Last updated: October 2026
FullClass™ is operated by DevShop Software Inc., a corporation incorporated under the laws of the Province of Alberta, Canada ("FullClass," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you use our Service, and the choices you have with respect to your information.
This policy is designed to comply with applicable privacy laws in the jurisdictions where we operate, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), the California Consumer Privacy Act (CCPA/CPRA) for California residents, the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, and New Zealand's Privacy Act 2020. Where a specific section applies only to users in a particular jurisdiction, that is noted.
This Privacy Policy explains how we collect, use and share personal information when you use the Service. If you do not agree with it, please do not use the Service.
We have designated a Privacy Officer who is responsible for overseeing our compliance with applicable privacy laws. For all privacy-related inquiries, requests, or complaints, please contact our Privacy Officer at:
Privacy Officer
FullClass
Email: [email protected]
We will acknowledge receipt of your inquiry within 5 business days and respond substantively within 30 days, or within the timeframe required by applicable law.
We collect personal information that you voluntarily provide when registering for or using the Service, including:
When you access and use the Service, we automatically collect:
The Service is designed for businesses that sell spots to classes and similar scheduled sessions. It does not ask for, and we do not intentionally collect, sensitive personal information (in the EU and the UK, the special categories of personal data). If a business words a booking question, note or other document so that its customers may provide such information, it does so on its own initiative and is responsible for having a lawful basis to collect it and for telling its customers how it will be used. We process such information only as part of the text concerned, on that business's behalf.
We use the information we collect only for the purposes for which it was collected, or as otherwise permitted by law. Specifically, we use your information to:
We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human review.
Your subscription payments to us. We use Stripe, Inc. to process the subscription fees you pay for access to the platform. Your full credit or debit card number is transmitted directly to Stripe and is never stored on our servers. We store only a tokenized reference provided by Stripe and the card brand and last four digits for display in your billing settings. Stripe's handling of your payment data is governed by the Stripe Privacy Policy.
Payments you collect from your own customers. When you connect a payment provider (Stripe or Square) to take bookings and other payments from your customers through the platform, those payments are processed by the provider you connect, under its own privacy policy and terms. Your customers' full card numbers are transmitted directly to that provider and are never stored on our servers; we retain only non-sensitive transaction metadata (such as the card brand, last four digits, and a provider reference) needed to display, reconcile, and report on bookings. Square's handling of payment data is governed by the Square Privacy Policy.
We do not sell, rent, or trade your personal information. We do not share your personal information with third parties for their own marketing purposes. We may share your information only in the following limited circumstances:
A business can add its Google Ads conversion ID and conversion label in its FullClass tracking settings. When set, the booking widget loads Google's tag (gtag.js) in the visitor's browser and fires a conversion event when a booking is completed, so the business can measure how its ads perform. This is a standard browser-side advertising tag, controlled by the business that enabled it.
FullClass does not connect to, sign in to, read, or modify the business's Google Ads account, and stores no Google credential or authorization token for advertising. The tag is served by Google and may set cookies on visitors' devices, subject to the visitor's consent choices and to Google's own policies. A business can remove the conversion ID and label at any time in its tracking settings to stop the tag from firing.
Where the business has turned on Google's "Enhanced Conversions" for its conversion, the tag may also send Google a hashed version of the customer's email address and, when available, phone number and name, so Google can match the conversion to an ad interaction. This data is hashed (SHA-256) in the customer's own browser before it is sent, so the raw values are not transmitted, and its use is governed by the business's Google Ads settings and Google's policies.
A business's owner, or a team member the owner has given access to Reports, can connect an AI assistant such as ChatGPT or Claude to the business's FullClass account. Connecting requires their FullClass sign-in and an explicit approval on a FullClass consent screen, and gives the assistant read-only access to that one business's reporting data. A business can instead use a secret API key it creates in its settings.
When the assistant asks, FullClass sends it the business's reporting data: class and event names, schedules, locations, instructor names, capacity and spots booked, booking, cancellation and attendance counts, and revenue totals. It does not send customer names, email addresses, phone numbers or payment details, and the assistant cannot book, cancel, refund, send email or change anything. The data is sent on the business's instruction to the provider the business chose, and once received it is governed by that provider's own terms and privacy policy.
We keep a record of each connection, including who approved it, which app it is for and when, and the business's activity log records each approval and revocation. For each request we log the tool used, the business and the time, but never the question asked. A connection lasts until it is revoked or goes unused for 90 days, and its record is deleted a day after it can no longer be renewed. The business can see and revoke its connections at any time in Settings, Connected apps, and a connection stops working as soon as the person who approved it is deactivated or loses access to Reports.
We implement appropriate technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS), access controls, and regular security reviews.
Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at [email protected].
In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and any applicable regulatory authority as required by law. For Canadian users, this includes notification to the Office of the Privacy Commissioner of Canada under PIPEDA, and to the Commission d'accès à l'information (CAI) under Quebec Law 25. For US users, we will comply with applicable state breach notification laws.
For people in the EEA, the UK and Switzerland, where we are the controller of your data, we notify the competent data protection authority, and you where the law requires it, within the time limits set by the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. Where we process data on a studio's behalf, we notify that studio promptly, as our Data Processing Agreement sets out, so that it can meet its own obligations. For people in New Zealand, we notify the Office of the Privacy Commissioner and the people affected of a notifiable privacy breach under the Privacy Act 2020.
Notification will be provided in a timely manner by email or through our platform, and will include the nature of the breach, the type of information involved, and steps you can take to protect yourself.
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. In practice:
When data is no longer required, we will securely delete or anonymize it. You may request earlier deletion of your personal data subject to our legal retention obligations (see Section 11).
We use cookies and similar tracking technologies (such as session tokens) to operate the Service and enhance your experience. Specifically, we use:
The FullClass admin application itself sets only strictly necessary cookies; it does not set analytics or advertising cookies. Our public marketing website sets no cookies at all and stores nothing on your device. You can control or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using the Service.
Our public marketing website (fullclass.io) uses a privacy-friendly analytics service to count visits and to see which pages people read and which sources they arrive from. We use this only to understand how our own website is performing.
This service is cookieless. It sets no cookies, stores nothing on your device, does not track you across other websites, and does not build a profile of you. The reports we receive are aggregated counts that contain nothing identifying you individually. Your IP address is processed only momentarily to estimate a country and is not retained by us. Because no information is stored on or read from your device, this measurement does not require a cookie consent banner. Where data protection law requires a legal basis, we rely on our legitimate interest in understanding and improving our website.
This applies to our marketing website only. It is separate from the analytics or advertising integrations that a business may enable on its own booking page, which are described in Section 10 above.
Subject to applicable law, you have the following rights regarding your personal information. To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days, or within the timeframe required by applicable law.
You have the right to access your personal information and to challenge our compliance with PIPEDA by contacting the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Quebec residents have additional rights under Law 25, including the right to de-indexing (removal from search results) and automated decision-making review, and may lodge complaints with the Commission d'accès à l'information at www.cai.gouv.qc.ca.
California residents have the following additional rights under the CCPA/CPRA:
To submit a CCPA request, contact us at [email protected]. We will verify your identity before processing your request and will respond within 45 days (extendable by a further 45 days with notice).
Residents of Virginia, Colorado, Connecticut, Texas, and other US states with applicable privacy laws may have similar rights to access, correct, delete, and port their personal data, and to opt out of certain processing. Contact us at [email protected] to exercise these rights.
You have the right to access the personal information we hold about you and to ask us to correct it. If you are not satisfied with how we handle a request or a concern, you may complain to the Office of the Privacy Commissioner at www.privacy.org.nz.
Who is responsible for your data depends on your relationship with FullClass. If you book with, buy from, or sign a waiver for a studio that uses FullClass, that studio is the controller of your data and FullClass processes it on the studio's behalf under our Data Processing Agreement. To exercise your rights over that data, contact the studio; we will help it respond. For studio owners' and staff accounts, billing, support and visitors to our website, DevShop Software Inc. is the controller.
Where we are the controller, we rely on these legal bases:
In addition to the rights listed above, you may ask us to restrict how we process your data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
FullClass is established in Canada, which the European Commission, the UK and Switzerland recognize as providing adequate protection for personal data handled by commercial organizations. Our servers and several of our service providers are in the United States; those transfers are protected by the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss adaptations, or by an equivalent safeguard. The service providers that process customer data are listed on our sub-processors page.
We have appointed Data Protection Representative Limited (trading as DataRep) as our data protection representative in the EU and EEA (under the GDPR), in the UK (under the UK GDPR) and in Switzerland (under the Federal Act on Data Protection). If you are in one of those places, you can contact us about your personal data through DataRep instead of writing to us in Canada:
Address letters to “DataRep”, not to FullClass, or they may not reach DataRep, and name FullClass in your letter. DataRep handles data protection matters only. For questions about a booking or about the Service, write to the studio or to us.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe the infringement took place. In the UK this is the Information Commissioner's Office, and in Switzerland the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first, so please contact us.
We will not charge a fee for reasonable requests. We may need to verify your identity before fulfilling your request. If we deny your request, we will explain why and, where applicable, provide information about how to appeal our decision.
Your information may be transferred to and processed in countries other than your country of residence, including Canada, where FullClass is established, and the United States, where our servers and several of our service providers are located. These countries may have different data protection laws than your own jurisdiction. Where we transfer personal data internationally, we take appropriate steps to ensure that your information is protected in a manner consistent with this Privacy Policy and applicable law, including the safeguards described in Section 11 for people in the EEA, the UK and Switzerland.
The Service is directed to businesses. We do not knowingly collect personal information directly from anyone under 18. When a parent or legal guardian books a child into an Operator's activity, the Operator may ask them for the child's name and their age on the day of the activity (never a date of birth); we process that information on the Operator's behalf, to identify the child and to record the parent or guardian's consent to the Operator's waiver. If you believe a child has given us personal information themselves, please contact us at [email protected] and we will take steps to delete that information.
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or by prominently posting a notice within the Service at least 30 days before changes take effect (or as otherwise required by applicable law). The "Last updated" date at the top of this page indicates when this policy was last revised. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.
For all privacy-related questions, requests, or complaints, please contact our Privacy Officer at [email protected]. General support inquiries can be directed to [email protected].