Privacy Policy

Last updated: 10 October 2026

This policy explains how Good Moves Studio uses personal data in TapIn: the Good Moves app for iPhone and Android, the App Clip that opens when you tap your phone at reception, the web check-in, and the web app at tapin.goodmovesstudio.com/me. It covers what we use, why, who helps us, how long we keep it and your rights under the EU General Data Protection Regulation (GDPR). If anything here is unclear, write to us and we'll explain.

1. Who is responsible

GMS Good Moves Studio GmbH, Immanuelkirchstraße 24, 10405 Berlin, Germany ("Good Moves", "we", "us"). Write to us at hello@goodmovesstudio.com about anything in this policy or about your data.

We don't have to appoint a data protection officer, so your message goes straight to the people who run TapIn.

2. In short

• We use your data to run your stamps, rewards, bookings and payments, and to look after you and the studio.
• We don't sell your data, we don't show ads, and there are no advertising or tracking tools in TapIn.
• The companies that help us run TapIn get only what they need for their part (section 6).
• You can see, correct or delete your data at any time. Deleting takes one short form: tapin.goodmovesstudio.com/delete-my-data.

3. What we use, and why

For each use we give its legal basis under Article 6(1) GDPR: contract (b), when we need the data to give you what you signed up for; legal obligation (c); legitimate interest (f), when we have a good reason that doesn't outweigh your interests (you can object, see section 9); and consent (a), which you can withdraw at any time.

Your account

• Phone number (required). It's how we recognise you, how you sign in, and where we text your codes.
• First and last name. So that we, and your class bookings, know who you are.
• Email address (optional). For receipts, booking emails, reward emails and sign-in codes, and to find your studio account.
• Profile photo (optional, in the iPhone app and the web app). Shown in your app. It sits at a long, random web address that only our apps use.
• Your settings, and small notes that keep the app tidy, such as which one-time messages you have already seen, and the app version you use, so older versions keep working.

Legal basis: contract (Art. 6(1)(b)).

Stamps, rewards and gifts

• Your stamps. The date and time of each tap, where it came from (the app, the App Clip or the web check-in), and whether it's saved or confirmed. We confirm a stamp by matching it to your booking for that class. When they don't match, our team may check it by hand. We also look out for double taps and other misuse. The App Clip may ask your iPhone to confirm that a check-in happened at the studio: your iPhone only answers yes or no, we keep that answer with the stamp, and we never receive or store your location.
• Your rewards. Which rewards you use your stamps on, when you use or give them back, and each reward's code.
• Partner rewards. When you use a reward at one of our partners in the neighbourhood, their team sees your first name and the reward, and their list of uses shows your first name and the time.
• Gifts. When you give a reward to a friend, we make a link that you send yourself. Your friend sees your first name and any message you add, and confirms their number with a texted code to claim it. We don't tell you who claimed it.
• A class on us (and the welcome class for signing in to the app) is added as a credit to your account in the studio's booking system.
• Your wallet card. If you add your card to Apple Wallet or Google Wallet, it shows your name and your stamps. Google keeps a copy of a Google Wallet card on its servers. An Apple Wallet card stays on your phone, and Apple's push service tells it when to update.
• Thanking teachers. When you start with us at a class, we note which class and teacher it was, because our teachers get a thank-you for new members.

Legal basis: contract (Art. 6(1)(b)). Checking taps for misuse and thanking teachers: legitimate interest (Art. 6(1)(f)).

Your studio account, classes and bookings

The studio's schedule, bookings and passes run on Mindbody, our booking system. So that you can book and cancel in TapIn, see your passes and receive a class on us, we link your TapIn account to your account (or accounts) there. We look for it with your phone number, name and email address. To be sure an account is yours, we may send a code to its email address or ask you a question or two about it, and we keep your answers and the result. Once it's linked, TapIn reads your bookings, visits and passes, books and cancels classes for you, adds credits, and records what you buy in TapIn.

If you book your first class through our website, we set up a TapIn account with the details you gave there (your name, email address, phone number and the class), so that your first visit can earn a stamp. It stays closed until you show it's yours, for example with a texted code.

Legal basis: contract (Art. 6(1)(b)).

The live class widget

For a class you've booked, the app can show it on your Lock Screen (iPhone) or as a live notification (Android), from 30 minutes before it starts until 30 minutes after it ends: the class, the time, your teacher (with her photo, only if she has agreed), your first name and directions to the studio. Our server sends these details through Apple's or Google's push service, which delivers them to your phone, and keeps a short record for each class so that every update is sent once. Directions opens your maps app: we don't see where you are. You can switch the widget off in the app's settings or in your phone's settings.

Legal basis: contract (Art. 6(1)(b)), with your phone's permission for notifications and Live Activities.

Rating a class

After a class you were in, you can rate it from 1 to 5 stars and, if you like, add a note of up to 1,000 characters. Rating is always optional.

• What we keep: your stars, your note, the class (its name, date and time), its teacher, where you rated from (for example the widget) and when. It's linked to your account. There's one rating per class: rating it again replaces the first.
• Why: to learn how our classes feel to you, to keep making them better, and to give our teachers fair, useful feedback.
• The check: before we save a rating, we check that you were in the class: you tapped in for it, or you're on its booking list in Mindbody.
• Who sees it: the small team that runs the studio, with your name, in our internal staff tool. Teachers don't see ratings or notes in our tools. We may pass on what you wrote to a teacher in our own words, without your name.
• Please keep health details out of your note. If something about your body or health matters for class, tell your teacher directly. If you do mention your health in a note, we use it only to look after you and to improve the class, and we delete the note if you ask.
• How long: as long as you have a TapIn account. To change a rating, rate the class again. To delete one, write to us.

Legal basis: legitimate interest (Art. 6(1)(f)). You can object, or ask us to delete a rating, at any time.

Paying in the app

• Payments by card, Apple Pay or Google Pay are processed by Stripe. You enter your card details in Stripe's secure payment form and they go straight to Stripe: we never see your full card number.
• We keep a record of each purchase: what you bought, the amount and date, the card brand and its last four digits, Stripe's payment reference, and what we added to your studio account. Stripe keeps a customer record for you with your email address and phone number, for receipts and to keep your payments together.
• Stripe's payment form also tells Stripe how it's used (for example, which step failed), so that Stripe can keep it working and prevent fraud. During a card check (3D Secure), your bank may receive details about your device. For its own legal duties, such as preventing money laundering, Stripe is responsible for your data itself: see stripe.com/privacy.

Legal basis: contract (Art. 6(1)(b)). Keeping purchase records: legal obligation (Art. 6(1)(c)).

Signing in and keeping your account safe

• Codes. We send sign-in codes by text (through Twilio) or by email (through Resend).
• Your phone. When you sign in to an app with a code, we link that phone to your account with a sign-in token, and keep only a scrambled copy (a hash) of the token and of an identifier for your device. On iPhone, Apple's App Attest helps us check that the app is genuine. That way your account works on one phone at a time, and we notice when it moves to a new one.
• The web. For each web sign-in we keep your IP address and browser type, and a cookie keeps you signed in (section 8). A browser that confirmed your number at the web check-in is remembered for a year.
• Limits. To stop abuse, we limit how often a number or an internet address can try things, which keeps IP addresses briefly in memory.

Legal basis: contract (Art. 6(1)(b)) and legitimate interest in keeping accounts safe (Art. 6(1)(f)).

Messages we send you

• Texts: sign-in codes, a link to your card, and our answer to a problem you reported when we don't have your email address, through Twilio. Before texting a number we may check with Twilio that it can receive texts. No marketing texts.
• Emails: receipts, booking confirmations and cancellations, reward and gift emails, a reminder before a reward runs out, sign-in codes, a link to confirm your email address and our answers to problems you report, through Resend. No newsletters from TapIn.
• Push notifications, if you allow them: your stamps and rewards, reminders, your bookings, and important changes to TapIn. Apple's and Google's push services deliver them. You can turn them off in your phone's settings at any time.
• Our message log: we keep a short record of each text, email and push we send (the kind, who it went to, the subject, the first 200 characters and whether it went out) for 90 days, so we can help when something doesn't arrive.

Legal basis: texts and emails, contract (Art. 6(1)(b)); push notifications, your consent through your phone's permission (Art. 6(1)(a)); the message log, legitimate interest (Art. 6(1)(f)).

Ideas and requests

In the iPhone app and the web app you can share an idea for the studio, with photos or files if you like, and vote for other members' ideas. Ideas we publish are shown without your name, even to our team, and attachments only to our team. We keep who shared an idea so that you can see your own. Votes are counted, never shown with names. Legal basis: contract (Art. 6(1)(b)).

Reporting a problem

When you report a problem in the app, the web app or the web check-in, we keep what you write, what it's about, the screen you were on, the app version and your phone model (on the web, your browser), a picture of the screen if you add one, and what our server recorded for your account in the day before you sent it, such as a booking that didn't go through, a payment or a check-in. We use it to fix the problem and to reply to you: by email from hello@goodmovesstudio.com, or by text if we don't have your email address. Only the studio team sees it, in our internal staff tool and our studio inbox. Our team chat gets a short note that a report came in, without your name or what you wrote. We keep it until you delete your account. Legal basis: contract (Art. 6(1)(b)), and legitimate interest in fixing what went wrong (Art. 6(1)(f)).

Fixing problems and improving TapIn

• Error reports. When something goes wrong on our server, Sentry receives a technical report so we can fix it. Phone numbers, email addresses and sign-in details are removed before it's sent.
• Server logs. Our hosting keeps logs of requests, including IP addresses, for up to 30 days, for security and to fix problems.
• Totals from our own records. We look at totals from data we already keep, such as how many check-ins come from the app, the App Clip or the web, how many members use the app, which rewards are used and how classes are rated. Staff and test accounts are left out. Apart from Stripe's payment form (above), TapIn has no third-party analytics or advertising tools, and we don't build profiles of you for advertising.

Legal basis: legitimate interest (Art. 6(1)(f)).

Our team's tools

• The studio's team sees your TapIn account in our internal staff tool, which only staff can sign in to, to help you, check stamps, link accounts and give refunds. What staff change on your account is logged.
• Alerts about payments or bookings that need a person, and a daily list of Monthly Unlimited members with their bookings, go to our team chat (Slack). Payment alerts carry no names, phone numbers or email addresses.

Legal basis: legitimate interest (Art. 6(1)(f)).

Which rewards you look at

Under Use your stamps, the app and the web app show a couple of rewards picked at random. We record which rewards we showed you there and which rewards you open, with the screen, whether it was the app or the web, and the time, linked to your account. We use it to learn which rewards members like, so we can choose better rewards and partners, and our team can see what interests you on your page in our staff tool. We keep these records for 90 days. Legal basis: legitimate interest (Art. 6(1)(f)). You can object at any time: write to us and we'll stop recording it for your account.

How the live class widget is used

We count how often the widget is opened, Directions is tapped, a star is tapped, and the widget is swiped away or switched off, for each class and day. We keep only the totals, never who did what, and staff and test accounts aren't counted. Legal basis: legitimate interest (Art. 6(1)(f)).

If you work at one of our partners

To sign in to your partner page we email a code to your work address, and we keep that address, your IP address and browser type with your sign-in for up to 180 days. Legal basis: legitimate interest in running the partnership with your business (Art. 6(1)(f)).

4. What you need to give us

You need a phone number to use TapIn, and your name to book classes and match your stamps. Everything else is up to you. Without an email address you won't get receipts or reward emails. Without a linked studio account, booking in the app and a class on us can't reach you.

5. Age

TapIn is for adults (18 and over).

6. Who helps us, and where your data goes

Each company gets only what it needs for its part. They work for us under data processing agreements (Article 28 GDPR), except where we say they're responsible themselves.

• Railway (hosting and our database): our servers are in the Netherlands (EU). Railway Corporation is based in the USA.
• Mindbody (the studio's booking system): Mindbody, Inc., USA.
• Stripe (payments): Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA. Stripe is also responsible itself for its own legal duties.
• Twilio (texts, sign-in codes and number checks): Twilio Inc., USA.
• Resend (email delivery): USA.
• Apple (push notifications, Live Activities, Apple Wallet, App Attest and the App Clip): Apple Distribution International Ltd., Ireland, and Apple Inc., USA.
• Google (notifications on Android through Firebase Cloud Messaging, Google Wallet, and our team's email): Google Ireland Limited and Google LLC, USA.
• Sentry (error reports): stored in Germany. Sentry (Functional Software, Inc.) is based in the USA.
• Slack (our team chat): USA.

Others see a little, because you ask them to: a partner whose reward you use (your first name and the reward), and a friend you send a gift to (your first name and your message). We don't sell your data or give it to advertisers.

Outside the EU. Where data goes to the USA, it's protected by the EU-U.S. Data Privacy Framework for companies certified under it, and otherwise by the European Commission's Standard Contractual Clauses (Article 46 GDPR). Write to us for a copy.

7. How long we keep it

• Your account and everything in it (stamps, rewards, gifts, bookings, purchases recorded in TapIn, ratings and notes, ideas, problem reports and their pictures, profile photo, wallet card and settings): until you delete your account.
• The copy of your ratings in our staff tool: removed within 48 hours after yours.
• Our message log: 90 days.
• Live class widget: the tokens that update a widget on your phone, a day after the class. Our record of which updates we sent stays with your account.
• Sign-in: codes expire after 10 minutes. A web sign-in lasts up to 30 days, or 14 days without use.
• Error reports: up to 90 days at Sentry. Server logs: up to 30 days.
• What the law makes us keep: the studio's accounting records of purchases, for up to 10 years (German tax and commercial law). Stripe and Twilio keep their own records for as long as their legal duties require.
• When you delete your account: at once (section 9).

8. Cookies and storage on your device

Our web pages use only the cookies they need to work, so there's no cookie banner:

• tapin_web_session keeps you signed in to the web app (up to 30 days).
• tapin_trusted_browser remembers that this browser confirmed your number at the web check-in (up to a year).
• tapin_csrf protects our forms from misuse.
• tapin_merchant_session keeps a partner's team signed in to their partner page (up to 180 days).
• A short session cookie carries a one-off message from one page to the next.

The web check-in also remembers your number and name in your browser, so you don't have to type them each time, and whether you closed the app banner. Clearing your browser's data removes them. The apps keep your sign-in, number and settings on your phone. We store and read these only because the service you asked for needs them (§ 25(2) No. 2 TDDDG, the German law on device storage). There are no advertising or analytics cookies.

9. Your rights

You can ask us at any time to:

• show you the data we hold about you and give you a copy (Art. 15), also in a format you can take elsewhere (Art. 20);
• correct anything that's wrong (Art. 16);
• delete your data (Art. 17), see below;
• limit how we use it while something is being checked (Art. 18);
• stop using it where we rely on legitimate interest, for reasons arising from your situation: this is your right to object (Art. 21);
• withdraw a consent you gave, such as for push notifications, for the future (Art. 7(3)).

Write to hello@goodmovesstudio.com. We'll answer within a month.

Deleting your data. Use tapin.goodmovesstudio.com/delete-my-data, or Account & privacy in the iPhone app. We text you a code to make sure it's you, then delete your TapIn account and everything in it at once, including your ratings and notes. The copy of your ratings in our staff tool goes within 48 hours. This doesn't close your account in the studio's booking system, and it doesn't delete records that Stripe or the studio must keep by law. If you'd like your studio account closed too, just ask.

Complaints. You can complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, mailbox@datenschutz-berlin.de. You can also go to the authority where you live or work.

We don't make decisions about you by automated means that have legal or similarly significant effects (Art. 22).

10. Changes to this policy

When we change something important, we'll tell you in the app or by email before it applies. The date at the top always shows the current version.