1. Controller and scope
The Provider identified above is the controller for visitors, prospective customers, studio owners and staff, and for contract, billing and support data. Personal-data requests should use the formal contact above.
For students, people making bookings and studio contacts, the studio is the controller. Mesana processes their data on the studio’s instructions under the DPA. Students should contact their studio for information and requests concerning their data; Mesana assists the studio.
2. Website browsing
Website requests may include IP address, device, browser, requested page, date, time and referrer. They are used to deliver and protect the site and prevent abuse, based on the legitimate interest in operation and security. Technical data is retained as needed for these purposes and incident investigation, according to hosting-service settings.
The public website does not embed third-party browser tracking, profiling or analytics tools. Dismissing the cookie notice stores a browser preference. The app uses technical mechanisms necessary for authentication and operation; the cookie page describes the public website’s choices.
3. Enquiries, registration and trial
We process names, email addresses, studio names, form details and enquiry content to respond, verify email, activate trials and manage the pre-contractual relationship. The legal basis is taking steps requested by the data subject before a contract (GDPR Article 6(1)(b)). Data is kept to handle the request and resulting relationship, with further retention only as needed for legal obligations or the defence of rights.
4. Contract and billing
We process Customer identity and contact details, tax details and billing address, plan, subscription history, payment outcomes and partial payment-method details available from the provider. Purposes are contract performance, billing, accounting and tax obligations, and disputes. Legal bases are contract, legal obligation and legitimate interest in defending rights (GDPR Article 6(1)(b), (c) and (f)).
Accounting and tax records are retained for periods required by applicable law; data needed for disputes may be kept until they are resolved. Mesana does not store full card details, which Stripe handles. The studio’s sales to students are separate from this subscription.
5. Access, security and support
For owners and staff we process names, email addresses, roles, hashed credentials, session data and activity records. They support authentication, authorisation, operation and traceability, for contract performance and security (GDPR Article 6(1)(b) and (f)). Accounts follow the studio’s authorisation; logs are kept for security, incident investigation and defence of rights, without commercial profiling.
Support requests include contact details, content and technical information necessary to resolve them. Administrative access to studio data for support is restricted to authorised personnel and recorded. Support data is kept to handle the request and document its outcome, subject to legal obligations or disputes.
6. Communications and automated decisions
Service communications, such as email verification, security, expiry and billing notices, are necessary for the relationship or legal obligations (GDPR Article 6(1)(b) and (c)). They are not promotional messages. Any marketing use requires the applicable legal basis and an opportunity to object or withdraw consent; these purposes are not a condition of using the service.
No decisions based solely on automated processing with the effects covered by GDPR Article 22 are made. Operational authentication, payment, availability and abuse checks apply the service rules; the Customer can request assistance. Optional AI-assisted import proposes an outcome for review and confirmation: it does not apply data autonomously.
7. Recipients, providers and transfers
Technical services include Neon for the database, Render for the application and jobs, Vercel for the interface and website, and Brevo for transactional emails when enabled. Stripe handles subscription payments and billing in its respective role; student payments are handled for the studio. Accountants, tax and legal advisers and competent authorities may also receive necessary data within their respective roles and limits.
The database and application server are configured in the Frankfurt region; web delivery uses a global network. Access or processing from countries outside the European Economic Area requires the safeguards under GDPR Chapter V. The operational list and optional functions are described in DPA Annex III. Information about safeguards actually applicable can be requested through the formal contact.
8. Providing data and your rights
Details marked as mandatory are necessary for registration, contract performance or billing; without them the relevant operation cannot be completed. Data for optional purposes remains optional.
Where applicable you may request access, rectification, erasure, restriction, portability and objection, and withdraw consent without affecting earlier lawful processing. Write to the formal contact. The GDPR period is one month, extendable by two months for complex requests with reasons communicated. You may complain to the Italian Garante, the Spanish Agencia Española de Protección de Datos or the competent authority in your country, and seek a judicial remedy.
9. Security and updates
Measures include protection of web traffic, hashed password storage, role- and organisation-based access controls, and records of administrative access. DPA Annex II describes verifiable technical measures. This notice may be updated; material changes are communicated to customers and the current version remains available on this page.