Privacy
Effective October 15, 2026. Fig Technologies LLC, a Delaware limited liability company. The business is run from Davidson, North Carolina.
This policy explains how Fig Technologies LLC (“Fig Technologies,” “we,” “us”) collects, uses, shares, and protects personal information through PilatesCRM at https://pilatescrm.com. We play two roles. For website visitors, studio account holders, staff, and prospects, we decide how information is used, and this policy applies fully. For information a studio collects through PilatesCRM (bookings, memberships, payments, messages, and waivers), we process data on the studio’s behalf and under its instructions. The studio’s own privacy policy governs that data. End clients should send privacy requests to their studio. If you contact us instead, we will forward the request.
What we collect and why
| Category | Examples | Why we use it |
|---|---|---|
| Studio account data | Studio name, owner and staff names, business email, phone, address, login credentials (hashed), plan, and settings | Create and manage accounts, provide and bill for the Services, support, and security |
| Billing data | Subscription and invoice records, Stripe customer ids, card brand and last four digits. Full card numbers are handled only by Stripe or Square | Process subscription payments and keep tax records |
| End client data (processed for studios) | Name, email, phone, booking and attendance history, memberships and purchases, payment metadata, waiver signatures and timestamps, messaging consent and opt-out records, communications, and notes the studio enters | Provide booking, payment, messaging, waiver, and AI features to the studio |
| AI feature inputs and outputs | Prompts and studio data used to prepare a setup card or a suggestion, and the generated output | Provide AI features. Calls through the Vercel AI Gateway to OpenAI use zero data retention and are not used to train models |
| Website visit data, when a studio enables the tracking snippet | Pages viewed, referrer, campaign parameters, and a first-party visitor id. An IP address is not stored by the snippet | Help that studio see which pages and campaigns bring people in. Do Not Track and Global Privacy Control stop the snippet before it sets a cookie |
| Technical and usage data | IP address, browser and device type, pages viewed, referring URL, timestamps, and error logs collected by our hosting provider | Deliver, secure, and debug the Services, and prevent fraud and abuse |
| Communications | Emails and messages you send us | Respond to you, provide support, and keep records |
We collect information directly from you, automatically when you use the Services, and from service providers that help us operate them. We do not knowingly collect sensitive personal information (such as health, financial-account, or government ID data) except payment metadata and notes a studio chooses to enter, and we ask that you not submit medical records or full card numbers.
How we use information
To provide, operate, maintain, and improve the Services; to respond to inquiries and provide support; to process transactions and send related notices; to send updates you request (you can unsubscribe at any time); to secure the Services and prevent fraud, abuse, and violations of our Terms; to comply with law and enforce our rights; and for other purposes with your consent. We may create de-identified or aggregated data and use it for any lawful purpose.
How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only to the service providers listed below, to comply with law or to protect rights and safety, in connection with a merger or sale of the business, with your direction or consent, and, for end client data, with the studio that collected it and with others as that studio instructs.
| Service provider | Purpose |
|---|---|
| Vercel Inc. | Hosting, serverless functions, content delivery, and the AI Gateway |
| Neon | Postgres database |
| Stripe, Inc. | Subscription billing and studio payment processing through Stripe Connect. Stripe collects card data directly and may use it for fraud prevention |
| Block, Inc. (Square) | Studio payment processing. Square collects card data directly |
| Twilio Inc. | SMS |
| Resend | Transactional and studio email |
| OpenAI, via the Vercel AI Gateway | AI features, with zero data retention. Inputs are not used to train models |
| Nango | Integrations a studio connects |
Retention
Studio account and billing data are kept for the subscription plus up to 7 years for tax, accounting, and legal records. End client data is kept as the studio directs during the subscription, then deleted within 30 days after the studio’s account ends, unless the studio exports it or the law requires us to keep it. Backup copies are overwritten on our ordinary backup cycle. Messaging consent and opt-out records are kept up to 5 years to document compliance. Hosting logs follow our providers’ standard retention.
Security
We use reasonable administrative, technical, and physical safeguards, including encryption in transit (HTTPS) and access controls. No method of transmission or storage is completely secure, and we cannot guarantee security.
Your choices and rights
You may ask us to access, correct, or delete your personal information, or to stop sending marketing emails, by emailing rob@figtech.xyz. You can also unsubscribe using the link in any marketing email. We will verify your request and respond within the time required by law. We will not discriminate against you for exercising your rights.
California residents
This section supplements this policy for California residents. In the last 12 months we have collected identifiers (name, email, phone, IP address, account ids); customer records and commercial information (subscriptions, bookings, memberships, purchases, and limited payment metadata); internet or network activity; professional information (studio business details); and limited notes only if a studio chooses to enter them. We collect that information from the sources described above and disclose it for business purposes only to the service providers listed above. We do not sell or share personal information as those terms are defined under California law, we have no actual knowledge of selling or sharing the personal information of consumers under 16, and we do not use or disclose sensitive personal information for purposes that require a right to limit.
California residents may know, access, correct, and delete personal information, subject to legal exceptions, and may not be discriminated against for exercising these rights. To exercise them, email rob@figtech.xyz with the subject “California Privacy Request.” You may use an authorized agent who provides proof of authorization, and we may require you to verify your identity directly. We respond within 45 days, extendable as the law permits. Residents of other U.S. states with comprehensive privacy laws may exercise similar rights and may appeal a denial by replying with the subject “Privacy Appeal.”
EEA, UK, and Swiss users
Fig Technologies LLC is the controller for personal information processed under this policy. For end client data processed for a studio, the studio is the controller and we are its processor. Our legal bases are performance of a contract or steps you request before entering one, our legitimate interests in operating, securing, and improving the Services and communicating with business contacts, your consent where we ask for it (which you may withdraw), and compliance with legal obligations. You may access, rectify, erase, restrict, or object to processing, request portability, withdraw consent, and lodge a complaint with your local authority. We are based in the United States and process information there. Where required, we rely on the European Commission’s Standard Contractual Clauses for international transfers.
Children
The Services are not directed to children under 13, and children under 13 may not use them. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact rob@figtech.xyz and we will delete it.
Changes
We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice where required.
Contact
Fig Technologies LLC, Davidson, North Carolina. Email: rob@figtech.xyz.