiry, provide the service or information you requested, and maintain records of our correspondence. Processing is based on your consent (by voluntarily submitting the form) and, where applicable, our legitimate interest in responding to inquiries and operating our business (GDPR Art. 6(1)(a) and (f)).

Data handling: Form submissions are stored within our Wix account (see Section 5.3 for hosting details) and may be forwarded to our team's email inbox, which may be hosted via Google Workspace (see Section 5.4).

More information: Wix Privacy Policy.

5.7 Class and Appointment Scheduling (Wix Bookings)

We use Wix Bookings, a built-in scheduling tool provided directly by Wix.com, to manage class registrations, appointment scheduling, and related booking activity for our Site.

When you book a class or appointment, Wix Bookings collects and processes:

Name, email address, and phone number
Selected class, service, or appointment type, along with date, time, and session details
Number of participants or guests included in a booking
Booking status and history (confirmed, cancelled, rescheduled, no-show, waitlisted)
Payment or deposit information for paid bookings, handled via Wix Payments (see Section 5.5)
Mailing or service address, for bookings that require it (e.g., at-home services, equipment delivery, or shipping related to a class or session)
Any optional notes or information you choose to provide at the time of booking. Please do not include medical, health, or other sensitive personal information in booking notes or general contact forms.

Purpose and legal basis: We use this information to schedule, confirm, manage, and follow up on your bookings, including sending automated confirmation, reminder, and cancellation notifications. This processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, providing the class or service you booked.

Retention: We retain booking records for as long as necessary to manage our class schedules, respond to inquiries about past bookings, and comply with our accounting and legal obligations, after which records are deleted or anonymized.

More information: Wix Privacy Policy.

5.8 SMS/Text Message Reminders

If you provide your phone number and opt in to receive text message reminders when booking a class or appointment, we (through Wix Bookings) will send you SMS communications related to that booking, such as confirmations, reminders, and rescheduling or cancellation notices.

Consent: SMS reminders are sent only if you affirmatively opt in at the time of booking. Opting in to SMS reminders is not a condition of purchasing any class or service.
Scope: We use text messaging solely for transactional, booking-related communications — not for marketing or promotional messages — unless you separately opt in to marketing texts.
Message and data rates: Message and data rates may apply based on your mobile carrier and plan.
Frequency: Message frequency varies based on your booking activity.
Opt-out: You may opt out of SMS reminders at any time by replying STOP to any text message, adjusting your notification preferences in your account, or contacting us.
Carriers: We are not liable for delayed or undelivered messages, and mobile carriers are not liable for delayed or undelivered messages.

This SMS program is administered through Wix Bookings' built-in messaging functionality, which may rely on third-party telecommunications/SMS delivery providers engaged by Wix to transmit messages. Your phone number is not sold or shared with unaffiliated third parties for their own marketing purposes.

5.9 Site Member Accounts (Wix Members Area)

Our Site allows visitors to create a member account using Wix's built-in Members Area, which lets you log in, manage bookings, and access member-only content.

When you create a member account, we collect and store:

Name and email address
Password (stored by Wix in encrypted/hashed form — we do not have access to your plaintext password)
Profile information you choose to add (e.g., profile photo, bio)
Your booking history, form submissions, and other activity associated with your account
Login session data, including sign-in timestamps and authentication cookies necessary to keep you logged in

Purpose and legal basis: We use this information to operate your account, authenticate your sign-ins, and let you manage your bookings and preferences. Processing is necessary to perform our contract with you (GDPR Art. 6(1)(b)) — namely, providing the account and related services you signed up for.

Account deletion: You may request deletion of your member account and associated data at any time by contacting us, subject to any records we are required to retain for legal, accounting, or dispute-resolution purposes.

More information: Wix Privacy Policy.

5.10 Email Newsletter and Blog Notifications

If you opt in to receive blog post notifications or newsletter emails, we may use your email address to send occasional newsletters, blog posts, school or community updates, class and event announcements, special offers or discount codes, and other Zenbrio-related communications.

Consent: These emails are sent only if you affirmatively opt in (e.g., by subscribing via a sign-up form or checkbox). Subscribing is not required to use our Site or book a class.
Content: These emails are separate from transactional communications such as booking confirmations, reminders, receipts, and account-related notices described in Sections 5.7 and 5.8.
Unsubscribe: Every email includes an unsubscribe link, and we honor opt-out requests promptly, consistent with the CAN-SPAM Act. You may also unsubscribe by contacting us directly.
Sender identification: Our marketing emails identify us as the sender and include our physical business address, as required by the CAN-SPAM Act.

More information: Wix Privacy Policy.

5.11 Embedded Google Reviews Widget

Our Site displays a Google Reviews widget, installed via the official Google Reviews app on the Wix App Market, that pulls and displays customer reviews from our Google Business Profile.

Installation: This app is installed through Wix's official App Market (rather than custom third-party code), meaning Wix mediates the connection between our Site and Google's review data on our behalf, alongside its other hosting services described in Section 5.3.
Review content: The reviews shown were submitted directly to Google by reviewers — not collected by us — and may include the reviewer's name, profile photo, star rating, and written review, as made available by Google's review platform. We do not control this content and are not responsible for its accuracy; requests to edit or remove a review should be directed to Google or the reviewer.
Visitor data from the embed: Depending on how the app renders reviews on our Site, Google may still automatically collect limited technical data about your visit (such as IP address, browser type, and device information) when the widget requests review data, independent of any other Google tool described in this Policy.
Legal basis: For EEA/UK visitors, if the widget sets non-essential cookies, it is only loaded after you consent via our cookie banner (see Section 6). Where the widget loads without setting cookies, we rely on our legitimate interest in showcasing customer feedback.
Google's role: Google acts as an independent controller (not our processor) with respect to any data it collects through this integration, since it processes that data for its own purposes as part of its review platform.

More information: Google's Privacy Policy and Wix App Market Terms.

6. Cookies and Tracking Technologies

We use cookies and similar technologies (pixels, web beacons, local storage) to:

Operate essential Site functions
Remember preferences
Analyze traffic and usage
Deliver relevant advertising

Cookie Categories with purpose:

Strictly Necessary: Core site functionality, Requires Consent (EU/UK): No
Performance/Analytics: Usage statistics, Requires Consent (EU/UK): Yes
Functional: Preferences, personalization, Requires Consent (EU/UK): Yes

We do not use advertising or targeting cookies on our Site.

Visitors from the EEA/UK are presented with a cookie consent banner allowing granular opt-in before non-essential cookies are set, in compliance with the GDPR and ePrivacy Directive. You can manage cookie preferences at any time via the blue fingerprint button in the lower corner of the site or through your browser settings.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law (e.g., tax, accounting, or litigation holds). When data is no longer needed, we securely delete or anonymize it.

8. Your Privacy Rights

8.1 Rights for EEA/UK/Swiss Residents (GDPR)

You have the right to:
Access a copy of your personal data
Rectify inaccurate or incomplete data
Erasure ("right to be forgotten"), subject to certain exceptions
Restrict processing under certain conditions
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests or for direct marketing
Withdraw consent at any time
Lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority)

To exercise these rights, contact us. We will respond within one month as required by GDPR Art. 12.

8.2 Other U.S. State Rights

Certain U.S. state privacy laws — including the California Consumer Privacy Act (CCPA/CPRA), and similar laws in states like Virginia, Colorado, Connecticut, and Utah — grant additional rights to consumers, but generally only apply to businesses that meet specific size or data-volume thresholds (for example, a minimum annual revenue or a minimum number of consumers whose data is processed).

Based on our current size and data practices, these thresholds do not apply to us, so this Policy does not currently include state-specific mechanisms such as a toll-free opt-out number or a "Do Not Sell or Share My Personal Information" link. If our business grows or our practices change such that these laws apply to us, we will update this Policy accordingly.

Regardless of whether a specific state law technically applies to us, we're happy to honor reasonable requests to access, correct, or delete your personal information.

9. Children's Privacy (COPPA)

Our Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). If we learn we have collected such information without consent, we will delete it promptly. Parents who believe their child has provided information to us may use our Contact Us form to request deletion.

10. International Data Transfers

Because some of our service providers operate internationally, your information may be processed in countries other than the country where you live, including the United States, European Union, and Israel. Where required by law, appropriate safeguards are used for international transfers.

11. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you, without human review.

13. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. The "Last Updated" date at the top reflects the most recent revision.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please use our Contact Us form or contact:

Data Controller: Zenbrio School of Energy Kinesiology

Registered Address: 1725 Pearl St, Eugene, OR 97401

Representative: Sara Mcrae