01Who we are & what this covers
This Privacy Policy describes personal information handled by SprintFWD, LLC, doing business as The Studio Stack (“Studio Stack,” “we,” “us” or “our”), in connection with our website, sales and support relationships, and the services we provide. It is separate from our Terms & Conditions.
Personal information includes information that identifies, relates to or can reasonably be linked to a person or household. Device identifiers, IP addresses and browsing activity can be personal information even without a name or email address.
When we decide why and how information is used for our own business purposes, such as answering a demo inquiry, we act as the business or controller. When a studio, franchise, brand or other customer directs us to handle member or lead information, we generally act as its service provider or processor. Our role depends on the actual processing, not simply the label used in a contract.
For customer-directed processing, the customer’s privacy notice and our applicable data processing agreement govern the customer’s instructions. If you book, purchase or communicate with a studio through a Studio Stack-powered experience, that studio is your first contact about its use of your information. We assist customers with requests as required by law and our agreement. This does not reduce any responsibility we have directly under privacy law.
02Information & where it comes from
The categories below describe information relevant to our website and supported service functions. The information involved depends on your relationship with us, the product used, the customer’s configuration and the permissions you provide. We receive information directly from you or a customer, from authorized integrations and service providers, and automatically through use of a website or application.
| Category | Examples and use |
|---|---|
| Contact & professional details | Name, email, phone number, company, role, platform and location count; used to respond to inquiries, manage a business relationship and provide support. |
| Account & administration | User identifiers, account settings, permissions, authentication information and administrative activity; used for access, configuration and security. |
| Commercial & service records | Orders, subscriptions, billing details, invoices, transaction references and support history; used to deliver services, bill and maintain business records. |
| Customer-managed member & lead data | Contact and profile details, bookings, attendance, membership or purchase status, preferences, loyalty activity and campaign interactions that the customer supplies or connects; processed to deliver its configured experience. |
| Communications & content | Form entries, email or text conversations, chat inputs, support requests, uploaded images, videos and workout materials; used for the selected communication or content feature. |
| Device, network & usage activity | IP address, browser and device type, operating system, identifiers, approximate location inferred from IP, pages or features used, timestamps and error logs; used for functionality, security, diagnostics and permitted measurement. |
Connected systems may include Mindbody, Kite, HubSpot, other MMSs, payment and messaging services or other tools a customer authorizes. Their permissions and product configuration determine which records are exchanged. Do not send payment-card security codes, medical records, government identifiers or other sensitive information through ordinary contact or support forms.
Where a supported feature requests device access, use the permission controls provided by the device or browser. A payment flow may transmit payment information to the applicable payment provider; its own notice explains its processing. Payment processing and the information available to us depend on the provider and the feature you use; do not send card details in ordinary support messages.
03Why information is used
- Provide, configure and support the services a customer orders, including branded apps, member portals, booking, checkout, content and authorized integrations.
- Respond to inquiries, manage accounts, process billing and send service, security and administrative communications.
- Carry out a customer’s lawful instructions for member communications, campaigns, offers, loyalty and workflow automation.
- Monitor reliability, investigate errors, protect accounts, prevent fraud and misuse, and enforce agreements.
- Understand use and improve our services, subject to applicable data protection restrictions and customer agreements.
- Send our own relevant business marketing where permitted, with an appropriate way to opt out.
- Meet legal obligations, resolve disputes, establish or defend legal claims and respond to valid legal requests.
Customer-directed member data is subject to the purpose and use restrictions in the applicable agreement and law. A broad product-improvement purpose does not authorize an unrelated use of that data or override a customer’s instructions. Aggregated or de-identified information is treated as non-personal only where the applicable legal standard is met, with safeguards against re-identification.
04Who receives information
Service providers. Providers of hosting, infrastructure, support, CRM, communications, payment processing, security and other operational functions receive information needed for their work. Applicable agreements must restrict their use and require appropriate protection. Some providers, such as payment services, also process information for their own legally defined purposes under their notices.
The business you interact with. A studio or brand and its authorized administrators receive the member, lead, booking, purchase and communication information associated with their services. Customer-configured permissions can allow brand-level or multi-location access.
Connections you or a customer enable. Information passes to authorized integrations to carry out the requested function. A third-party destination’s own privacy notice applies to its independent use. An external link does not mean that all practices of that destination are covered by this policy.
Legal, safety and business events. Information may be disclosed where reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate fraud or obtain professional advice. In a proposed or completed financing, merger, acquisition or asset transfer, relevant information may be disclosed with appropriate safeguards and any legally required notice or choices. Corporate affiliation alone does not authorize an unrelated use.
Advertising-related disclosures, if any, require the specific disclosures and controls described in the next section. This policy is not permission to sell customer-controlled member data.
06AI, messaging & optional products
If a customer enables an AI chatbot or messaging product, inputs, responses, recipient details and interaction records may be processed to provide that feature and allow the customer’s team to review and follow up. Do not put confidential or sensitive information into a conversation unless the business has clearly explained the use and the feature is approved to handle it. AI output can be inaccurate; ask the business for human assistance when needed.
Optional tools can have separate providers, terms and privacy notices. In particular, follow the notice presented by First Timers when using its AI and SMS platform. A link from Studio Stack does not by itself enroll you in that service or authorize marketing messages.
For marketing texts, follow the opt-out instructions in the message, such as replying STOP, or contact the identified sender with another valid revocation request. For marketing email, use the unsubscribe link or contact the sender. A studio manages its own campaigns; we will assist it with applicable requests. Essential transactional communications may continue where lawful.
07Children & sensitive information
Our business website and administrative accounts are intended for adults, not children under 13. We do not knowingly solicit children’s personal information through these channels. If you believe a child has provided information inappropriately, contact us so it can be investigated and handled under applicable law.
Studios may serve families or minors. A customer must not enable collection from children through our Services unless that use has been expressly approved and the required notices, parental permissions and safeguards are in place. A general statement that a service is for adults does not remove obligations when children’s information is actually processed.
Fitness, attendance or preference information can reveal sensitive health information in some contexts. Uses involving regulated health data, precise location, biometrics or other sensitive information require a separate assessment and any necessary consent, notice and processing terms. We do not claim HIPAA compliance or treat ordinary website acceptance as consent to sensitive-data processing.
08Security
We use reasonable administrative, technical and organizational measures designed to protect personal information, taking account of the nature of the information and the services. Customers also help protect information by assigning appropriate permissions, securing accounts and devices, and keeping their connected systems current.
No online service or transmission is completely secure. This is not a waiver of our legal security obligations. We handle security incidents and notifications as required by applicable law and our agreements. Report a suspected issue to contact@thestudiostack.com; do not include passwords or unnecessary sensitive information.
09How long information is kept
Retention must be limited to what is reasonably necessary for the stated purpose, our agreements and applicable law. Relevant criteria include the duration of an active account or relationship, the service a customer asks us to perform, legal recordkeeping duties, dispute periods, security needs and deletion requests.
- Business contacts and support records: for the relationship or request and a justified follow-up or claims period.
- Billing and transaction records: for applicable accounting, tax and legal recordkeeping requirements.
- Customer-controlled member data: according to the customer’s lawful instructions and applicable data processing agreement, including return or deletion at the end of service.
- Security and usage logs: for a period proportionate to diagnostics, abuse prevention and security needs.
- Suppression records: limited information needed to remember and honor an opt-out.
- Backups: protected copies that expire under the backup cycle, with retained data restricted from ordinary use where required.
Information subject to a legal hold may be kept until the hold ends, with use restricted to that purpose. Deletion must also be addressed with relevant service providers.
10Your privacy rights
Depending on your location, our role and applicable law, you may have rights to obtain information about processing; access or receive a portable copy; correct inaccurate information; request deletion; withdraw consent; restrict or object to processing; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive information; or challenge certain automated decisions. These rights have legal exceptions and do not apply identically everywhere.
California residents may have rights to know the categories and specific pieces collected, sources, purposes and recipient categories; delete or correct information; opt out of sale or sharing; limit qualifying sensitive-information uses; and receive equal treatment when exercising their rights. The information, purposes and recipient categories described above depend on the services and relationship involved. Contact us to request the information and choices applicable to you.
Other U.S. state laws may provide an appeal if a request is denied. Individuals in the EEA, UK or Switzerland may also have the right to complain to their local data protection authority. We do not require you to waive a privacy right as a condition of making a request. We will not unlawfully discriminate or retaliate because you exercise a protected right.
11How to make a request
Email contact@thestudiostack.com with “Privacy request” in the subject, call 310-955-1357, or write to the address in the contact section. Describe your request and the website, studio or service involved. Do not send a password, full payment-card number or identity document unless a secure and necessary verification step is specifically arranged.
For information controlled by a studio or other customer, contact that business directly where possible. We may route the request to the appropriate customer and assist it under our agreement. For information we control, we may need proportionate information to verify your identity or an authorized agent’s authority. Opt-out requests will not be subjected to identity verification where the law prohibits it.
We will respond within the period required by the law that applies to your request and explain any permitted extension or refusal. Where an appeal is available, email the same address with “Privacy appeal”; we will provide an outcome and any required information about further recourse. You may contact a regulator without first contacting us.
To stop Studio Stack marketing email, use the unsubscribe link or email us. To change a studio’s messages or membership details, contact that studio. Service and legal notices may still be sent when appropriate.
12International information
We are based in the United States. Information may be processed in the United States or other countries where the relevant service providers operate. Those countries may have different privacy protections. Merely visiting a website does not waive protections or create a valid transfer mechanism.
Where European or UK data protection law applies to our own processing, the relevant basis depends on the purpose: performing a contract with the individual or taking requested pre-contract steps; compliance with a legal obligation; a properly assessed legitimate interest such as securing services or managing a business relationship; or consent where required. A contract with a studio does not automatically supply a contractual lawful basis for every member’s data.
Customer-directed processing follows the customer’s lawful instructions and required processing terms. Before restricted international transfers occur, the parties must establish an applicable lawful mechanism and safeguards, such as appropriate standard contractual clauses where suitable. Contact us for the safeguards applicable to a particular service.
13Changes to this policy
This policy is effective October 11, 2026, and was last updated on that date. We will explain material changes through appropriate notice and obtain consent where required before applying a new use. An update does not retroactively authorize an incompatible use of information or reduce rights that the law protects.
The notice presented by a studio or a separately supplied product continues to govern that business’s independent processing. This policy does not amend an existing signed data processing agreement.
14Contact us
SprintFWD, LLC, doing business as The Studio Stack
Attention: Privacy
703 Pier Ave, Ste B #632
Hermosa Beach, CA 90254, United States
Email: contact@thestudiostack.com
Phone: 310-955-1357
Product support: DashApps Support (opens in a new window)