Privacy Notice

1. Who we are

CueBeat is operated by Sirena Clark ("CueBeat", "we", "us"). We are the data controller for personal data processed through the CueBeat website and app. Contact us at hello@cuebeatpilates.com.

2. Who CueBeat is for

CueBeat is intended for people aged 13 or older. Anyone under 18 should have a parent, guardian, or supervising school authorize their use. CueBeat is a wellness and educational tool — it is not medical advice, diagnosis, or treatment, and it does not replace a qualified instructor or clinician.

3. Data we process

• Account & profile: name/display name, email, avatar, role (instructor/student), age acknowledgement.
• Subscription & payment status: plan, trial state, invoice references. Full card details are handled by Stripe; CueBeat never sees or stores your full card number.
• Classes, sessions, completions: classes you create or join, exercises completed, duration, share codes and bookmarks.
• Optional alignment / calibration measurements: if you opt into the optional alignment check, we store the derived scores (shoulder, hip, spine, knee, stability) and per-cue reference-pose measurements. We do not store raw camera video or photos.
• Support & security logs: messages you send us, and standard security/audit logs (IP address, device/browser, timestamps).

4. Camera & on-device processing

When you use the optional alignment check or a live class with pose feedback, camera frames are processed on your device using MediaPipe pose landmarks. Raw camera video and photos are not intentionally uploaded, recorded, or retained by CueBeat. Only derived measurements you agree to save (e.g. alignment scores) are stored in your account.

5. How we use your data

• Providing the service (contract): account, authentication, delivering classes, syncing progress.
• Product improvement (legitimate interest): aggregate usage analytics to improve features.
• Security & fraud prevention (legitimate interest / legal obligation).
• Support (contract): responding to your inquiries.
• Marketing (consent): product updates only when you opt in.

We do not sell personal data, use it for cross-context targeted advertising, or use identifiable school-pilot student data to train general-purpose AI models.

6. Recipients & service providers

CueBeat's principal subprocessors are:

• Supabase — authentication and application database.
• Lovable-hosted infrastructure — application hosting and edge delivery.
• Stripe — payment processing, subscriptions, and receipts. See stripe.com/privacy.
• Resend — transactional email delivery.
• Legal / regulatory authorities — where required by law.

Stripe and Resend do not need to receive school-pilot alignment or form measurement data, and are not sent it as part of pilot operation.

7. Retention

We keep account data while your account is active. When you delete your account we remove or anonymize personal data within 30 days, except where a narrow legal-hold or back-up-rotation exception applies. For school pilots, active-system pilot data is deleted or de-identified within 30 days after pilot end, or earlier on verified school request, subject to the same narrow legal-hold and back-up-rotation limits (see §9). This is an operational commitment, not a certification or blanket legal guarantee.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request portability of your data
• Withdraw consent where processing is based on consent

You can delete your account in-app from Settings → Danger Zone, or contact us at hello@cuebeatpilates.com. We aim to respond within 30 days.

9. School-pilot commitments (documented safeguards, not a certification)

CueBeat runs rapid school pilots under the commitments below. These are our documented operational safeguards — not a certification, audit finding, or blanket legal compliance guarantee — and they are open to school review.

Students in the school pilot do not need individual CueBeat accounts, personal email addresses, or real names. The instructor-only tracker uses pseudonymous labels (for example, "Student A").

Pilot measurements and internal use. CueBeat may collect pseudonymous paired baseline/final and per-session measurements during a pilot, provide the participating school with an improvement report, and use deidentified, aggregated results internally for product evaluation, validation, and improvement.

No public or marketing use without separate written permission.We will not use the school's name or logo, student-level or pseudonymous records, quotes, testimonials, or pilot-cohort results in advertising, sales materials, a public case study, or other public proof without separate written authorization from the school. Where such authorization is obtained, any public reporting will remain deidentified and aggregated and will describe cohort size and methodology honestly — small-cohort results (for example, a six-person pilot) are described as deidentified and aggregated, never as "anonymous." Identifiable student data will not be used to train general-purpose AI models.

Incident commitment. If we confirm a security incident affecting school-pilot data, we will notify the school's designated contact without unreasonable delay and cooperate on response.

• Ages 13 and up, staff-supervised. The rapid school pilot is for students age 13 and older with adult/staff supervision at all times. Under-13 use is out of scope for this release and requires a separate reviewed process.
• Pilot measurements and internal use. CueBeat may collect pseudonymous paired baseline/final and per-session measurements during a pilot, provide the participating school with an improvement report, and use deidentified, aggregated results internally for product evaluation, validation, and improvement. We do not sell student data, use it for targeted advertising, or use identifiable pilot data to train general-purpose AI models.
• No public or marketing use without separate written permission. We will not use the school's name or logo, student-level or pseudonymous records, quotes, testimonials, or pilot-cohort results in advertising, sales materials, a public case study, or other public proof without separate written authorization from the school. Where such authorization is obtained, public reporting will remain deidentified and aggregated and will describe cohort size and methodology honestly. Small-cohort results (for example, a six-person pilot) are described as deidentified and aggregated, never as "anonymous."
• Camera stays on the device. Camera frames used for optional pose landmarks are processed on the student's device via MediaPipe. Raw camera video and photos are not intentionally uploaded, recorded, or retained by CueBeat — only derived measurements you agree to save.
• Pseudonymous student labels — no personal accounts required. Students in the school pilot do not need individual CueBeat accounts, personal email addresses, or real names. The instructor-only tracker uses pseudonymous labels (for example, "Student A"). We do not ask for date of birth, home address, personal phone number, government identifier, precise location, or medical diagnosis.
• Optional alignment baseline is opt-in and skippable. The optional posture/alignment check is clearly optional, off by default in pilots, separately explained and authorized, and always skippable. A skipped or failed alignment check never blocks a class.
• Pilot data deletion: 30 days, operational commitment. Active-system school-pilot data is deleted or de-identified within 30 days after pilot end, or earlier on verified school request — subject to narrow legal-hold and back-up-rotation limits. This is an operational commitment, not a certification or blanket legal guarantee.
• Incident notification. If we confirm a security incident affecting school-pilot data, we will notify the school's designated contact without unreasonable delay and cooperate on response.
• Documented safeguards, not certification. We do not claim FERPA or COPPA certification, blanket legal compliance, medical accuracy, or that CueBeat is a substitute for a qualified instructor. These commitments describe our documented pilot safeguards and are open to school review.

10. Security

We use encryption in transit, access controls, and standard operational safeguards. No online service can guarantee perfect security; report suspected issues to hello@cuebeatpilates.com.

11. Cookies

CueBeat uses essential cookies/local storage for session and authentication. Optional analytics cookies (where offered) can be managed in your browser settings.

12. Changes

We may update this notice; material changes will be signaled in-app or by email where appropriate. The "Last updated" date at the top reflects the current version.