Legal · version 2026-10-26.1

Privacy Policy

What we collect, why, where it is stored, who sees it, how long we keep it, and your rights to see, export and delete it.

buildteam.ai is the controller of the personal data described here. We built Shvasa around a simple idea: your practice is yours. This policy says what we collect, why, and what you can do about it.

1. What we collect

• Account. When you sign in with Google we receive a stable identifier, your name and your verified email address. We do not receive your Google password.
• Profile. What you tell us: preferred name, language, experience, goals, how much time you usually have, instruction style, and anything a teacher should know. All of it is optional and editable.
• Practice. Which classes you start and finish, when, how you rated them, what you asked for next time (for example a slower pace or props), the times you set for a day and whether you asked to be reminded, and whether you stopped a class and why. Completion is self-reported.
• People who practise with you. If you tell us after a class which other adults practised with you, we keep the first name or nickname you give, who they are to you (for example partner or friend), whether they are 65 or over, and which practices they joined. Tell us only what they are happy for you to share. Shvasa is for adults: we do not accept details of anyone under 18. We never contact them, ask them for anything, or record or analyse them. You can change or remove anyone in your profile, and removing someone deletes them from every practice.
• Health and safety. If you report pain or an incident during a class we record what you tell us so a reviewer can follow up. This is health information: only reviewers can read it, it never appears in logs, and it is never used to diagnose.
• Recordings and camera. Nothing from your camera is recorded or analysed unless you turn that on, and each use (recording, training, publication, sharing) needs its own permission.
• Reminders. If you turn on reminders, we keep the hour you chose and your time zone (taken from your browser) so the email arrives at your morning, not ours, and we keep a note of each reminder sent so you never get the same one twice.
• Classes a teacher asks to see. When you choose to practise one with your camera, we record that class (video only, no sound) so a teacher can see how your practice is going and place you in our curriculum. Still frames from it are reviewed by an AI model, which notes whether each posture the teacher is looking for is visible; a teacher may review the recording and the notes, and only a teacher decides your place in the curriculum. Only our teachers and reviewers see the recording. It is never used for training or shown to anyone else, and it is deleted 30 days after the teacher decides, at once if you stop for pain, or whenever you delete it on Progress.
• Sign in with Apple. If you sign in with Apple we receive a stable identifier and, if you choose to share it, your name and an email address (which may be an Apple relay address). We do not receive your Apple ID password.
• Body setup in the iPhone app. To fit the teaching, the props and the camera to your body, the app guides you through a few poses in front of your phone (standing with your arms out, arms up, feet wide, and, if you choose, side-on and folding forward). From them it works out your height (or uses the height you tell us), the proportions of your body (such as arm span and leg length as shares of your height), your range of movement (how far your arms reach overhead, how wide your legs open, how near your hands come to the floor in a fold) and your standing posture (such as shoulder and hip level, where your knees track, how far forward your head sits). You may also tell us your weight; it is optional, and we use it only to make suggestions for arm balances, inversions and similar postures gentler. The coach uses these numbers to set targets for your body, such as how wide your stance should be in Warrior II or how long your Downward-Facing Dog. The pictures are analysed on your phone and never leave it; we keep only the resulting numbers, labelled as told by you or observed, with how sure each measurement is, and each completed setup so a later one can be compared with it. This is not a medical or anatomical assessment and never a score. Delete it, with every earlier setup, any time in your profile.
• Faces on your phone, if you turn it on. In the iPhone app you can let it recognise the people who practise with you, the way a home camera learns familiar faces. See section 6, Biometric information: face prints stay on your phone and are never sent to us; we learn only the first name you choose when you say who practised with you.
• Apple Health, if you turn it on. The app can write each finished practice to Apple Health as a yoga workout, only with your permission in iOS. With Apple Watch, the Watch saves that workout instead, once. You can turn either off in the Health app at any time.
• Classes for your day, if you turn it on in the iPhone app. The app reads your workouts, steps, exercise and stand time, and sleep from Apple Health on your phone, and turns them into a few words (for example “a day on your legs” or “a short night”) to suggest one extra class. The readings never leave your phone; we receive only the words, keep them 28 days, show them to no one at Shvasa, and use them for nothing else, never for advertising. Turn it off in the app and we delete them at once.
• Payments. Stripe processes payments and holds your card details; we hold your membership status, plan and billing period, never the card.
• Technical. Sign-in session, device and browser type, pages viewed, and errors, so the Service works and stays secure. We use no advertising trackers.
• Waitlist. If you join the waitlist: your email, name if given, interests, and whether you agreed to further messages.

2. Why we use it

To run your account and membership; to suggest and deliver classes; to keep you safe (stop, pain, incidents); to answer you; to improve the teaching (for example which cues are unclear), using aggregated or de-identified data wherever possible; to meet legal duties; and, only with your separate consent, to send you news about programs and teachers. We do not sell personal data and we do not share it for advertising.

3. Legal bases

Where the law requires one: performance of our contract with you (account, membership, classes); your consent (optional profile details, marketing, camera and recordings, health reports); our legitimate interests in running a safe, secure service; and legal obligations (tax, accounting, responding to lawful requests).

4. Who sees it

Our staff, under access controls and only as needed for their role. Processors who act on our instructions: Google Cloud (hosting and storage, in the United States), Stripe (payments on the web), Twilio SendGrid (sending our emails), Google and Apple (sign-in), Apple (purchases in the iPhone app, and push notifications if you allow them), the video and speech providers we use to produce classes, which receive teaching footage of our presenters, never your data, and the AI model provider we use (OpenAI or Anthropic), which receives still frames from a class you chose to practise with your camera for a teacher, only to describe them to us, and may not use them to train its models. Reviewers see health reports. We disclose personal data when the law requires it or to protect someone’s safety.

5. Where it is stored and for how long

Data is stored in Google Cloud in the United States. We keep account and practice data while your account is active and for 30 days after you close it, then delete or de-identify it. Face prints are never stored by us; their schedule on your phone is in section 6. Billing records are kept as tax law requires (typically seven years). Incident reports are kept for the period our safety reviewers need and then deleted. Recordings of classes a teacher asked to see, and their frames, are deleted 30 days after the teacher's decision; the teacher's notes stay with your placement as text. The people you told us practise with you, and your body setup (with each earlier setup kept for comparing), are kept until you remove them or close your account; deleting the body setup deletes its history too. Waitlist entries are deleted when the studio opens or on request.

6. Biometric information

What. If you turn on face recognition in the iPhone app, the app turns faces it sees during a class with the camera on into face prints: numbers it can compare to tell the people who practise with you apart. A face print is biometric information under the laws of several places, including Illinois, Texas, Washington and Colorado, and the European Union and United Kingdom.

Why. Only to suggest, after a class, who practised with you, which you confirm or correct. Never to identify anyone else, never for advertising, and never to decide anything about anyone.

Consent. It is off until you read what it does and agree in the app. Only adults may be named, and before you name someone you confirm that they agreed; the app never remembers the face of anyone under 18. Faces nobody names are not kept after the class.

Where. Face prints and the small pictures used to ask “Who’s this?” are stored only on your phone, in the app’s own folder, encrypted while the phone is locked. They are never sent to buildteam.ai or anyone else. We do not sell, lease, trade or disclose them, and we do not profit from them; we never receive them.

How long. A face is deleted from the phone at the first of: a year without being named or confirmed after a class; you forgetting it, or all faces, in the app; you turning face recognition off; you signing out of the app; or the app being deleted. This retention schedule applies to every face the app remembers.

7. Health data, and rights in the United States

Some of what you share with us can be health data under laws such as Washington’s My Health My Data Act, Nevada’s and Connecticut’s: pain and incident reports, what a teacher should know, and your movement profile. Our Consumer Health Data Privacy Policy says what we collect, why, from where, with whom we share it, and how to use your rights. Residents of California and other states with privacy laws may ask what we collect, ask us to correct or delete it, and opt out of sale or targeted advertising, which we never do. We do not discriminate against anyone for using these rights. If we refuse a request, you may appeal by replying to our answer; we decide an appeal within 45 days and tell you how to contact your state’s attorney general if you disagree.

8. Your rights

You can see and change your profile at any time. You can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, withdraw any consent, and complain to your data-protection authority. Residents of the European Economic Area, the United Kingdom, California and other places with privacy laws have these rights by law; we extend them to everyone. Write to the support address shown in your profile; we answer within 30 days and never charge for a first request.

9. Children

Shvasa is for adults only. We do not knowingly collect personal information from or about anyone under 18, let them hold an account, or remember their face. If we learn that we have, we delete it; if you believe we hold a child's information, write to the support address shown in your profile and we will delete it promptly.

10. Cookies

We use a sign-in cookie and a few settings stored in your browser. We use no third-party advertising cookies. See Cookies.

11. Security

Data travels encrypted and is stored encrypted at rest. Access is by role and logged. Media is private and served only through short-lived signed links. If a breach affects you we will tell you and the authorities as the law requires.

12. Changes

When this policy changes the version date changes and we ask you to agree again before you practise. Earlier versions you agreed to are kept on record.

13. Contact

buildteam.ai. Email: the support address shown in your profile.