← Back

Privacy Policy

Last updated: 1 May 2026

1. Introduction

This Privacy Policy explains how Class Cobra ("we", "us", "our") collects, uses and protects personal data when you use the Class Cobra platform (the "Platform"). We are committed to protecting your privacy and complying with the UK GDPR and Data Protection Act 2018.


2. Who we are

Class Cobra is the data controller for personal data processed in connection with our platform subscription accounts (Club owners) and for limited data processed in connection with end-Member accounts. For data processed on behalf of a Club about its Members, the Club is the data controller and Class Cobra acts as the data processor.


3. What data we collect

Club owners (account holders)

  • Name, email address, phone number
  • Club details (name, address, branding)
  • Billing details (handled by Stripe — we do not store full card numbers)
  • Login credentials and session data

Members (people enrolled with a Club)

  • Name and (where applicable) parent/guardian name
  • Date of birth
  • Contact details (email, phone, address)
  • Emergency contact information
  • Medical conditions, allergies and accommodations (provided voluntarily by you or your guardian)
  • Photo permission preferences
  • Class enrolment and attendance records
  • Payment history (processed via Stripe)
  • Communications history (emails sent to you)

Automatic data

  • Device and browser information
  • IP address and approximate location
  • Cookies and similar technologies (see our cookie banner)
  • Pages visited and actions taken on the Platform


4. How we use your data

We process personal data on the following lawful bases:

  • Contract — to provide the Platform to Clubs and to deliver booking, payment and communication services to Members.
  • Legitimate interests — to operate, secure and improve the Platform; to detect fraud; to send service-related announcements.
  • Legal obligation — to keep records required by tax, accounting or other applicable laws.
  • Consent — for non-essential cookies and for marketing communications, where applicable. You can withdraw consent at any time.


5. Children's data

Where a Member is under 18, the account is created and managed by a parent or legal guardian who provides any personal data on behalf of the child. Health and medical information about children is treated as special-category data and processed only where necessary for the Club to safeguard the child during activities, with explicit consent from the parent/guardian. We comply with the ICO's Age Appropriate Design Code.


6. Sharing your data

We share personal data only where necessary:

  • With your Club — Members' data is shared with the Club they have signed up to, which uses it to deliver classes and communicate with the Member.
  • With service providers — Stripe (payments), Brevo (transactional email), AWS (hosting). All providers are bound by contract to protect your data.
  • With authorities — where required by law, court order or to protect our rights or those of others.

We do not sell personal data to anyone.


7. International transfers

Some of our service providers are based outside the UK. Where personal data is transferred internationally, we rely on UK-approved safeguards such as Standard Contractual Clauses or adequacy decisions to ensure your data remains protected.


8. How long we keep your data

We keep personal data only as long as needed for the purposes described:

  • Active accounts: for the lifetime of the account
  • Closed accounts: typically 30 days, then deleted or anonymised
  • Payment and tax records: 6 years (UK statutory requirement)
  • Communications history: up to 2 years


9. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion ("right to be forgotten") subject to legal exceptions
  • Object to or restrict processing
  • Request a portable copy of your data
  • Withdraw consent (where consent is the lawful basis)
  • Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email support@classcobra.com. If your request relates to data held by your Club, we may pass it to the Club to action.


10. Security

We use industry-standard security measures including TLS encryption, encrypted databases, role-based access control, and regular backups. Payment data is handled by Stripe (PCI-DSS Level 1). No system is 100% secure, however; if a breach affecting your data occurs we will notify you and the regulator as required by law.


11. Cookies

The Platform uses essential cookies required for login and core functionality, and optional analytics cookies with your consent. You can manage your cookie preferences via the "Manage cookies" link in the footer at any time.


12. Marketing

We do not send marketing emails to Members on behalf of Clubs without the Member's opt-in. Each Club is responsible for the content and consent basis of marketing communications it sends through the Platform. You can opt out at any time using the unsubscribe link in any email.


13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date at the top. Where changes are material we will notify you by email or in-app banner.


14. Contact us

For any privacy-related question, contact us at support@classcobra.com