Privacy Policy
Last updated: October 12, 2026
Poetry in Motion is an online movement-membership service operated by Sind Studios (“we”, “us”, or “our”). This policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, create an identity, purchase or use a membership, or contact us. It is intended to meet the transparency requirements of Canadian privacy legislation, including PIPEDA where it applies, and the GDPR and California privacy laws where they apply.
Sind Studios is responsible for the personal information described here. Our Privacy Officer can be reached at privacy@poetryinmotionstudio.com.
1. Information we collect
| Category | Examples | Why we use it |
|---|---|---|
| Identity and security | Email address, Supabase identity ID, session identifiers, sign-in-code requests, verification events, and authentication cookies. | Create and secure your identity, send essential sign-in messages, and prevent abuse. |
| Membership and payments | Billing name and billing address, billing country, Stripe customer and subscription IDs, payment and tax status, price, currency, renewal date, and cancellation status. | Process payment, manage membership, prevent fraud, meet tax and accounting duties, and provide support. |
| Device, request, and playback data | IP-derived coarse location, browser and device details, request and security logs, anonymous viewer or session IDs, playback events, and video-quality metrics. | Deliver and secure the service, select a displayed currency, diagnose errors, and improve reliable playback. |
| Instructor and content data | Instructor identity, uploaded video, titles, descriptions, collection, publication settings, upload and asset IDs, and timestamps. | Enable the private publishing workspace and deliver the member library. |
| Messages and gifts | Information you send to us and, where we offer gift memberships, recipient email, redemption, and delivery information. | Respond to you, deliver a requested gift, and protect against fraud or misuse. |
| Library updates | Whether you chose to receive library updates and, for each update we send, whether it was delivered, bounced, or reported as spam, when it was opened, and the links you tap. | Send the updates you chose, respect your choice to stop them, and learn which practices and emails help members keep practising. |
You provide most information directly to us. We also receive payment, subscription, tax, and fraud-related information from Stripe, and service, security, and playback information from our providers. We do not ask you to submit medical, injury, pregnancy, disability, biometric, or other health information. Please do not include health information in messages to us.
2. Legal grounds and purposes
Where the GDPR applies, we process personal information to perform our contract with you, comply with legal obligations, pursue legitimate interests in operating a secure and reliable service, or with your consent where consent is required. We do not use consent as a condition of membership when the processing is necessary to provide the membership. You may withdraw consent at any time, without affecting processing that occurred before its withdrawal.
We use personal information only for the purposes described in this policy or for a compatible purpose allowed by law. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.
3. Cookies and similar technologies
We use essential cookies to maintain a secure Supabase authentication session. In the member library, our video player uses Mux Data to measure playback quality, such as start-up time and errors, without storing an identifier on your device. The introduction video on our home page is not measured. We do not use advertising or retargeting cookies.
Library updates, our occasional email about new practices, measure opens and the links you tap. Each update contains a small image that records when it is opened, and its links pass through our email provider so a tap can be counted before you reach the page. Some email apps load or block images automatically, so open figures are approximate. To stop this, turn library updates off in Account → Emails or use the unsubscribe link in any update. Our other emails, such as sign-in codes and billing notices, do not measure opens or taps.
Where law requires consent before a non-essential cookie or similar technology is enabled, we will ask before enabling it and provide a way to change that choice.
4. Who receives personal information
We disclose personal information only to service providers that help us deliver the service, comply with law, protect people and the service, or complete a business transaction permitted by law. Our current providers include:
- Supabase for identity, authentication, and our primary application database.
- Stripe for payment, billing, tax, fraud prevention, invoices, and subscription management.
- Mux for secure video upload, streaming, and playback-quality analytics.
- Vercel for website hosting, delivery, and service-security logs.
- Resend for operational, gift, and library updates email delivery, including measuring opens and taps in library updates.
Payment-card details are collected and processed by Stripe Checkout rather than stored in our application. We do not sell or share personal information as those terms are defined by California law, and we do not use personal information for cross-context behavioural advertising.
5. International processing
Our primary Supabase database and Vercel application functions are configured in Canada. Some providers process information outside Canada, including in the United States and other countries where they or their subprocessors operate. Information can therefore be subject to the laws of those places.
We use contractual and organizational measures intended to provide a comparable level of protection when we use a service provider. Where GDPR transfer rules apply, we use an applicable transfer mechanism and supplementary safeguards before a restricted transfer.
6. Retention
We keep personal information only as long as reasonably necessary for the purpose for which it was collected, including to provide the service, resolve disputes, enforce agreements, prevent fraud, and meet legal obligations. Identity and membership records are retained while your membership or identity remains active and then deleted or anonymized when they are no longer needed, subject to the records below.
Billing, payment, tax, and accounting records are retained for seven years after the end of the relevant calendar year, unless a longer period is required by law or a legal hold applies. Provider-held logs, authentication records, and playback analytics follow documented retention schedules and are deleted or anonymized when no longer needed for security, troubleshooting, or legal obligations.
7. Your privacy choices and rights
Subject to applicable law, you can ask us to give you access to, correct, delete, restrict, object to, and provide portability of your personal information. You may also ask about our use and disclosure of your information, withdraw consent where consent is the legal basis, or challenge our privacy practices.
Email privacy@poetryinmotionstudio.com to make a request. We may need to verify your identity before acting and will not discriminate against you for exercising a privacy right. We aim to respond within the time required by applicable law, which is normally one month for a GDPR request and 45 days for a verified California request, subject to permitted extensions.
California residents may have rights to know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information if the California Consumer Privacy Act applies to us. We do not sell or share personal information, so there is no sale or sharing to opt out of. We will honor applicable browser-based opt-out preferences if our practices change in a way that requires it.
Canadian residents can contact our Privacy Officer to challenge our compliance and may complain to the Office of the Privacy Commissioner of Canada or their provincial privacy regulator. EEA and UK residents may complain to their local supervisory authority where GDPR or UK GDPR applies.
8. Security, children, and updates
We use reasonable administrative, technical, and organizational safeguards, including access controls and secure service providers, to protect personal information. No online service can guarantee absolute security.
Poetry in Motion is not directed to children under 18. Do not create an identity or use the service if you are under 18. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
We may update this policy to reflect a change in our practices, providers, or legal duties. The revised policy will be posted here with a new effective date.