Privacy Policy

1.1This Privacy Policy explains how Personal Data is collected, used, disclosed, and protected in connection with sanawell.co and our related websites, applications, and services (collectively, the "Platform"). The Platform is operated by Sonalabs LLC ("Sanawell", "we", "us"). For Personal Data described in this Policy, Sanawell is the data controller. Contact for all privacy matters: hello@sanawell.co, Sonalabs LLC.

1.2Capitalized terms not defined here (Member, Teacher, Business, Host, Editor, Listing, Booking Request, Booking Link) have the meanings given in the Terms of Service.

1.3Sanawell is a wellness directory: we present Hosts' offerings, transmit Booking Requests to Hosts as leads, and surface Hosts' own booking channels. We process no payments and collect no payment card data. When a Host receives your Booking Request details, or when you transact with a Host through the Host's own channels, the Host acts as an independent data controller and is responsible for its own privacy practices (Section 7).

2.1Account data: name, email address, and profile picture; a hashed password (for password accounts); email-verification status; your onboarding choice (member / teacher / business / claim). Your account display name is shown publicly alongside any review you publish (Section 8).

2.2Google sign-in data: if you sign in with Google, we receive your email address, name, profile image, and email-verification status, and we store the OAuth tokens needed to operate the sign-in. If your Google email matches an existing Platform account, the sign-ins are linked to that account.

2.3Profile and Listing data (Hosts): for Teachers — name, email, tagline, bio, origin, website and social links, photographs, teaching styles, languages, experience years, and certifications (name, organization, location, lead teacher, hours, year); for Businesses — business name, description, business types, and for each Center: address, latitude/longitude, website, email, phone, WhatsApp, social links, photographs, schedules, and pricing. Published Listing data is public by design.

2.4Booking Request data: the Wellness Service concerned, requested session date/time, participant count, your name, email address, and phone number, any free-text message, and a timestamp of your acceptance of the Booking Terms.

2.5Reviews, claims, and interactions: review ratings, titles, and text; place-claim details including your claimed role, justification message, and verification website and phone number; saved favourites; in-app notifications; messages sent through the site contact form.

2.6Draft content and version history: the Platform autosaves Listing edits, so unpublished drafts and a limited version history of Listings are stored. Uploaded images are stored at unguessable URLs but are technically retrievable by anyone holding the URL, including images attached to unpublished drafts — do not upload images you are not prepared to have accessible.

2.7Technical data: IP address (including as forwarded to our bot-protection provider during registration), browser and device information, pages visited, and server logs; analytics events described in Section 9.

2.8Data not collected from you:

(a) Publicly sourced directory data — for unclaimed Listings, we compile business details (name, address, category, opening hours, website, public social profiles) from publicly available sources, in furtherance of our legitimate interest in operating a wellness directory.

(b) Host-imported schedule data — where a Business connects its scheduling system (currently Momence), we import upcoming session data supplied by that system, which may include instructor names; we may match those names to existing Teacher profiles.

(c) Invitation data — a Business may enter a Teacher's name and email address to invite them or notify them of a class assignment; we use that address solely to send the invitation or notification, which identifies the inviting Business.

If you are named in data described in this Section 2.8 and want it corrected or removed, contact hello@sanawell.co.

3.1Directly from you (registration, profiles, Listings, Booking Requests, reviews, claims, contact form, newsletter signup); automatically (cookies, logs, analytics — Sections 9–10); from Google when you use Google sign-in; from Businesses that invite you or import schedules naming you; and from publicly available sources for directory Listings.

4.1We use Personal Data to:

(a) operate the Platform — accounts, profiles, Listings, search, favourites, notifications (contract);

(b) transmit Booking Requests to the applicable Host and record your acceptance of the Booking Terms (contract);

(c) publish content you choose to publish — Listings, profiles, and approved reviews with your display name (contract);

(d) send transactional and workflow email — verification, password reset, submission and moderation outcomes, invitations, booking leads, roster notifications (contract; legitimate interests);

(e) send our newsletter to subscribers, with unsubscribe available at any time (consent);

(f) operate analytics to understand and improve the Platform (legitimate interests; consent where required — Section 9);

(g) maintain security, prevent fraud, spam, and abuse, verify claims, and keep records of our dealings with you (legitimate interests);

(h) comply with legal obligations and respond to valid legal process (legal obligation).

4.2We do not use Personal Data for automated decision-making that produces legal or similarly significant effects, and we do not sell Personal Data.

5.1Access to Personal Data is limited to: (a) Sanawell staff operating the Platform's administration systems; and (b) authorized onboarding operators who assist studios in creating Listings. Administrative access is role-restricted and used to operate, moderate, and support the Platform.

6.1The following are public when published: Host Listings and Center contact details (subject to profile tier), Teacher profiles, class and event details, articles, and approved reviews together with the reviewer's account display name. Contact details for "standard" (unclaimed) Listings may be partially hidden; claimed and verified Listings display phone and WhatsApp details supplied by the Host.

7.1When you submit a Booking Request or accept a Booking Link, the applicable Host receives your name, email address, phone number, requested session details, and message so it can respond to you. You consent to this disclosure at the point of submission. The Host is an independent controller of that data and of anything you provide through the Host's own booking and payment channels; the Host's own privacy practices apply, and rights requests concerning a Host's records should be directed to that Host.

8.1Reviews you submit are held pending moderation, which may be performed by Sanawell or by the reviewed Host. If your review is rejected, the rejection reason may be shown to you. Approved reviews display your account name publicly. Moderation notes kept by Sanawell are internal.

9.1We use PostHog for product analytics (pageviews, page-leave events, and product interaction events, together with device, browser, and IP information). Analytics requests are served through our own domain (a first-party proxy path) and are then delivered to PostHog's US cloud; this means analytics operates even where third-party trackers are blocked, and PostHog receives your IP address. We do not currently create identified person profiles or use session recording.

9.2Cookies and similar storage we use: authentication and security cookies (strictly necessary); functional cookies that remember your last-browsed city, carry a teacher invitation through sign-up, or enable listing previews; staff-only cookies for administration and content preview; PostHog analytics cookies; and cookies set by Google when Google Maps or Google sign-in loads.

9.3Where required by applicable law (including for visitors from the EEA and UK), analytics cookies are set only with your consent, which you can give or withdraw through our cookie banner. You can also limit cookies through your browser settings; strictly necessary cookies cannot be disabled without breaking sign-in.

10.1The following providers process Personal Data on our behalf:

10.2We may update this list as providers change; material changes will be reflected in this Policy.

11.1Our users are primarily in Southeast Asia; our infrastructure and service providers operate in Japan, Singapore, the United States, and Brazil, as described in Section 10. Personal Data is therefore transferred across borders as a necessary part of providing the Platform. Where we transfer Personal Data of EEA or UK residents, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses. For data subject to Indonesia's Personal Data Protection Law (Law No. 27 of 2022), transfers are made consistent with its cross-border transfer requirements.

12.1We retain Personal Data only as long as needed for the purposes described above:

13.1You may request account deletion from your account settings, which asks you to email us from your registered address. Requests are actioned by us rather than automatically. We retain your data for at least ninety (90) days from your request before deletion is performed, and longer only where Section 13.4 or Section 12 gives a reason to. Until deletion is performed your account remains available to you, and you may withdraw the request at any time by contacting us. Deletion is permanent once performed.

13.2The 90-day period exists to protect you against accidental or unauthorized deletion and to protect the Platform against fraud and abuse (such as spam, fake enquiries, and review manipulation followed by account deletion).

13.3What is deleted: your account record, sign-in credentials and OAuth tokens, sessions, notifications, favourites, profile picture, and Teacher profiles you own; you are removed from our newsletter audiences; and we initiate deletion of your identifier-linked analytics data.

13.4What is retained, and why:

(a) Reviews — your published reviews are retained but anonymized (your name and account link are removed), because they form part of other users' and Hosts' context;

(b) Booking Requests — records already transmitted to Hosts are retained in anonymized form for the remainder of their retention period (Section 12); note that the Host you contacted independently holds the details you sent them;

(c) Business Listings — Listings of a Business you owned are not automatically deleted, because they describe a business rather than an individual; ownership is detached, and the Business may be claimed by an authorized representative. If a Listing contains your personal contact details, tell us and we will remove them;

(d) Legal records — limited records retained where required for legal claims, compliance, or fraud prevention, for no longer than necessary.

13.5Independently of account closure, you may exercise your erasure rights under applicable law at any time (Section 14); statutory requests are honored within legal timeframes and are not subject to the 90-day period, except for the specific retained categories in Section 13.4.

14.1Depending on your location — including under the GDPR/UK GDPR and Indonesia's Personal Data Protection Law — you may have the right to: access your Personal Data and obtain a copy; correct inaccurate data; delete your data; restrict or object to processing, including direct marketing; data portability; withdraw consent at any time; and lodge a complaint with your data protection authority. Residents of certain U.S. states have comparable rights to know, delete, and correct, without discrimination; we do not sell Personal Data or share it for cross-context behavioral advertising.

14.2To exercise any right, email hello@sanawell.co. We may verify your identity, and we respond within the timeframes required by applicable law (and in any event aim to respond within thirty (30) days). Requests concerning data held by a Host — including anything you sent them in a Booking Request or provided through their booking channels — should be directed to that Host.

15.1We protect Personal Data with measures appropriate to the risk, including: hashed passwords; mandatory email verification before password sign-in; encrypted connections (TLS); HTTP-only, secure session cookies; bot protection on registration; server-side, role-based authorization on all administrative and Host functions; and secrets management for credentials and signing keys. No service is completely secure, and we cannot guarantee that unauthorized access or a breach will never occur. If you suspect unauthorized access to your account, contact hello@sanawell.co immediately.

16.1The Platform is not directed to children, and account holders must be at least eighteen (18). Wellness Services listed by Hosts may themselves welcome minors, but we do not knowingly collect Personal Data from anyone under eighteen. If you believe a child has provided us Personal Data, contact hello@sanawell.co and we will delete it.

17.1We may update this Policy from time to time. Material changes will be announced on the Platform or by email before they take effect; the effective date above indicates the current version.

17.2Questions, rights requests, and complaints: hello@sanawell.co · Sonalabs LLC. EEA and UK residents may also lodge a complaint with the data protection authority for their country or region; Indonesian residents may complain to the competent authority under the Personal Data Protection Law.