Privacy Policy

Last updated: 18 October 2026

This policy explains how TBO AB ("we", "us") collects and uses personal data when you use BookMyClass: the public booking site at bookmyclass.net and the teacher app at app.bookmyclass.net. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

TBO AB, a company registered in Sweden, is the data controller for teacher accounts, for this website and for our own communication with you. Contact us at hi@bookmyclass.net for any question about your personal data.

When a student books a class, the teacher offering the class decides how the booking data is used and is the controller of that data. We process it on the teacher's behalf to provide the booking service. Students can contact the teacher directly, or us, to exercise their rights.

2. What data we collect

Teachers

  • Account data: email address and password (stored as a secure hash).
  • Profile data you choose to publish: name, profile picture, description and social media handles.
  • Class data: class descriptions, schedules, locations and prices.
  • Payment data: your Stripe account identifier, subscription plan and payout information handled by Stripe.

Students

  • Booking data: email address, the classes you booked, number of spots and booking status.
  • Payment data: payment status. Card details are entered directly with Stripe and never reach our servers.

All visitors

  • Usage data: pages visited, referring website, browser and device type. This is collected without cookies, and IP addresses are not stored.
  • Technical logs: IP address and request details, kept for a short time to operate and secure the service.

3. Why we use your data and our legal basis

  • To provide the service (accounts, booking pages, bookings, payments and related emails): performance of a contract (GDPR art. 6.1.b).
  • To keep the service secure and prevent fraud or abuse: our legitimate interest (art. 6.1.f).
  • To understand how the service is used and improve it, using cookieless, aggregated analytics: our legitimate interest (art. 6.1.f).
  • To send service-related messages to teachers, such as account and billing information: performance of a contract (art. 6.1.b).
  • To comply with accounting and tax rules: legal obligation (art. 6.1.c).

We do not sell your personal data and do not use it for third-party advertising.

4. Who we share data with

We use the following service providers (processors), bound by data processing agreements:

  • Stripe: payment processing and payouts to teachers. Stripe also acts as an independent controller for some payment data; see Stripe's privacy policy.
  • Brevo: sending transactional emails, such as booking confirmations and account verification.
  • PostHog (EU Cloud, data stored in Frankfurt) and Umami: cookieless website analytics.
  • Cloudflare: content delivery, DNS and protection against attacks.
  • Hosting and infrastructure providers: running our servers and databases.

A teacher can see the booking data of students who book their classes. We may also disclose data where required by law.

5. Transfers outside the EU/EEA

We aim to keep personal data within the EU/EEA. Where a provider processes data outside the EU/EEA, we ensure appropriate safeguards are in place, such as an EU adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

6. How long we keep data

  • Teacher account and class data: for as long as the account is active. When you ask us to delete your account, we delete or anonymise this data within 30 days.
  • Booking data: for as long as the teacher's account is active, or until deleted on request.
  • Accounting records, such as invoices and payment records: 7 years, as required by Swedish accounting law.
  • Technical logs: a limited period needed for security and troubleshooting.

7. Cookies and local storage

We do not use advertising or tracking cookies, and our analytics runs without cookies. The teacher app stores a login token in your browser's local storage, which is strictly necessary to keep you signed in. When you pay for a booking, Stripe may set cookies required for payment security and fraud prevention.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to our processing, including processing based on legitimate interest;
  • receive your data in a portable format;
  • withdraw consent at any time, where processing is based on consent.

To exercise your rights, email hi@bookmyclass.net. We reply within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the supervisory authority in your country.

9. Security

We use encrypted connections (HTTPS), hashed passwords and access controls to protect your data. Payments are handled by Stripe, which is certified to the highest payment industry security standard (PCI DSS Level 1).

10. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. We will notify teachers by email of significant changes.