Privacy Policy
Version 2026-11-03, in force since 3 November 2026. Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018.
1. Who is responsible
The controller of your personal data is [Aeva S.à r.l.], [street and number], L-[postcode] [city], Luxembourg, RCS Luxembourg [B000000] ("Aeva", "we"). For anything about your data write to support@example.lu or to the postal address above. We have not appointed a data protection officer because the law does not require one for our activity; the privacy contact handles all requests.
2. In short
- We use your data to run your account, your membership and your bookings, to take payment and to send you the messages the service needs.
- We share your name with the studio where you book a class, and we use service providers (payments, hosting, email, notifications, crash reports) under contracts that protect your data.
- We send marketing messages only if you asked for them, and you can stop them at any time.
- We do not sell your data, we do not use advertising trackers, and we do not profile you.
- You can see, correct, export and delete your data from the app or by writing to us, and complain to the CNPD.
3. Data we process and where it comes from
You give us: your email address; your name and, if you add them, a photo and a telephone number; your age confirmation; the plan you choose and your promotional or referral code; the language you pick; your messages to support.
Created by using the service: your bookings, check-ins, cancellations and no-shows; your credits and subscription status; payments and fees (we hold the Stripe customer and payment-method identifiers, the last four digits and the brand of a card, the amount, date and status of each payment, never the card number); the version of the terms you accepted and your consent choices, with their dates; the device token used for notifications.
From Apple or Google, if you sign in with them: your identifier with that provider, your email address (or the relay address Apple creates for you) and your name.
From your device: the approximate location of your phone, only when you allow it and only to centre the map, and crash reports (device model, operating system, app version, the error) with personal data switched off.
From studios: whether you attended a class.
We do not ask for and do not want health data. Classes you book say nothing about your health, and we do not draw conclusions from them. If a studio needs medical information from you for safety reasons, it asks you itself and is responsible for it.
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) | Kept for |
|---|---|---|---|
| Creating and running your account, signing you in | email, name, photo, language, sign-in codes, Apple/Google identifiers | Contract (art. 6(1)(b)) | While your account exists |
| Your membership, credits and bookings | plan, subscription status, credits, bookings, check-ins | Contract | While your account exists; bookings and credits history 3 years after, for disputes |
| Taking payment, invoices, refunds, chargebacks | Stripe identifiers, payment status, amounts, invoices | Contract; legal obligation (accounting and VAT law) | Invoices and payment records 10 years after the end of the financial year (Code de commerce art. 16, VAT law) |
| Telling the studio who booked | name, class, time, attendance | Contract (the class cannot take place without it) | Studios keep it no longer than 14 days after the class |
| Service messages: booking confirmations and reminders, payment receipts, sign-in codes, changes to the terms | email, device token | Contract | While your account exists |
| News and offers by email and notification | email, device token, consent record | Consent (art. 6(1)(a)), given at sign-up or in Profile → Privacy & legal | Until you withdraw consent; the record of your consent 3 years after |
| Centring the map on your area | approximate device location | Consent (system permission), processed on your device only | Not stored |
| Keeping the app working: crash reports | crash data without personal details | Legitimate interest (a working, secure app); you can opt out in the app | 90 days |
| Preventing fraud and abuse: duplicate accounts, unpaid fees, payment fraud | account and booking metadata, IP address at sign-in, Stripe risk signals | Legitimate interest (protecting the service, the studios and other members) | 12 months |
| Answering your requests and complaints | your messages | Contract; legitimate interest | 2 years after closure of the request |
| Proving what you agreed to | terms version, consent choices, withdrawal statements, with dates | Legal obligation (consumer law) and legitimate interest (defence of claims) | 10 years |
| Statistics about the service | aggregated data that no longer identifies you | Not personal data | Indefinitely |
Where we rely on a legitimate interest, we have checked that it does not override your interests and rights; you can object at any time (section 9).
Providing your email address and payment details is necessary to conclude the membership contract; without them we cannot provide the service. Everything else is optional.
We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects.
5. Who receives your data
Studios. The studio where you book receives your name and the details of the booking, and records your attendance. Each studio is an independent controller for that data. Our agreement with studios allows them to use it only to run the class, forbids marketing to you without your separate consent, and requires them to delete it within 14 days after the class. Studios are in Luxembourg.
Service providers (processors) act on our instructions under data-processing agreements:
| Provider | What for | Where |
|---|---|---|
| Stripe Payments Europe Ltd (Ireland) and Stripe, Inc. (USA) | Payments, subscriptions, invoices, fraud prevention (for which Stripe is also an independent controller) | EU, USA |
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting, database, file storage | EU data centres |
| Resend (Plus Five Five, Inc., USA) | Sending email | USA |
| Expo (650 Industries, Inc., USA) and Google (Firebase Cloud Messaging) | Delivering notifications | USA |
| Functional Software, Inc. (Sentry, USA) | Crash reports | EU region, USA |
| Google (Maps) | Showing the map of studios; Google is an independent controller for the map | USA |
| Apple and Google (sign-in) | Signing you in with your Apple or Google account; independent controllers | USA |
Others. Our accountants and lawyers where needed; public authorities when the law requires it; a buyer of our business, with notice to you.
We never sell your data and we do not share it with advertisers.
6. Transfers outside the EU
Our servers are in the European Union. Some providers listed above process data in the United States. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and otherwise on the Commission's standard contractual clauses, together with additional safeguards where needed. You can ask support@example.lu for a copy of the safeguards used.
7. How long we keep your data
See the table in section 4. When your account is closed we immediately delete your profile, saved payment methods, devices, favourites and sign-in links, and anonymise your name and email address. We keep invoices and payment records for 10 years as the law requires, a minimal record of bookings, fees and disputes for the time during which claims can be brought, and anonymised statistics. Data kept for those reasons is no longer linked to your name.
8. Marketing
You decide at sign-up, and at any time afterwards in Profile → Privacy & legal, whether you want news and offers by email and notification. The box is never pre-ticked. Every marketing email contains an unsubscribe link, and marketing notifications stop as soon as you switch the setting off. Messages about your bookings, payments and account are not marketing and continue while you have an account.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its use (including any processing based on our legitimate interests, and marketing at any time), to receive the data you gave us in a portable format, and to withdraw consent at any time without affecting what was done before.
- Correct your name and photo in the app under Profile.
- Request a copy of your data from Profile → Privacy & legal → Request a copy of my data (an email to support@example.lu from your account's address); we answer within one month.
- Delete your account in the app under Profile → Delete account, or at https://app.staging.luxapass.com/account/delete.
- Change your marketing choice under Profile → Privacy & legal.
- Anything else: support@example.lu.
We may ask you to confirm your identity through your account (for example with a sign-in code sent to your email address). We never ask for a copy of an identity document for this.
If you believe we handle your data unlawfully, you can lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, cnpd.lu, or with the authority of the EU country where you live.
10. Children
Aeva is for adults: you must be at least 18 to hold an account, and we ask you to confirm this. If we learn that an account belongs to someone younger, we close it and delete the data.
11. Cookies and app permissions
The website uses only the cookies needed to sign you in; the app uses no cookies and no analytics or advertising trackers. Details, including the software built into the app, are on the cookies page. The app asks for permissions (notifications, location, camera or photos for your profile picture) only when you use the feature that needs them, and works without them.
12. Security
Your data is stored encrypted at rest and transmitted over encrypted connections. Access within our team is limited to the people who need it for their work and is logged. Payment details are handled by Stripe, a certified payment provider, and never reach our servers. If a breach of security is likely to put your rights at risk, we tell you and the CNPD as the law requires.
13. Changes to this policy
We may update this policy when our service or the law changes. The version and date are shown at the top. If a change is significant, we tell you by email or in the app before it applies. Earlier versions are available on request.
14. Languages
This policy exists in English, French and Luxembourgish. [The lawyer is to decide which version prevails in case of divergence.]