Kula Fitness Privacy Policy

Version 2.0 · 31 October 2026

Version 2.0 · 31 October 2026. This Policy replaces the Kula Fitness Privacy Policy Version 1.2 (18 August 2026). It is separate from the Kula Ops + Intelligence Privacy Policy, which governs the AI layer Kula Fitness builds on. The substance reflects how the service works today.

This Privacy Policy is published by Kula Holdings Pty Ltd (ABN 53 676 723 452) of Sydney, New South Wales, Australia (“Kula”, “we”, “us”, “our”). It describes how we handle personal information in connection with Kula Fitness and the Kula Tribe app, consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). The last section, §15, covers visitors to the kula.digital website.

1. What this Policy covers

Kula Fitness is the studio-side platform for boutique fitness businesses. It reads the studio’s booking system (GymMaster, Mindbody or Wix) and, through Kula Intelligence, other systems the studio has connected there, such as Stripe and ClassPass. It gives owners and managers analytics and retention insight, a front-desk view, cover and personal-training coordination, teacher pay-run calculations, and plain-language answers about the studio.

Kula Tribe is the app for a studio’s teachers and coaches: schedule and covers, short in-class cues about the people in the room, messages from the studio, compliance documents, and training.

There is no member interface. Members do not use Kula Fitness. Their information reaches us only as part of a studio’s data, and Kula Fitness does not message them today (§5). Features that will act toward members are described in the Terms and will be added to this Policy as they are released.

2. Our roles, and whose data this is

Controller of account information. For studio users and for the teachers a studio invites into Kula Tribe, we are the controller of the account and contact details in §3.1.
Processor of studio data. For the operational data a studio connects or creates through the service (its members, bookings, sales, teachers’ work records, covers, notes, documents and analytics), the studio is the controller and Kula acts as a processor on the studio’s instructions. A teacher’s work records in Kula Fitness belong to the studio they teach for.

Health and other sensitive information. A studio’s data may include health-related information about members (injury notes, pregnancy or medical flags a teacher records so they can teach safely). Such information receives heightened protection and is handled only as needed to provide the service on the studio’s instructions.

Consents and notices are the studio’s responsibility. As controller, each studio is responsible for the consents and notices required for it to collect its members’ and teachers’ personal information and to instruct us to process it, including any notice its workplace laws require before staff activity is recorded or reviewed. Kula relies on the studio’s representation that it holds them.

3. What we collect

3.1 Account and contact information (Kula as controller)

Studio users: name, work email, role and permissions, studio name, region and timezone, and sign-in identifiers from our identity provider. Billing contact details for the subscription, which is billed through the Kula Intelligence console.
Teachers: name and preferred name, email, mobile number, profile photo, employment type, and sign-in identifiers from the app’s identity provider (including an Apple or Google sign-in identifier where used). Where a teacher chooses to add them: date of birth, gender, pronouns and an emergency contact.
Devices: a push notification address for each signed-in phone, the device type and app version. A front-desk device holds a link token for the studio.
Support and diagnostics: what you send us when you ask for help, including the in-app “shake to report” bug report, which sends a screenshot, the device model and OS version, recent app log lines and your user identifier to our issue tracker only when you send it.

3.2 Studio operational data (Kula as processor)

On the studio’s instructions, Kula Fitness reads and stores a working copy of records from the systems the studio connects, directly or through Kula Intelligence:

Members and contacts: names, email addresses, phone numbers, membership status and plans.
Bookings and attendance: classes, visits, check-ins, cancellations.
Sales and payments: amounts, plans, payment method and status, and limited payment metadata, read through Kula Intelligence from Stripe where the studio has connected it. We hold at most the last four digits of a card and never receive full card numbers.
Class and teacher schedules, and the studio’s staff list.

3.3 What teachers and studios create in the service (Kula as processor)

Covers and personal-training sessions: requests, claims, approvals, sign-ins, and the confirmations sent.
Messages: threads between the studio and its teachers, with any photos attached.
Notes about members: observations a teacher records about the people in their classes, including alert tags, so the next teacher can teach safely. These are the studio’s records.
In-class cues: the short prompts Kula generates for a teacher before or during a class, and the snapshot of member context they were built from.
Compliance documents: a teacher’s Working with Children Check, first-aid certificate or similar, the details an AI model extracts from them (holder, number, expiry), and their currency status.
Training: which modules a teacher has done.
Availability and preferences.
Pay rules and pay runs: the rates a studio enters, the sessions and classes counted, and the calculated gross, tax, super and net amounts the studio exports. Kula pays nobody.
Bank and tax details: the service has fields for a teacher’s account name, BSB, account number, PayID, ABN, superannuation fund and GST status, and a one-way hash of a tax file number. Collection of these is currently switched off in the Kula Tribe app. When it is switched on, they will be collected only from the teacher, stored encrypted at rest, and used only to prepare the studio’s pay run.
Analytics: class utilisation, retention and at-risk signals, and class and teaching analytics that compare classes and teachers, produced for the studio (§5).
Questions and drafts: questions a studio user asks Kula in the web app, the answers, and drafts Kula produces (a retention email, a message), kept as the studio’s records and so Kula learns how the studio works (§6).

3.4 Provider credentials

The credentials a studio supplies to connect its booking system are stored encrypted at rest with Google Cloud Key Management Service, with the key held separately from the data, and used only for that connection. Bank and tax details, when collected, are encrypted at rest with AES-256-GCM.

3.5 Usage and audit data

To operate the service, support you and keep an audit trail, we record how the service is used: sign-ins, actions taken and by whom, connector sync results, and, for each AI call, the model, tokens and cost. In the studio web app we also use a product-analytics service that records which screens and features a signed-in studio user uses, identified by their work email, so we can improve the product. We do not use product analytics in the Kula Tribe app.

4. What we do not collect or do

Does not change the studio’s booking system. Today Kula Fitness reads; cover changes are made by the studio in its booking system and Kula verifies them.
Sends nothing outside the studio on its own. Kula notifies teachers and managers inside the service. The only message that reaches a member today is a personal-training sign-in confirmation that a teacher triggers.
Does not move money and holds no pay rates except those a studio enters to calculate its own pay runs. Billing between a studio and its members happens in the studio’s booking system.
Does not use your location. The Kula Tribe app has no location permission.
Does not run a coaching chat in the Kula Tribe app today. A coaching assistant exists in the app’s code but is not switched on; if it is, this Policy will say so and the conversations will be the teacher’s and the studio’s records.
Does not use crash-reporting or third-party analytics SDKs in the Kula Tribe app. The studio web app uses product analytics (§3.5).
Does not sell personal information, ever, and does not disclose it for third parties’ marketing.
Does not use one studio’s data for another studio. Each studio’s data lives in its own database.
Does not let its AI providers train on studio data, and engages them under terms that do not permit it. Kula’s own learning across studios uses de-identified information only (§6).

5. How we use data

To provide the service: analytics, retention insight, covers, personal-training coordination, pay-run calculation, in-class cues, messages and documents, within the access each studio grants.
To notify: push notifications and messages to teachers and managers inside the service (a push may carry the sender’s name and the start of a message); text messages and emails from Kula for invitations, access codes, front-desk links, sync notices and pay-run reports; and the personal-training sign-in confirmation a teacher triggers to a member.
To track compliance: to read a teacher’s compliance documents with an AI model and record the holder, number and expiry, so the studio can see what is current.
To produce analytics for the studio, including class and teaching analytics that compare classes and teachers. The studio decides who sees them and how they are used.
To operate and support: diagnostics, troubleshooting, security, audit and billing.
To learn and improve: to keep a studio’s questions, answers, drafts and decisions so Kula serves that studio better over time, and to improve Kula’s models and skills for every studio using de-identified, aggregated information (§6).

Direct marketing

We may send studio users service communications about the product (onboarding, security and feature updates). Where we send promotional messages, we include a way to opt out and honour it promptly, consistent with the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth). We do not use a studio’s members’ or teachers’ personal information for our own marketing.

6. How Kula uses AI

Kula Fitness uses AI models in these places:

In-class cues for teachers, built from member attendance and notes.
Answers and drafts in the studio web app: plain-language questions about the studio’s data, help writing a message, retention email drafts, at-risk member analysis, and class and teaching analytics.
Reading compliance documents to extract the details needed to track currency.
Voice transcription, where a teacher uses voice input, turning speech into text. The audio is not kept.

For these, Kula sends the relevant data to an AI model provider under Kula’s own account, currently Google (Gemini) and OpenAI, under commercial terms that do not permit the provider to train on it. We are not tied to one provider; the current providers are listed in §8. The coaching chat in the Kula Tribe app is not switched on (§4).

How Kula learns

Kula keeps a studio’s questions, answers, drafts and decisions so it can learn how that studio works. That learning serves the studio it came from.

Across studios, Kula improves its models and skills using de-identified information. Names, contact details, identifiers and any free text that could identify a person or a studio are removed or replaced before the data is used, and what remains is aggregated. One studio’s identifiable data is never used for, or shared with, another studio, and our third-party AI providers never train on it. A studio can ask us about this at privacy@kula.digital.

AI output is decision support. In-class cues and teaching analytics inform a person; they do not decide anything about a teacher or a member.

7. Kula Intelligence

Kula Fitness reads the studio’s data through Kula Intelligence, which is also provided by Kula, and shares member and teacher records with it so the two work from one picture of the studio. Kula Intelligence is governed by the Kula Ops + Intelligence Privacy Policy. The subscription for Kula Fitness is billed through the Kula Intelligence console.

We use the providers below to run Kula Fitness and Kula Tribe. Each processes data only to provide its part of the service.

Provider	Role	Privacy policy
Google Cloud Platform	Application hosting, databases, document storage, analytics storage, key management and secrets, in Sydney (australia-southeast1)	https://cloud.google.com/terms/cloud-privacy-notice
Neon	Managed Postgres: each studio’s own database, in the region chosen when the studio is set up	https://neon.tech/privacy-policy
Kinde	Studio user sign-in and identity	https://kinde.com/privacy-policy/
Clerk	Teacher sign-in for the Kula Tribe app, including Apple and Google sign-in	https://clerk.com/legal/privacy
Vercel	Hosting for the studio web apps	https://vercel.com/legal/privacy-policy
Expo, with Apple APNs and Google Firebase Cloud Messaging	Push notifications and app updates for Kula Tribe	https://expo.dev/privacy
AI model providers, currently Google (Gemini) and OpenAI	In-class cues, answers and drafts, compliance-document reading, voice transcription	https://policies.google.com/privacy, https://openai.com/policies/privacy-policy
Resend	Transactional email: invitations, access codes, sync notices, pay-run reports	https://resend.com/legal/privacy-policy
Twilio	Text messages: teacher invitations, front-desk links, personal-training sign-in confirmations	https://www.twilio.com/en-us/legal/privacy
Amplitude	Product analytics in the studio web app	https://amplitude.com/privacy
Crisp	Support chat in the studio web app	https://crisp.chat/en/privacy/
Linear	Bug reports sent from the apps	https://linear.app/privacy
Cloudflare	Bot protection on teacher sign-up, network security and edge delivery	https://www.cloudflare.com/privacypolicy/
Stripe	Kula’s subscription billing, through the Kula Intelligence console	https://stripe.com/privacy

In addition, the studio’s booking system (GymMaster, Mindbody or Wix) is read under the studio’s agreement with that provider, and Kula Intelligence receives and returns studio data as described in §7.

We may update this list as the service evolves; the current list will always be here. Material changes are notified under §14.

9. Where data is stored and cross-border handling

Kula Fitness runs on Google Cloud in Sydney, Australia. Each studio’s database is provisioned in the region chosen when the studio is set up, Australia for Australian studios.

Some processing takes place outside Australia: our AI model providers (Google and OpenAI), push delivery (Expo, Apple and Google), email and text providers (Resend and Twilio), product analytics, support chat and issue tracking (Amplitude, Crisp and Linear), parts of our web hosting, and parts of Kula Intelligence operate in the United States. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including APP 8, through contractual data-processing terms.

10. How long we keep data

While the studio’s account is active, its data and the records its team creates are retained as the studio’s records.
Voice audio is not kept once transcribed.
On account closure, the studio may export its data for a reasonable period, after which we delete it within 30 days, except where we must retain limited records to meet a legal, tax or accounting obligation (for example pay-run records), and minimal audit records.
When a teacher leaves a studio, the studio ends their access. Their work records remain the studio’s. A teacher can ask us to delete the account information we hold about them as controller (§11), and we will anonymise their profile in the studio’s records on the studio’s instruction.

11. Your rights and choices

Studio users and teachers. You may ask us for access to, or correction of, the account information we hold about you as controller by emailing privacy@kula.digital. We respond within a reasonable period, generally 30 days. Access to your own account information is free; if a request is complex we may charge a reasonable, cost-based fee and will tell you beforehand. If we cannot provide access or make a correction, we will tell you why in writing and how to complain. You can request deletion of your account and the data we hold as controller at kula.digital/user/deleteme, which confirms by email before anything is erased, or by email. A teacher’s work records belong to the studio; direct requests about them to the studio, and we will support it in responding.

Members. Because the studio is the controller of member data, members should direct access, correction and other privacy requests to their studio. As its processor, we will support the studio in responding.

Permissions. A teacher controls push notifications and the camera and photo permissions in their device settings. Kula Tribe works without them, apart from the features that need them.

12. Security

Per-studio isolation. Each studio’s data lives in its own database, and a request is bound to one studio from its verified credential.
Encryption. In transit (TLS) and at rest. Booking-system credentials are encrypted with Google Cloud Key Management Service; bank and tax details, when collected, with AES-256-GCM, with keys held separately from the data.
Scoped access and auditing. Role-based access in the studio web app, and audit records of sign-ins and actions.
Revocable access. A studio can revoke any teacher’s or device’s access at any time.

For more detail on the shared platform, see Security & data handling. To report a vulnerability, see Responsible disclosure or write to security@kula.digital.

Notifiable Data Breaches. Where an eligible data breach occurs, we will act in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required, and supporting controller studios in meeting their own notification obligations.

13. Complaints

If you have a privacy complaint, contact privacy@kula.digital. We will acknowledge your complaint within 5 business days and work to resolve it promptly. If you are in Australia and not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Children, and changes to this Policy

Kula Fitness and Kula Tribe are workplace tools for studios and their teams. They are not directed at children and we do not knowingly collect personal information directly from children. Where a studio’s records include information about minors, that information is handled on the studio’s instructions, and the studio remains responsible, as controller, for holding any required consents.

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify studios in advance. The version and date at the top of this page indicate the current edition.

15. Website visitors, cookies and analytics

This section is different from the rest of this Policy: it covers visitors to kula.digital itself (this marketing website), not the Kula Fitness platform described in §1 to §14. Kula Holdings Pty Ltd is the controller for this data.

15.1 What we collect

When you visit kula.digital, we may collect: the pages you view and when, links and buttons you click, session information (grouped into visits by a rolling 30-minute window), device type, referring site, campaign parameters (for example utm_source), and advertising click identifiers (Meta’s fbc/fbp, LinkedIn’s li_fat_id). We also assign your browser a random, first-party identifier so we can recognise repeat visits.

If you submit a form (for example a newsletter signup or a Studio Health Check request) or click a link in an email we have sent you, we connect your browsing history on that browser to your email address, so we can see your enquiry in context and follow up sensibly. We do not otherwise know who an anonymous visitor is.

15.2 Recipients

Website analytics is stored in our own database (Supabase, hosted in Australia) and served via Vercel. Depending on your cookie choice, information may also be shared with Google (Analytics/Ads), Meta and LinkedIn (advertising measurement), and Slack (internal new-enquiry notifications). If you submit an enquiry, your details are also shared with the Kula Intelligence platform’s own systems and, for enquiries suited to direct outreach, with Kula’s lead-management system, so a member of our team can follow up.

15.3 Retention

Analytics for a visitor who never contacts us is kept for up to 180 days, then deleted. If you do contact us, your browsing history is kept alongside your enquiry: the page-by-page detail is purged after 24 months of inactivity, though your enquiry record itself is retained. Your cookie choice is remembered for 180 days.

15.4 Your choices

Choose Essentials only on the cookie banner, or via Cookie settings in the footer at any time, to stop analytics and advertising cookies. This also removes the cookies already set.
Ask us to delete your information via /user/deleteme or by emailing privacy@kula.digital.
If you are in the EU, UK or Switzerland, we do not set analytics cookies until you actively accept them.

15.5 Cookies we use

Cookie	Purpose	Duration	Category
kula_consent	Remembers your cookie choice	180 days	Essential
kula_vid	A random id for your browser, so we can count visits and, if you contact us, connect your enquiry to your earlier visits	Up to about 400 days	Analytics
kula_sid	Groups the pages you view into one visit	30 minutes	Analytics
kula_attr	Records the campaign or referrer that first brought you here	90 days	Analytics / advertising
_fbc / _fbp	Meta advertising click and browser identifiers	90 days	Advertising
li_fat_id	LinkedIn advertising click identifier	90 days	Advertising
Google Analytics (_ga, ga*)	Aggregate site-usage analytics	Up to 2 years	Analytics
Crisp chat cookies	Keeps a live-chat conversation connected	Session / functional	Functional

“Essentials only” stops us setting or renewing these; it does not retroactively affect cookies a browser extension or the platforms themselves may already hold independently of our site.

15.6 Links in our emails

If you arrive from a link in an email we sent you, the link can carry a code identifying the email address it was sent to. We use it to connect your visit to our earlier contact with you. Choosing Essentials only stops this, and you can ask us to remove the connection at privacy@kula.digital.

16. Contact

Privacy: privacy@kula.digital (attn: Privacy Officer)
Security: security@kula.digital
Legal: legal@kula.digital
Support: support@kula.digital

Kula Holdings Pty Ltd, ABN 53 676 723 452, Sydney, New South Wales, Australia. Governing law: New South Wales, Australia. The parties submit to the non-exclusive jurisdiction of the courts of New South Wales.

Version 2.0 · 31 October 2026.