Privacy policy

Last updated 2 November 2026

Project Book is booking software for Pilates and boutique fitness studios. This policy explains what personal data Project Book handles, why, and the choices you have. It covers this website, the Project Book booking app and the services that come with it.

Project Book is run by Keith O’Loughlin, Dublin, Ireland. You can contact us at hello@projectbook.ie.

Two kinds of people, two roles

Studios that use Project Book. For studio owners and staff, Project Book decides how your account data is used, so we are the data controller for it.
Clients of those studios. When you book with a studio that uses Project Book, the studio is the data controller for your details. Project Book stores and processes them on the studio’s behalf, as its data processor, and only on its instructions. Questions about your bookings, credits or health information are best sent to your studio first; we will help them answer.

What we collect

Studio accounts: names, email addresses and phone numbers of owners and staff, studio details (name, address, VAT number, logo and colours), billing details, and records of how the account is set up.

Studio clients (on the studio’s behalf):

Name, email, phone, and any address or next-of-kin details you choose to give.
Bookings, attendance, waitlist places, class packs, credits, vouchers, invoices and payment records.
Answers to the studio’s intake and health forms, including any injuries or medical conditions you tell the studio about. This is sensitive information. It is shown only to the studio’s staff and teachers so they can teach you safely.
Notes the studio adds to your profile, and messages and emails the studio sends you.
If you call a studio that uses the Project Book phone receptionist: your phone number, what you say during the call (as a text transcript) and a short summary emailed to the studio. Calls are not recorded as audio.
Video rentals and what you watch, if the studio offers on-demand classes.

Sign-in: if you choose Continue with Google, Google shares your name, email address and profile picture with us. We do not get your Google password or access to anything else in your Google account.

This website: we do not use advertising or tracking cookies here. Our hosting provider keeps standard server logs (such as IP address and pages requested) for security.

Why we use it

To run bookings, payments, waitlists, courses and the other features a studio switches on (contract, or the studio’s legitimate interest in running its business).
To send booking confirmations, reminders, receipts and service messages (contract).
To send marketing emails, only where the studio has your permission or another lawful basis, and always with a way to unsubscribe.
Health and injury answers are used only so your teacher can keep you safe in class, based on your explicit consent when you fill in the form.
To keep the service secure, prevent fraud and meet tax and accounting rules (legal obligation and legitimate interests).

We do not sell personal data, and we do not use a studio’s client data for our own marketing.

Who we share it with

We use carefully chosen providers to run Project Book. They only process data to provide their service to us:

Supabase: database, sign-in and file storage.
Vercel: hosting for the website and app.
Stripe: card payments. Card details go straight to Stripe and are never stored by Project Book.
Resend: sending emails.
Twilio: phone calls for the receptionist feature.
Anthropic: the AI that powers the phone receptionist, the website chat and the Ask Studio assistant.
Bunny.net: hosting and streaming on-demand class videos.
Google: sign-in, if you choose Continue with Google.

Some of these providers are based in or process data in the United States. Where data leaves the European Economic Area it is protected by the EU Standard Contractual Clauses or another approved safeguard.

How long we keep it

Studio client data is kept for as long as the studio uses Project Book, or until the studio deletes it. Invoices and payment records are kept for six years to meet Irish tax rules. When a studio leaves Project Book, we return its data on request and delete it within 90 days, apart from records we must keep by law.

Your rights

You can ask to see, correct, export or delete your personal data, ask us to restrict or stop using it, and withdraw consent at any time. If you are a studio’s client, contact the studio first, as it decides what happens to your data; you can also write to us and we will pass it on. You also have the right to complain to the Data Protection Commission in Ireland (dataprotection.ie).

Security

Data is encrypted in transit and stored with access limited to each studio’s own staff. Studios only ever see their own clients. Staff access is controlled by role, and sensitive actions are logged.

Changes

If we change this policy in a way that matters, we will update the date above and tell studios by email.