This Privacy Policy explains how Pilates.Online, operated by Indigo Holdings Limited ("we," "our," "us"), collects, uses, and protects personal information when you interact with our website, mobile applications, and services. By using our services, you agree to the terms outlined here.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password.
• Profile Information: You may provide additional information such as your preferred name, birthday, experience level, and fitness goals.
• Payment Information: Payment details are collected and processed securely by our payment processor, Paddle. We do not store your full payment card details.
• Communications: When you contact us for support or use our direct messaging feature with instructors, we collect the information you provide in your messages.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, and browser type (major version only to protect your privacy).
• Device Identifier: On our apps, we collect a unique device identifier to prevent abuse of our free trial system and provide account security. This identifier is tied to your device and is used for fraud prevention and account recovery purposes.
• Visitor Identification: When you first visit our website or app, we generate a random identifier stored on your device. This allows us to understand how visitors use our service before creating an account. When you create an account, we link this identifier to your account to provide a seamless experience and understand your complete journey with our service. If you access our service from multiple devices or browsers, we may link these identifiers together once you sign in, creating a unified view of your activity.
• Usage Data: We track detailed usage patterns including video playback behaviour, feature interactions, progress toward goals, and navigation within the app. This data helps us improve our services. For Premium subscribers, your instructor can view your workout history, progress, goals, and contact information to provide personalised guidance and support.
• Location Data: We derive your approximate location (country, region, city) from your IP address for pricing localisation and analytics. On our apps, we also receive your app store country from the platform.
• Fraud Prevention: We collect and store your IP address and device information to prevent abuse of our free trial system and protect against fraudulent activity.
• Marketing Attribution: Referral source and campaign information to understand how you found us.
• Link Tracking: When you click links in our emails or marketing materials, we may use our own link tracking service to understand which content you engage with. This helps us measure marketing effectiveness and send more relevant communications.

1.3 Cookies and Similar Technologies

We use cookies and local storage to remember your preferences and settings (essential), maintain your session (essential), understand how you use our services (analytics), and measure advertising effectiveness (marketing, with your consent). Essential cookies are necessary for the service to function. Analytics data is collected using a randomly generated identifier and does not personally identify you unless you create an account. Marketing cookies are only used with your consent.

1.4 Email Tracking

For marketing and content emails (which you can unsubscribe from at any time), we may track whether you open the email and which links you click. This helps us send more relevant content and measure the effectiveness of our communications. Essential account emails (such as password resets and verification codes) are not tracked in this way.

2. How We Use Your Information

• Provide and maintain our Pilates video streaming service
• Process your subscription and payments
• Personalise your experience and content recommendations
• Enable your instructor to provide personalised guidance (Premium subscribers)
• Send transactional emails and service updates
• Send marketing communications (with your consent)
• Send automated message sequences based on your activity (for example, helpful tips during your free trial, or re-engagement messages if you haven't visited in a while). You can opt out of marketing sequences at any time; service-related messages that are part of your subscription cannot be opted out of.
• Analyse usage patterns to improve our services

3. Legal Basis for Processing

We process your personal data based on: Contract (processing necessary to provide services you've requested), Consent (marketing communications, marketing cookies), Legitimate Interests (analytics, fraud prevention, service improvement), and Legal Obligation (compliance with applicable laws).

4. Information Sharing

We share information with trusted third parties who help us operate our services:

• Paddle: Our payment processor and merchant of record
• Postmark: For transactional and marketing emails
• IPinfo: For geolocation services to provide localised pricing

If you consent to marketing cookies, we may share data with advertising platforms (such as Meta/Facebook) to measure advertising effectiveness. We work with affiliate partners who may refer you to our service; we track referrals to compensate our partners and provide them with aggregate performance metrics, but we do not share your personal details with affiliates without your explicit consent. We may also disclose your information if required by law or to protect our rights.

5. International Data Transfers

As a UAE-based service provider with servers in Australia and a global audience, your data may be transferred internationally. Transfers to Australia are under EU adequacy decisions. Transfers from UAE are made pursuant to UAE PDPL Article 22 on the basis of your explicit consent, contractual necessity, or implementation of appropriate safeguards. Transfers from EU/UK to UAE are made on the basis of your explicit consent and/or as necessary to perform our contract with you. We implement appropriate technical and organisational measures to protect your data regardless of location.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption of data in transit (TLS/HTTPS) and at rest (AES-256), regular security assessments, access controls, and secure password hashing. While we strive to protect your information, no method of transmission over the Internet is 100% secure.

7. Data Retention

We retain your data for as long as your account is active, plus 30 days after a deletion request to allow recovery. After you close your account or your subscription ends, we retain your data for up to 15 years as required to comply with legal obligations, resolve disputes, and enforce our agreements (in accordance with applicable statutes of limitations). After this period, data is either securely deleted or anonymised for aggregate analytics purposes.

8. Your Rights

Depending on your location, you may have the right to: access, correct, or delete your personal data; request your data in a portable format; withdraw consent for marketing communications or cookies; and object to certain processing of your data. To exercise these rights, contact us at privacy@pilates.online. We respond to all enquiries within 30 days.

9. Children's Privacy

Our content is suitable for all ages, but minors require an adult to create their account and supervise their use of our service. By creating an account for a minor, you represent that you are their parent or guardian and consent to our collection and use of their information as described in this Privacy Policy. If you believe an account has been created for a child without appropriate parental consent, please contact us at privacy@pilates.online and we will take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through the Service.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Indigo Holdings Limited
Suite 1006, Tiffany Tower
Jumeirah Lake Towers
Dubai, UAE
Email: privacy@pilates.online

12. Regional Information

For UAE Residents: We comply with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). You may exercise your data protection rights by contacting us at privacy@pilates.online.

For EU and UK Residents: You have the right to lodge a complaint with your local data protection authority (in the EU) or the Information Commissioner's Office (in the UK) at ico.org.uk.

For California Residents: Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect and to request deletion. We do not sell your personal information.

For Australian Residents: We comply with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth).

Last Updated: 20 March 2026