Privacy Policy

Mumokshu Pty Ltd ([ABN pending — contact legal@mumokshu.com]) ("Mumokshu", "we", "us", or "our") operates the $mumokshu.com platform — a global two-sided marketplace connecting students with certified yoga, pilates, fitness, and wellness teachers.

We are an Australian-based company headquartered in Sydney, New South Wales. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with the Australian Privacy Act 1988 (including the Australian Privacy Principles), the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), the India Digital Personal Data Protection Act 2023 (DPDPA), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy applies to our website, mobile applications (iOS and Android), APIs, and all related services regardless of how you access them.

By using our platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

Account Information

When you create an account we collect your name, email address, phone number, and optional profile photo. Teachers additionally provide qualifications, certifications, business information, and bank account details (securely via Stripe Connect).

Payment Information

All payments are processed by Stripe, which is PCI DSS Level 1 compliant. We never see, access, or store your credit/debit card numbers. Stripe and Razorpay handle all card data securely on our behalf.

Booking Data

We record classes you attend, the teachers you book with, session times, and booking status so we can provide confirmations, reminders, and your booking history.

Wellness Data

Your Wellness Score and activity history are computed from your platform usage. This data is visible only to you and is never shared with teachers, other users, or third parties.

Usage Data

We may collect anonymised analytics such as pages visited and features used to improve the platform. If Vercel Analytics is enabled, it collects aggregated, non-personally-identifiable data.

Communications

Support tickets, in-app messages, and reviews you submit are retained to provide customer service and maintain platform integrity.

Teacher-Specific Information

Teachers provide professional qualifications, certifications, teaching experience, ABN/business registration, and payout bank details. Bank details are collected and stored exclusively by Stripe Connect — we do not have access to full account numbers.

Mobile App Data

When you use our mobile applications, we may additionally collect:

• Device information: device model, operating system version, unique device identifiers, and app version
• Push notification tokens: used solely to deliver class reminders, booking confirmations, and account alerts. You can disable push notifications at any time via your device settings.
• Biometric authentication: if you enable Face ID or fingerprint login, biometric data is processed entirely on your device by Apple/Google — we never receive, transmit, or store biometric data
• Offline cached data: your recent bookings and class details may be stored locally on your device for offline access. This data is encrypted at rest and deleted when you log out.
• Location data: only if you explicitly grant permission, used to show nearby classes. Never shared with third parties or stored on our servers beyond search context.

• Provide services: process bookings, facilitate payments, deliver class confirmations and reminders.
• Improve the platform: AI-powered teacher matching, analytics, and feature development — using your data to help you.
• Communications: transactional emails (booking confirmations, receipts), SMS notifications (via Twilio), and marketing communications only with your explicit consent.
• Safety & security: fraud detection, abuse prevention, and enforcement of our Terms of Service.

We use artificial intelligence to enhance your experience on Mumokshu:

• Teacher Matching: our AI analyses your booking history, preferences, and activity to recommend teachers and classes tailored to your goals.
• Wellness Score: computed from your activity data (classes attended, consistency, variety). This score is visible only to you and is designed to motivate, not judge.
• Year in Review: an annual summary of your wellness journey. You have full control over whether any part of this summary is shared publicly.

Opt-out: you can disable AI personalisation at any time from your account settings. This will not affect the core functionality of booking and attending classes.

We share personal information only in the following limited circumstances:

Between Users

• Teachers see: student name and booking details (date, time, class). Teachers do not see your phone number or email address unless you choose to share them.
• Students see: teacher profile, ratings, reviews, and listed qualifications.

Service Providers

• Stripe: payment processing (PCI DSS compliant). Card data is handled entirely by Stripe.
• Twilio: receives your phone number solely for the purpose of sending SMS notifications (booking confirmations, reminders).
• Supabase / AWS: database hosting and infrastructure.

Legal Requirements

We may disclose information when required by law, regulation, or legal process — for example, in response to a court order or lawful request by government authorities.

• Data is hosted on Supabase (built on AWS infrastructure) with servers in secure, SOC 2-compliant data centres.
• All data is encrypted at rest and in transit using TLS 1.3.
• Row-Level Security (RLS) is enforced at the database level, ensuring users can only access their own data.
• We conduct regular security audits and follow industry best practices for application security.
• Access to production systems is restricted to authorised personnel with multi-factor authentication.

Australian Privacy Act

Under the Australian Privacy Principles (APPs), you have the right to access your personal information, request corrections, and complain about breaches of the APPs.

GDPR Rights (EU/EEA Users)

If you are located in the EU/EEA, you have the right to:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restrict processing — limit how we use your data.
• Object — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

CCPA Rights (California Residents)

If you are a California resident, you have the right to:

• Know — what personal information we collect, use, and disclose.
• Delete — request deletion of your personal information.
• Opt-out of sale — we do not sell personal information, so this right is automatically satisfied.
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
• Limit use of sensitive data — you can request we limit the use and disclosure of your sensitive personal information.

To exercise any of these rights, email us at privacy@mumokshu.com or use the account deletion feature in your dashboard settings. We will respond within 45 days.

UK GDPR Rights (United Kingdom Users)

If you are located in the United Kingdom, you have the same rights as EU/EEA users under the UK General Data Protection Regulation (UK GDPR). You may also lodge a complaint with the Information Commissioner's Office (ICO).

DPDPA Rights (India Users)

If you are located in India, under the Digital Personal Data Protection Act 2023 (DPDPA), you have the right to:

• Access — obtain a summary of your personal data and processing activities.
• Correction & Erasure — request correction of inaccurate data or erasure of data no longer necessary.
• Grievance Redressal — raise grievances with our Data Protection Officer.
• Nomination — nominate another individual to exercise your rights in case of death or incapacity.
• Withdraw Consent — withdraw consent for processing at any time, subject to legal obligations.

PIPEDA Rights (Canada Users)

If you are located in Canada, under PIPEDA, you have the right to:

• Access — know what personal information we hold about you.
• Correction — challenge the accuracy and completeness of your information.
• Withdraw Consent — subject to legal or contractual restrictions, withdraw consent for collection, use, or disclosure.
• Complain — file a complaint with the Office of the Privacy Commissioner of Canada.

How to Exercise Your Rights

To exercise any of these rights, email us at privacy@mumokshu.com. We will respond within 30 days (or sooner where required by applicable law). We may ask you to verify your identity before processing your request.

We use a minimal set of cookies:

We do not use any third-party advertising or tracking cookies.

You can manage cookies in your browser settings. Disabling essential cookies may prevent you from signing in. For more information, visit allaboutcookies.org.

Mumokshu is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

Minors aged 13–17 may use the platform with parental or guardian consent. Parents or guardians are responsible for managing their child's account and bookings.

As a global platform, your data may be processed in multiple jurisdictions, including:

• Australia — our primary place of business.
• United States — Supabase (AWS infrastructure) and Stripe payment processing.

Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

You may request deletion of your personal data at any time by emailing privacy@mumokshu.com. Some data may be retained where required by law (e.g., financial records for tax purposes).

We may update this Privacy Policy from time to time. For material changes, we will notify you via email and/or a prominent notice on our platform at least 30 days before the changes take effect.

Continued use of Mumokshu after the updated policy becomes effective constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant regulatory authority:

• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• EU: your local Data Protection Authority.
• California: Office of the Attorney General — oag.ca.gov/privacy