Privacy Policy

CODA Pilates LLC (“CODA,” “we,” “us”) operates codapilates.com and is preparing to offer Pilates studio services. This Privacy Policy applies to our website and our mobile app. This policy describes our current website data practices and our planned studio security practices. Contact us at hello@codapilates.com or CODA Pilates LLC, 5245 Santa Monica Blvd, Unit 1B, Los Angeles, CA 90029. This notice does not itself enroll you in marketing messages or replace consent where required.

Founding List: We collect your name, email address, and interest in our offerings. You may optionally provide a phone number and ZIP code. We also collect referral and campaign information, including UTM source and campaign, the landing-page URL and query parameters, and referrer.

Class preferences: We collect your name and email, interest in Reformer and/or Glow, preferred days and times, class styles, Pilates experience, expected weekly attendance, optional requests, and attribution information. If you choose the optional email-updates checkbox, we record your choice, timestamp, source page, and the consent text shown.

Messages: We collect information you provide when contacting us. Optional free-text fields may contain information you choose to enter. Please do not submit medical histories, injury details, payment-card information, or other sensitive information through these fields or ordinary email. The current website does not request a structured health or injury questionnaire.

Lovable hosting analytics collects page-hit and event information, including timestamps, browser/user-agent information, locale, page path, full page URL, referrer, session identifiers, page views, and performance information. Network requests also expose information such as IP addresses to the receiving providers. A first-party session-id analytics cookie lasts approximately 30 minutes. Hosting technologies may change, and provider-side retention can differ from cookie expiration. Cloudflare uses the __cf_bm cookie for bot protection. Our hosting environment also sets a __dpl cookie; its precise function is being confirmed with the provider. Session storage supports scroll restoration and navigation. Google Fonts requests send ordinary connection information, including IP address, to Google. No Google Analytics, Meta advertising pixel, or session replay was observed in the website audit underlying this notice. We do not currently enable session replay in our application.

We use information to maintain the founding-interest list; understand class demand and scheduling preferences; respond to inquiries; provide requested opening, preview-class, and founding-membership updates; evaluate referral campaigns; operate and improve the website; protect against misuse; and comply with law or establish, exercise, or defend legal claims. We do not use optional sensitive disclosures for advertising.

Website submissions are stored in Lovable Cloud. Selected Founding List contact information may be copied to our Google Sheets CRM. New lead and survey submissions may generate internal owner notifications by email; survey free-text responses are currently included in those notifications. Survey answers are not mirrored into Google Sheets as survey responses. Authorized owners and staff may access records for their work. We disclose information as needed to hosting, database, analytics, security, email, and CRM providers that support these functions, including Lovable and Google services, and Cloudflare for website protection. Google receives network information through Google Fonts. Providers may process information outside California or the United States under their applicable arrangements. We may also disclose relevant information to professional advisers, insurers, authorities, or others when legally required or appropriate to address safety, fraud, disputes, or legal claims, and in connection with a business transfer subject to applicable law. Mobile information and text messaging originator opt-in data and consent are excluded from the sharing described in this section. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We do not sell contact or survey information for money or provide it to other businesses for their own direct marketing. No advertising-pixel integration was identified in the current website audit. This is not a representation that all hosting-provider processing has been independently verified; provider terms and configurations remain under review.

If you request or opt in to CODA updates, we may email you about opening, preview classes, founding memberships, and related offerings. You may ask us to stop promotional emails at any time by emailing hello@codapilates.com, or by using an unsubscribe link where provided. We maintain necessary suppression information to honor opt-outs. We may still send non-promotional replies or communications you request. Providing a telephone number does not constitute consent to promotional texts. Our current website has no marketing-text opt-in and does not enroll visitors in a text-marketing program. Any future SMS program will require a separate consent process and appropriate terms before launch.

Text messaging program: CODA may send text messages through its booking and marketing providers, including Mariana Tek, Xplor Growth, and Twilio. Messages may include booking and class reminders, account and membership notices, and — only with separate express consent — promotional messages about opening, preview classes, and founding memberships. Providing a phone number alone does not constitute consent to promotional texts, and consent is not a condition of purchase. You may receive up to four (4) messages per week. Message frequency may vary depending on your activity and interactions with us. Message and data rates may apply. Reply STOP to opt out at any time, and reply HELP for help. After you send STOP, we may send one confirmation message to confirm your opt-out. Carriers are not liable for delayed or undelivered messages. Supported carriers may change. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

The website currently has no cookie banner, cookie-preference panel, or application-level implementation responding to Global Privacy Control or Do Not Track signals. In the website audit, enabling those signals did not stop the observed hosting analytics requests or cookies. We do not represent that these signals currently disable tracking. You can use browser settings to restrict or delete cookies, although this may affect site functionality. Contact us about privacy choices or rights that may apply to you; browser settings do not necessarily control all provider-side processing.

We plan to use Mariana Tek for class bookings, accounts, memberships, payments through applicable processors, and a brief optional participation questionnaire, and Xplor Growth for marketing. These services are not currently integrated with this website, and current website submissions are not being transmitted to them through an active website integration. Before activating these data flows, we will update this policy to describe the actual collection, providers, retention, and consent controls. Future injury or limitation disclosures will be limited to participation needs, with access restricted to personnel who need them for safe instruction and modifications.

When studio security monitoring begins, four video-only cameras will cover the entrance/reception, reformer room, heated room, and hallways for safety, security, loss prevention, and incident investigation. Audio recording and live audio monitoring will be disabled. We will not use facial recognition or biometric identification. Cameras will not be placed in bathrooms, changing areas, or other areas where people reasonably expect privacy. Signs will provide notice of video monitoring. Routine footage will be automatically deleted or overwritten after 30 days. Relevant footage may be retained longer for an incident, investigation, legal obligation, or claim. Access will be limited to authorized personnel and security/storage providers, with relevant disclosures to insurers, advisers, authorities, or others as legally permitted for these purposes. Security footage will not be used for marketing. Identifiable promotional filming will be handled separately with appropriate permission.

We retain contact and preference information while reasonably needed for the opening-interest list, requested updates, scheduling research, and related business purposes. We review continued need and delete or deidentify information when no longer reasonably needed, subject to legal obligations, disputes, and necessary consent or suppression records. Specific operational retention schedules are still being finalized. Copies may exist in the database, Google Sheets, notification emails, and provider backups; deletion requests must account for these locations. Provider logs and backups follow applicable provider arrangements and deletion cycles. We use reasonable safeguards appropriate to the information and restrict access to authorized users. No system is completely secure. We will provide legally required breach notifications if applicable. Do not send sensitive information through public comments or ordinary website free-text fields.

Email hello@codapilates.com to request access to, correction of, or deletion of information you submitted, or to change communication preferences. The owner and studio manager handle requests. We may reasonably verify your identity and an authorized agent’s authority. Some information may be retained for legal requirements, claims, security, or honoring opt-outs. Depending on your location and which laws apply to CODA, you may have additional rights to know, receive a portable copy, opt out of sale or sharing or targeted advertising, limit certain uses of sensitive information, withdraw consent, or appeal a denial. We will respond under applicable requirements and will not unlawfully discriminate for exercising privacy rights. California residents may request information about qualifying disclosures for third-party direct marketing under California Civil Code section 1798.83, where applicable.

Our current website is not directed to children under 13, and we do not knowingly collect their personal information online. A parent or guardian may contact us with concerns. Studio services are available only to adults aged 18 and over. Third-party websites have their own privacy practices. We will post revised policies here with an updated date and provide further notice or obtain consent when legally required.