Privacy policy

NZ Privacy Act 2020 · Last updated October 2026

What we collect

Name, email, mobile number
Neighbourhood and movement preferences
Payment method (held securely by Stripe — we never see or store your card number)
Session holds and ratings
Anything you tell us under “moving with care” — an optional note about an injury, pregnancy, surgery, or anything else you’d like your teacher and GEM to know
Usage data (which sessions you view, when you log in)
If you teach or GEM for us: your qualifications, First Aid training status, availability, and banking details for payouts

Why we collect it

To match you with sessions near you
To process holds and payments
To send confirmations, updates, and receipts
To keep everyone moving with care — your teacher and the GEM on the day see your care note. Stretchy HQ can also see it, at our discretion — for example, to help sort out a safety concern
To improve Stretchy and fix problems

Who we share it with

Stripe — payment processing (stripe.com/privacy)
Supabase — database hosting (supabase.com/privacy)
Resend — transactional email (resend.com/privacy)
Vercel — app hosting (vercel.com/legal/privacy-policy)
Google — if you choose to sign in with your Google account, or once Google Calendar sync is switched on for your sessions
Your teacher and GEM — your first name, and any care note, for sessions you hold a place in

We do not knowingly sell your data, and we do not use it for advertising.

Some of the services above store data outside New Zealand. We choose providers who meet strong privacy and security standards wherever they’re based, in line with our obligations under the Privacy Act around sending information overseas.

Care & health notes

Anything you share with us under “moving with care” is treated as sensitive. It’s visible to your teacher and the GEM running your session, and Stretchy HQ can also see it at our discretion — for example, to help resolve a safety concern. It’s protected by database-level access controls, and you can edit or remove it at any time. We are not a medical service, and this note isn’t medical advice. It’s ultimately up to you to move within your own limits, and to seek professional medical, health or wellness advice where you need it.

Cookies 🍪

The short version: we only use the essentials. No ads, no analytics, no following you around the internet.

Cookies are tiny files a website pops on your device so it can remember you. Here’s everything Stretchy uses:

Keeping you logged in — when you sign in, a cookie remembers it’s you so you don’t have to log in on every page. It’s cleared when you log out.
Keeping payments safe — when you hold a spot or add a card, our payment provider Stripe sets its own cookies to process your payment securely and help stop fraud (stripe.com/privacy).
Remembering little things — your browser’s local storage notes that you’ve closed a pop-up or this cookie note, and which Stretchy suggestions you’ve voted for. This stays on your device and isn’t sent to us.
Signing in with Google — only if you choose that option, Google sets its own cookies while it signs you in.
Fonts — our typefaces load from Google Fonts. That means Google sees your device’s IP address to deliver them, but no cookies are set.

What we don’t use: analytics cookies, advertising cookies, or social media tracking pixels.

Your choices: you can block or delete cookies any time in your browser settings. If you block the essential ones, logging in and booking won’t work — but you can still browse what’s on. Because everything we use is needed to run Stretchy, there’s nothing to opt in or out of. If we ever add analytics or marketing cookies, we’ll ask you first and update this section.

Marketing emails

Booking confirmations, receipts, and session updates aren’t marketing — we’ll always send you those, they’re part of running your booking, and they’re not something you can opt out of while you have an upcoming session. If we send marketing emails (like newsletters or offers), that’s separate: we’ll only do that with your clear opt-in, and every marketing email has a one-click unsubscribe. We don’t currently send SMS messages.

How long we keep your information

Payment and financial records: 7 years, as required under New Zealand’s tax record-keeping rules (Tax Administration Act 1994)
Your account details: for as long as your account is active, and for a reasonable period afterwards in case you come back — we’re working towards a fixed number here and will update this section once it’s confirmed
Care notes: kept only as long as they’re useful for your safety in sessions, and removed sooner if you ask us to
You can ask us to delete your information at any time, and we will, unless we’re required to keep something (like financial records, for tax purposes)

Your rights

You can ask to see, correct, or delete your personal information at any time — email kimberley@stretchyyoga.co.nz and we’ll respond within 20 working days, as required under the NZ Privacy Act 2020. If you’re not happy with our response, you can complain to New Zealand’s Office of the Privacy Commissioner.

If something goes wrong

If we ever have a privacy breach that’s likely to cause you serious harm, we’ll tell you and the Privacy Commissioner as soon as we reasonably can, as required by law.

Under 18s

Stretchy is for adults 18 and over. If you’re under 18, you can only join a Stretchy session if you’re accompanied by a paying parent or legal guardian who attends the session with you — a guardian’s permission alone isn’t enough, they need to be there and to have paid for you. This doesn’t apply to any session or event we specifically host for children or teens — those will always be clearly marketed as such, with their own age guidance. Some sessions are held at licensed venues (like bars or restaurants) — those venues have their own rules about where under-18s can go on the premises, even with a guardian present, and those rules apply on top of ours.

Contact

Privacy Officer: Kimberley Torrie
kimberley@stretchyyoga.co.nz
stretchyyoga.co.nz