Privacy Policy

1. Who this policy covers

This policy covers:

• Studios and their staff — businesses that subscribe to Twyla and their owners, administrators and instructors;
• parents and guardians — people whose family records are held by a Studio or who use the parent portal;
• students and children — people whose enrolment, attendance, safety and billing-related information is recorded by a Studio; and
• enquirers and messaging contacts — people who contact a Studio through web forms, email, SMS, Facebook Messenger or Instagram.

Studios and Twyla each handle personal information in their own right. Studios are responsible for their collection and use of member information, including obtaining consents required before entering information into the Platform. Twyla is responsible for the information it holds and processes in operating the Platform.

2. Information we collect

Account, contact and studio information

• names, email addresses, phone numbers, addresses and account roles;
• Studio business, location, staff and subscription information; and
• account authentication, login and security-event information.

Enrolment and family information

• student names, dates of birth, family relationships and contact details;
• class, program, trial, enrolment, timetable and attendance records;
• emergency, medical, allergy, disability or accessibility information where provided for safety or participation; and
• photos, video or other class media if a Studio uses an enabled media feature and has authority to provide that content.

Enquiries and communications

• enquiry details, communication preferences and marketing consent;
• email and SMS addresses, message content, delivery events and opt-out requests; and
• Facebook or Instagram account identifiers, profile details made available by Meta, message content and attachments when a Studio connects those channels.

Billing and payment information

• billing contacts, fee schedules, payment obligations, transactions, receipts, refunds and payment history; and
• payment tokens or references and safe payment-method details, such as card brand and last digits.

Full card numbers, CVVs and full bank-account details entered into a Fat Zebra-hosted payment form are sent directly to Fat Zebra. Twyla's servers receive a token or reference rather than the full card or bank-account number.

Technical information

We and our infrastructure providers may collect IP address, device and browser details, timestamps, pages or features used, cookie or session identifiers, security events and diagnostic logs. We use this information to operate, protect and improve the Platform.

3. How we collect information

We collect information:

• directly from Studio owners, staff, parents, guardians and enquirers;
• from a Studio when it imports or enters its operational records;
• from payment, email, SMS and connected social-messaging providers when they deliver a service or status event; and
• automatically through the website and application for authentication, security and diagnostics.

Where practicable, information is collected from the person concerned. Information about a child is generally supplied by their parent or guardian, or by an authorised Studio.

4. How we use information

We use personal information to:

• provide enrolment, scheduling, attendance, CRM, billing, reporting and parent-portal functions;
• receive and respond to enquiries and operational communications;
• process card and direct-debit payments through Fat Zebra;
• send account, class, billing, service and consented marketing communications;
• provide support, prevent misuse and maintain the security, integrity and performance of the Platform;
• administer Studio subscriptions; and
• meet legal, regulatory, accounting and record-keeping obligations.

We do not sell personal information. We do not use children's information for advertising, profiling or Twyla's own marketing.

5. Disclosure and overseas processing

We may disclose personal information:

• to the relevant Studio and its authorised staff for that Studio's operations;
• to Fat Zebra to establish and operate the relevant Studio's payment facility and Twyla's separate subscription-payment facility;
• to infrastructure and technology providers that host, secure or support the Platform;
• to email and SMS providers, including Resend and ClickSend, to deliver communications;
• to Meta when a Studio connects Facebook Messenger or Instagram and sends or receives messages through those channels;
• to professional advisers, insurers, auditors and regulators where reasonably necessary; or
• where required by law or reasonably necessary to protect the safety of a child or another person.

Some providers operate global infrastructure, support and delivery networks. Personal information may therefore be processed in Australia, the United States, New Zealand and other countries where our providers or their subprocessors operate. For example, web requests and application data may pass through Vercel's global infrastructure; email data is processed by Resend; SMS content and phone numbers may be processed by ClickSend and telecommunications carriers in several countries; and connected Facebook or Instagram messages are processed by Meta.

Provider locations and subprocessors can change. We take reasonable steps appropriate to the circumstances to assess providers, use contractual and security protections, and handle overseas disclosures consistently with Australian Privacy Principle 8.

6. Data security

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures include role-based access controls, tenant separation, encryption in transit, restricted administrative access, encrypted storage of integration credentials, audit records for significant changes and use of hosted payment capture so Twyla does not store full card or bank-account numbers.

No internet transmission or storage system can be guaranteed completely secure.

7. Retention and destruction

We retain personal information for as long as reasonably needed to provide the Platform, support a Studio's operational records, resolve disputes and meet legal, tax, accounting, payment-scheme and security obligations. Retention periods vary by record type and may also be affected by a Studio's lawful record-keeping requirements.

Payment authorisation and transaction evidence may be retained by the responsible Studio, Twyla and/or Fat Zebra for the applicable legal or scheme period. When information is no longer required and no lawful basis requires it to be retained, we take reasonable steps to delete it or de-identify it.

8. Data breaches

We maintain incident-response procedures. If an incident is an eligible data breach under the Notifiable Data Breaches scheme, we will notify the Office of the Australian Information Commissioner and affected individuals as required by law. Where Studio-supplied information is affected, we will also work with the relevant Studio on its responsibilities.

9. Sensitive information

Medical, allergy, disability and other health information is sensitive information. A Studio must only collect or enter it where reasonably necessary for safety or participation and where the consent or other authority required by law has been obtained. Where a parent or guardian voluntarily provides optional health information through the Platform for that purpose, they consent to Twyla and the relevant Studio collecting and holding it for that purpose. A parent or guardian may ask the Studio to correct or remove it, subject to lawful retention requirements.

10. Children's information

Twyla is designed for activities involving children, so children's information is central to the Platform and is treated with particular care. Children generally do not create their own Twyla accounts; information is supplied and managed by parents, guardians and authorised Studio staff.

• Use is limited to enrolment, attendance, safety, communication, billing and related Studio operations.
• Access is restricted according to role and operational need.
• Studios are responsible for parental or guardian permission for photos, video and the intended use of that media.
• Twyla does not use children's information for advertising, marketing or profiling.

The OAIC is developing a Children's Online Privacy Code, due to be registered by 10 December 2026. We will review the final Code and update our practices and this policy as required.

11. Meta and connected communication channels

A Studio owner may choose to connect a Facebook Page and associated Instagram professional account. To operate that connection, Twyla processes Page and Instagram account identifiers, the connecting Meta user's app-scoped identifier, encrypted access credentials, sender-scoped identifiers, profile details supplied by Meta, and message content or attachments.

We use this information only to connect the Studio's accounts, receive enquiries, display conversations to authorised Studio staff, allow staff to reply and maintain connection security. Twyla does not use this integration for advertising, ad management, Lead Ads, automated Page posting or comment automation.

Disconnecting the channel stops Twyla's future Page access and erases the stored access credential. A valid Meta deauthorisation or deletion callback revokes connections authorised by that Meta account and erases the corresponding credentials. Existing messages may remain in the relevant Studio's operational records where they are not the connecting user's data or where retention is otherwise permitted or required. A sender may request access, correction or deletion by contacting the Studio or privacy@twylahq.com.

12. Access, correction and complaints

You may ask for access to or correction of personal information about you or your child by contacting the relevant Studio or Twyla. You may also complain about how information has been handled. We aim to respond within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. We may need to verify your identity and authority before acting on a request.

13. Payment information

Each participating Studio applies for and operates its own merchant facility with Fat Zebra for payments by its members. Member card and direct-debit arrangements are between the member and the relevant Studio, with Fat Zebra providing payment services. The Studio's Direct Debit Request and Service Agreement governs a direct-debit arrangement.

Twyla's own subscription charges to Studios use a separate Twyla merchant facility and, where applicable, a separate subscription Direct Debit Request and Service Agreement. These two payment relationships are distinct.

14. Changes to this policy

We may update this policy as the Platform, providers or legal requirements change. The current version will be published at this URL with its last-updated date. Material changes will be communicated where required or reasonably appropriate.

15. Contact us