Privacy Policy

Last updated: November 3, 2026

1. Introduction

VersaWave BV ("Company", "we", "us", or "our"), a company registered in Belgium, operates the StudioTrackr application ("App") and the website at studiotrackr.be ("Website"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our App and Website.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the Belgian Data Protection Act (Gegevensbeschermingswet), and other applicable data protection legislation.

2. Data Controller

The data controller responsible for your personal data is:

• Company: VersaWave BV
• Email: info@studiotrackr.be
• Website: studiotrackr.be

3. What Data We Collect

3.1 Account Data

When you create an account, we collect:

• Full name: to personalise your experience and display within studios.
• Email address: for authentication, email verification, password resets, and studio invitations.
• Password: stored only in hashed form; we never store or have access to your plaintext password.

3.2 Studio and Business Data

When you create or join a studio, we store:

• Studio name and details: the name and configuration of your studio workspace.
• Client records: names, contact details (email, phone, Instagram handle), addresses, dates of birth, and notes that you choose to enter.
• Session records: session dates, times, pricing, VAT percentages, payment methods, services, tags, and notes.
• Inventory data: item names, quantities, pricing, supplier information, and stock thresholds.
• Team member data: names, email addresses, roles, and revenue share percentages of invited studio members.
• Signed documents: consent forms a client signs in the App, as a PDF with the signature, the signer's name, and the time of signing.
• Session photos: photos you add to a session, such as reference images, the work itself, or the healed result.

Important: When you store client data in the App, you may be acting as an independent data controller under GDPR. You are responsible for ensuring you have a lawful basis for processing your clients' personal data and for informing your clients about how their data is used. This includes photos: if you want to use them publicly, for example in a portfolio or on social media, you ask for that consent yourself.

Photos and documents: session photos and signed documents are only visible to the members of your studio who can see the session. The App removes location data from a photo before it is stored. We use photos and documents only to show them in the App.

3.3 Subscription and Payment Data

Subscription payments are processed by Apple (via the App Store) and RevenueCat (our subscription management partner). We receive:

• Subscription status (active, expired, trial).
• Plan type and billing period.
• RevenueCat customer ID.

We do not receive or store your credit card number, bank details, or Apple ID password. All payment processing is handled directly by Apple.

3.4 Technical Data

We may collect limited technical data to ensure the App functions correctly:

• Device type and operating system version.
• App version.
• Crash reports: when the App crashes, a technical report (device model, OS and App version, and the place in the code where the crash happened) is sent to Firebase Crashlytics, a Google service. Crash reports do not contain your studio, client, or session data.

We do not use analytics tracking, advertising SDKs, or third-party behavioural analytics tools.

3.5 Google Calendar Sync (optional)

A studio owner can choose to connect a Google account to the studio, so planned sessions appear in the artists' own calendars. Nothing is shared with Google unless the owner connects an account. When connected, we use Google's sign-in to request the following access, and only this access:

• Your Google account's email address (scopes openid and email): to show which Google account is connected to the studio.
• Calendars created by StudioTrackr (scope calendar.app.created): to create one calendar per artist in the connected account, and to add, change, and remove the events in those calendars. StudioTrackr cannot see, read, or change any other calendar or event in your Google account.
• Sharing of those calendars (scope calendar.acls): to share each artist's calendar read-only with the email address the owner or artist chose, and to remove that share again.

We store the connected account's email address, an access token for Google (encrypted at rest), the email address each calendar is shared with, and the identifiers of the calendars and events we created, so we can keep them up to date.

What we write into these calendars: for each planned or completed session, the date and time, the service, the studio name, and, depending on the detail level the studio owner chooses, the client's full name, first name only, or no name at all, plus the session notes (not at the minimal level). For time off and studio closures we write the dates and the note. We never write prices, payments, contact details, or documents to Google.

The owner can disconnect Google at any time in the App's settings. We then remove all shares, revoke our access at Google, and delete the token and the stored identifiers. The calendars and events already created stay in the studio's own Google account, which the owner controls. Once written to Google, that data is also subject to Google's Privacy Policy.

Limited Use: StudioTrackr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the calendar sync described above. We do not sell it, use it for advertising, use it to train AI or machine learning models, or transfer it to anyone else except as needed to provide this feature, for security, or to comply with the law. No person at VersaWave BV reads it, unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.

4. How We Use Your Data

We use your personal data for the following purposes:

1. Providing the Service: storing and displaying your studio data, managing sessions, clients, inventory, and team members.
2. Authentication and Security: verifying your identity, managing login sessions, and protecting your account.
3. Email Communications: sending email verification, password reset links, and studio invitation emails. We do not send marketing emails unless you explicitly opt in.
4. Google Calendar Sync: if the studio owner connects Google, keeping the artists' calendars in that account up to date with their sessions and time off (see section 3.5).
5. Subscription Management: managing your plan, feature limits, and billing status in coordination with Apple and RevenueCat.
6. Service Improvement: identifying and fixing bugs, improving performance, and developing new features based on aggregated, anonymised usage patterns.

5. Legal Basis for Processing

Under GDPR, we process your data on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide you with the App and Services you signed up for.
• Legitimate interest (Art. 6(1)(f)): improving our services, ensuring security, and preventing fraud.
• Consent (Art. 6(1)(a)): where applicable, for optional communications such as marketing newsletters.
• Legal obligation (Art. 6(1)(c)): where we are required to retain data by Belgian or EU law.

6. Data Sharing and Third Parties

We do not sell your personal data. We share data only with the following categories of service providers, under appropriate data processing agreements:

• Hosting provider: our servers process and store your data securely.
• RevenueCat: manages subscription state and communicates with Apple's App Store.
• Apple: processes payments through the App Store.
• Email service provider: delivers transactional emails (verification, password reset, invitations).
• Google (Firebase Crashlytics): receives crash reports to help us fix bugs.
• Google (Google Calendar): only when a studio owner connects Google, receives the calendar data described in section 3.5.

All third-party providers are contractually obligated to process your data in accordance with GDPR and our instructions.

7. Data Retention

• Account data: retained for as long as your account is active. Upon account deletion, your personal data is removed within 30 days.
• Studio data: retained for as long as the studio exists. If a studio is deleted by its owner, all associated data (clients, sessions, inventory) is permanently removed within 30 days.
• Session photos: removed as soon as the studio deletes the photo or the session.
• Signed documents: kept for as long as the studio exists, as proof of the consent given.
• Email verification and password reset tokens automatically expire (72 hours for email verification, 60 minutes for password reset) and are then deleted.
• Google Calendar Sync: the Google token and stored identifiers are deleted when the owner disconnects Google, or when the studio is deleted. When an artist leaves the studio or deletes their account, their calendar's share is removed.
• Subscription data: retained for the duration of your subscription plus any legally required retention period for financial records.
• Backups: our database is backed up on a rolling 7-day cycle for security and disaster recovery. After you delete data, residual copies may remain in these backups for up to 7 days before they are automatically overwritten. Backup data is not accessed or used for any purpose other than restoring the Service.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission using industry-standard protocols, one-way hashing of passwords so they can never be read or recovered by anyone (including us), secure authentication, and role-based access controls that limit each studio member to the data their role permits. We also review our security practices on an ongoing basis.

While we take every reasonable step to safeguard your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you may update or correct your personal data at any time through the App's settings.
• Right to erasure (Art. 17): you may request that we delete your personal data. You can also delete your studio data directly within the App.
• Right to data portability (Art. 20): you may export your studio data through the App's export feature.
• Right to restriction of processing (Art. 18): you may request that we limit how we process your data.
• Right to object (Art. 21): you may object to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at info@studiotrackr.be. We will respond within 30 days.

10. International Data Transfers

Your data may be processed on servers located within the European Economic Area (EEA). If any data is transferred outside the EEA (for example, through third-party service providers), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Children's Privacy

The App is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly.

12. Cookies and Website Tracking

Our Website uses only essential cookies necessary for basic functionality (such as remembering your cookie preference). We do not use tracking cookies, advertising pixels, or third-party analytics on our Website.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email. The "Last updated" date at the top of this page reflects the most recent revision.

14. Supervisory Authority

If you believe that we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / GBA):

• Website: gegevensbeschermingsautoriteit.be

15. Contact

For any questions or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: VersaWave BV
• Email: info@studiotrackr.be
• Website: studiotrackr.be