Privacy policy

STEPFIT runs fitness classes in Tampa, Florida. This policy covers getstepfit.com and the booking system on it. If you have a question about anything here, use the contact page.

Booking a class stores:

• Your first and last name
• Your email address
• Your phone number
• Confirmation that you are 18 or over
• If you are booking for someone under 18: their name and age
• An emergency contact name and phone number
• Whether you opted in to text messages
• The class you booked and when you booked it
• Your IP address and browser user-agent, recorded with your waiver acceptance

Before a booking is completed you read and sign the informed consent and liability waiver. We store your signature — either the image you drew or the name you typed — along with the version of the document you agreed to, the date and time, your IP address, and your browser user-agent.

We keep this because it is the record of what you agreed to. The waiver is a standing agreement covering all future STEPFIT classes until you revoke it in writing, so if you book again we carry your existing signature forward rather than asking you to sign again.

You can revoke the waiver in writing at any time through the contact page. We record the revocation against your signature, with the date and who actioned it, and from that moment the signature no longer covers a future class — if you book again you are asked to sign again first.

Revoking does not delete the record. The signed acceptance is the evidence of what you agreed to on a particular day, and we keep it for the period set out below whether or not it is still in force; the revocation is a fact added to it, not a replacement for it. Revoking also does not cancel a class you have already booked — we will contact you, and either you sign again or the booking is cancelled and refunded. You cannot take part in a class without a signature in force.

Card payments are handled by Stripe on Stripe’s own hosted checkout page. Your card details are entered on Stripe, never on getstepfit.com, and we never see or store them.

From Stripe we store the amount you paid, when it was paid, and the identifier of the checkout session, so we can match a payment to a booking.

Stripe’s own privacy policy governs what they collect: stripe.com/privacy

Your booking confirmation and class reminder are transactional — you are giving us an address so we can tell you about a class you booked, not subscribing to marketing. Every one of those emails carries a one-click link to cancel your spot.

If you tick the box to receive text messages, that is a separate, optional consent for messages about classes, registration and promotions. It is never required to book. We store the date and time you consented. Reply STOP to any message to stop them, and we record that too.

If you ask us to email you when a new class is posted, that is a separate opt-in list and anything we send from it carries an unsubscribe link.

Email is sent through Resend, which delivers via Amazon SES. Text messages are sent through Textbelt. Your address or phone number and the content of the message pass through those systems.

The contact form sends us your name, email address and message by email. We do not publish an email address on this site, which is why the form exists. Messages are kept so we can follow up.

The form uses a hidden field and a timing check to catch automated submissions, and limits how many messages can be sent from one network address. It also uses Cloudflare Turnstile, which checks that a submission comes from a person rather than a script; making that check sends your IP address and a one-time token to Cloudflare.

The careers page has an application form, and it asks for more than a booking does: your name, email address, phone number, home address, whether you have taught before and where, and anything you write in the free-text fields.

We use it to consider you for the role you applied for and to contact you about it. It is not used for marketing, it is not added to any mailing list, and it is not shared outside STEPFIT.

Applications are stored separately from bookings and are reachable only by a signed-in administrator. If you want yours deleted, ask through the contact page.

STEPFIT is adding measurement and advertising tools to this site: Google Analytics, Google Ads, and a Meta pixel for Facebook and Instagram, all loaded through Google Tag Manager. They are not switched on yet — the cookie policy carries the current status and is updated the day that changes.

Google Analytics tells us how many people reached the site, where they came from, which pages they read and how many finished a booking. The Google Ads and Meta tags report that an ad led to a booking, and let an advert for STEPFIT be shown to you elsewhere afterwards. Those two are cross-site: Google and Meta receive a record of your visit here and they also see you in many other places.

Vercel Analytics and Speed Insights measure page views and loading speed without cookies, do not identify you, and do not follow you to other sites.

None of what you type into the booking form — your name, email, phone, emergency contact, a minor’s details or your signature — is sent to any advertising or analytics tool. None of these run on the admin area. The cookie policy lists each one, the cookies it sets and how to stop it.

Microsoft Clarity records how pages are used — pointer movement, clicks, scrolling, and a replay of the page as it appeared on screen. It is a reconstruction of the page, not a recording of your camera or microphone, and it is held on Microsoft’s systems under Microsoft’s privacy statement.

It is kept off the pages where you type anything that matters. The booking flow, the careers form and the contact form are excluded from recording, because those are the pages carrying a signature on a liability waiver, a child’s name and age, an emergency contact’s phone number, a home address and whatever you write to us. Excluded, not merely masked — a recording of somebody signing a waiver should not depend on a setting being right.

It does not run on the admin area either.

This one is different from analytics and we would rather explain it than list it.

STEPFIT is adding a service called retention.com. Analytics counts visits anonymously. This service attempts the opposite: it takes signals from a visit and matches them against a database assembled from many other websites and sources, and where it finds a match it can tell us that a named person, with an email address, was on this site — even if you never typed anything here and never booked.

What we would use it for is ordinary marketing: knowing that somebody looked at the schedule twice and never booked, and following up. It is still a different proposition from measurement, because the information does not come from you and you were not asked for it. It comes from a third party that already held it.

It runs on the public pages only. It is not on the booking flow, not on the careers form, and not on the admin area. If you would rather not be matched, the browser controls in the cookie policy interfere with it directly, and you can also tell us through the contact page and we will pass it on. Anything we send you carries an unsubscribe link, and one click stops it.

The Tampa page can show a Google map of the venue. It does not load until you press the button to load it — if you never do, nothing is requested from Google and nothing is set on your device.

We use these services, and your information reaches them only as described:

• Supabase — the database holding bookings and waiver records, hosted in the United States
• Vercel — hosting for the website and its server code, including standard request logs
• Cloudflare — the domain’s DNS, and the network your request passes through to reach the site, which means it handles your IP address and standard request information
• Resend — sending confirmation, reminder and contact-form email
• Textbelt — sending text messages, if you opted in to them
• Stripe — card payments, on their own hosted page
• Google — Tag Manager, Analytics and Ads, and Maps only if you load it
• Meta — the Facebook and Instagram advertising pixel, on the public pages
• Microsoft — Clarity session recording, on the public pages, never on the booking flow or the careers form
• retention.com — visitor identification, on the public pages only, as described above

We do not sell your personal information for money, and we never have. We do not sell or rent the booking list, the waiver records, the contact form messages or the job applications to anybody, and nothing you type into this site is passed to an advertising company.

We are being narrower than the usual "we do not sell or share" sentence on purpose, because the advertising and visitor-identification tools described above do involve information about your visit reaching other companies, and under some states’ laws that counts as sharing even when no money changes hands. Saying "we never share anything" while running an advertising pixel would be the kind of sentence this policy exists to avoid.

So: what you give us stays with us and the services listed above that we need to run the studio. What your browser gives to Google, Meta, Microsoft and retention.com while you read the public pages is set out above and in the cookie policy, along with how to stop it.

Waiver acceptances and the bookings attached to them are kept for five years. This is deliberate: the waiver exists to record what you agreed to before taking part in physical activity, and it needs to outlast the period in which a claim could be brought.

Contact form messages are kept for two years. Job applications are kept for one year after we fill or close the role, so we can come back to you if something else opens up — ask us through the contact page and we will delete yours sooner. Email addresses on the new-class notification list are kept until you unsubscribe.

These three periods are settled policy, not estimates. A revoked waiver is kept for the same five years as a live one — revoking ends what it covers, it does not shorten how long the record of it is held.

Analytics, advertising and session-recording data sits with the companies that collect it and is kept under their own retention settings, which are shorter: Google Analytics data on a rolling window we set in the property, and Microsoft Clarity recordings for the period Clarity retains them. We do not keep our own copy of any of it.

You can cancel any booking with the one-click link in your confirmation email. You can stop text messages by replying STOP, and unsubscribe from the notification list from any message it sends.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it, through the contact page. Some records we cannot delete on request — a signed waiver for a class you attended is the record of an agreement you made, and we keep it for the period above.

Classes are for adults 18 and over. Someone under 18 may attend with a parent or guardian, who does the booking and signs on their behalf. In that case we store the minor’s first name, last name and age, given to us by their parent or guardian. We do not knowingly collect information directly from anyone under 18.

If we change this policy we will update the date at the top. Continuing to use the site after a change means the updated policy applies.