Data Processing Addendum

1. Roles and scope

For the member, lead, booking, attendance, purchase, payment-reference and messaging records your studio loads into or generates on the platform ("Studio Data"), your studio decides why and how it is processed and is the controller. Bare Links processes Studio Data only to provide the platform and only on your documented instructions, which include using the platform's features as designed.

For the accounts of the people who administer your studio on Bare Links, and for Bare Links' own customer relationship with your studio, Bare Links is the controller (see the Privacy Policy).

2. What Bare Links does with Studio Data

• Runs the booking portal and admin backend: schedules, bookings, waitlists, memberships and credits, appointments, front-desk check-in.
• Sends transactional messages your members expect (booking confirmations, reminders, receipts, sign-in links) and marketing messages only to members who have opted in to your studio's marketing, with a working unsubscribe.
• Processes payments through Stripe: Bare Links never sees or stores full card numbers.
• Produces the records you are legally required to keep, including FTA tax invoices, and the audit trail of staff actions.
• Keeps the service secure, available and supported, which may involve our staff viewing Studio Data when you ask for help or when an incident requires it.

Bare Links does not sell Studio Data, use it to market to your members on its own behalf, combine it with another studio's data, or show one studio anything about another.

3. Sub-processors

Bare Links uses the following sub-processors to run the platform. Each is bound by its own contractual and technical safeguards, and data may be stored or processed on servers outside the UAE:

• Vercel (application hosting and edge network)
• Neon (managed Postgres database)
• Stripe (payments, subscriptions and Connect payouts)
• Resend (transactional email)
• Sentry (error diagnostics, with personal data scrubbed before it leaves the platform)
• Meta (WhatsApp Business messaging, only once your studio's WhatsApp number is connected)

We will update this list here before adding a sub-processor that handles Studio Data and, for material changes, notify your billing contact so you can object.

4. Security

Every studio's data is isolated by tenant in the database and enforced in the authorisation layer on every read and write. Access is role-based (owner, manager, front desk, instructor) and financial or medical fields are limited to the roles that need them. Traffic is encrypted in transit, secrets are held outside the codebase, and sensitive staff actions are logged in an audit trail.

Bare Links will notify your studio's primary contact without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting Studio Data, with what we know about its nature, the records concerned, the likely consequences and the measures taken.

5. Helping you meet your obligations

Members can access and correct their own profile in the booking portal and withdraw marketing consent at any time. For access, correction, deletion or objection requests you receive as controller, the admin backend lets you export your member data as CSV and edit or archive a profile; where a request needs our help (for example a full erasure, with the legally retained invoice records anonymised rather than deleted), email us and we will act within ten business days.

Bare Links keeps the records that support your legal duties (tax invoices, refund credit notes, consent timestamps, the audit trail) and makes them available to you and, on your instruction, to your auditors or the authorities.

6. Retention and return

Studio Data is kept for as long as your subscription is active. When it ends, your data is retained for at least 90 days so that you can export it or reactivate, after which Bare Links deletes it, except for records that must be kept by law (for example tax invoices for the statutory period), which are retained only for that purpose and then deleted.

7. Confidentiality and staff

Bare Links staff and contractors who can access Studio Data are bound by confidentiality obligations and receive access only to the extent needed for support, operations or security.

8. Liability and precedence

This addendum is governed by the Terms of Service, including its limitation of liability and governing law. Where this addendum and the Terms conflict on the processing of personal data, this addendum prevails.

Questions about data processing: admin@barelinks.ae.