Privacy Policy

This policy explains how 22 Labs (“we”, “us”) collects, uses and protects information when you visit the StudioVector website, create an account, subscribe, or use the StudioVector Mindbody MCP server (together, the “Service”).

Information we collect

• Account signup. When you sign in with Google, we receive the name and email address Google shares with us, and we create your account from that name. When you sign up with an email code, we receive only your email address. The code is sent through our email provider (Resend) and expires after 10 minutes. The sign-up forms use Cloudflare Turnstile (see the addendum below). If you subscribe, we store the plan you choose on that account.
• Account details. Your name, email, studio name and the team members you invite.
• Mindbody data. When your AI assistant asks a question, we read the data it needs from the Mindbody sites you connect, such as locations, classes, schedules, sales, memberships, staff and client records, and pass it back to the assistant. For a late-cancel count, class-roster rows (a client id and attendance flags) are kept for at most 48 hours after the read and are then deleted. For an attendance-with-revenue report, these are also kept for at most 48 hours after the read and are then deleted: the class list (each class's time, name, program, staff member, location and booked and signed-in totals); for each class visit or appointment, the client id, its time, status and staff, and the pricing option used (its name, visits left, payment date and expiry); the appointment clients' pricing options bought in the last two years (the same fields); and for each class or appointment purchase, the buyer's and recipient's client ids, the amount paid, tax, discount and payment method. Names, email, and phone are not kept in the cache, and neither are birth date, address, notes, or card numbers. Disconnecting a site deletes that site's rows. We do keep the locations of a connected site (names and IDs) to count your plan's location limit, and we hold site settings and catalog data, such as programs and staff lists, in memory for a short time so we do not repeat requests.
• Site connection. The Site ID you connect, the activation request and its status, and the locations of that site. The activation code is shown only to you and is cleared once the request is finished.
• Usage data. For each tool call: which tool ran, for which site, whether it succeeded, how long it took, how many Mindbody requests it made and the credits it used, linked to your user and account. We do not record the questions you ask your AI assistant, what you searched for, its answers, or the content Mindbody returns. Our server logs also keep request times, paths, status codes and your user ID, for security and debugging.
• Billing details. Payments are handled by our payment processor. We never see or store full card numbers.
• Technical data. Your IP address is used briefly to prevent signup abuse. The website does not use advertising cookies.
• Checklist email. If you ask us to email the setup checklist, we store the email address you submit and send you that checklist.
• Website analytics. We use Google Analytics, a service of Google LLC, to understand how visitors use the website. Google Analytics uses cookies and similar technologies to collect information such as your IP address, device and browser type, pages viewed and how you arrived at the site. Google processes this information for us and under its own Privacy Policy. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser settings.

How we use it

• To create your user, run your subscription, and send service messages about your account.
• To provide the Service: connecting your AI to the Mindbody data you authorize, through the MCP server, and metering that use in credits.
• To meter credit usage, bill you and prevent abuse.
• To support you, secure the Service and improve it, including by measuring website traffic.

We do not sell your information, and we do not use your Mindbody data to train AI models.

AI processing

StudioVector does not run an AI model and does not use an AI model provider of its own. The AI assistant you connect, such as Claude or ChatGPT, decides when to call our tools. When it does, we read the data from Mindbody and return it to the assistant. That assistant's provider then receives the data under your agreement with them, and we do not control how it handles it. Check your AI provider's data settings before you ask about client information.

Your studio's client data

Your Mindbody site holds personal information about your clients and staff. For that data, you are the controller and we process it on your behalf, only to provide the Service, and we read it only when your AI assistant asks for it. You're responsible for having the right to share it with us. Access is limited to the sites and locations you grant.

Who we share it with

We share information only with service providers that help us run the Service, under agreements that protect it. These include email delivery (Resend), hosting and databases, sign-in (Google), payment processing and website security. The AI assistant you connect is your own tool, not our service provider. We may also disclose information when the law requires it, or as part of a merger or acquisition.

Retention

Account and usage data are kept while your account is active and deleted or anonymized within 90 days after you close it, unless the law requires us to keep them longer. This includes the Site IDs and locations you connected. To close your account, email contact@22labs.io. Class-roster rows, and the visit, pricing-option and purchase rows of an attendance-with-revenue report, are kept for at most 48 hours after the read and are then deleted. Disconnecting a site deletes that site's rows then. To ask for a deletion sooner, email the account owner or contact@22labs.io.

Security

We use encryption in transit, OAuth sign-in, per-site access controls and audit logs of every tool call. No system is perfectly secure, but we work to protect your information and will notify you of a breach as the law requires.

Your choices and rights

You can unsubscribe from emails at any time using the link in any email. Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to certain uses. To make a request, email contact@22labs.io. Requests about a studio's client data are best sent to that studio, and we'll help them respond.

Children

The Service is for businesses and isn't directed to children under 16. We don't knowingly collect their information directly.

Turnstile Privacy Addendum

Last updated: June 18, 2025

1. Introduction. Turnstile, developed by Cloudflare, Inc. (“Cloudflare”), is a pro-privacy website security tool that processes minimal Signals (as defined below) solely to protect web properties against malicious activity by distinguishing human users from bots and blocking bot traffic. Cloudflare does not control whether a website chooses to use Turnstile; instead, we make Turnstile available to any website that is looking for a way to detect and block bot traffic.

2. Scope of this addendum. This Turnstile Addendum is supplemental to Cloudflare's main Privacy Policy. It provides additional information specific to your use and interaction with Turnstile. This Addendum also applies to the personal data processed using Cloudflare's Challenge Platform, and any reference to “Turnstile” in this addendum applies equally to the Challenge Platform. The Cloudflare Privacy Policy continues to apply to your use and interaction with Turnstile, except where this Turnstile Addendum provides more specific information. In those cases, the more specific information will apply instead.

3. Information we collect. Cloudflare Turnstile processes a variety of client-side signals (“Signals”) such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin. Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

4. How we use information we collect.

(i) Bot detection and blocking. Turnstile is a tool to protect web properties by distinguishing human users from bots and blocking any detected bot traffic that could otherwise harm the safety and security of that property. It does so by evaluating the Signals listed above specific to both the website visitor and the website visited. The purpose of collecting these Signals is not to identify, profile or target any individuals but solely to detect and block bots. The Signals collected by Turnstile are strictly necessary for this purpose (i.e. detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile).

Cloudflare is a data processor of Signals that we process to provide the Turnstile service to our customers, that is, securing our customers' websites. This means that we process Signals for this purpose on behalf of, and pursuant to instructions issued by, our website operator customers (who are the data controllers of any data processed for this purpose). If you have questions, or wish to exercise any data protection rights, regarding Cloudflare's processing of Turnstile data to provide our service, please contact the relevant website operator.

(ii) Improving Turnstile's bot detection capabilities. Cloudflare also processes the Signals described in this Privacy Notice to improve Turnstile. This is necessary to refine and improve our bot detection algorithms in order to respond to evolving bot threats, and to maintain the security of the web properties that website visitors choose to visit. Cloudflare is a data controller of Signals that we process to improve Turnstile's bot detection capabilities. This Turnstile Privacy Notice (in conjunction with Cloudflare's main Privacy Policy) governs our processing of Signals for this purpose.

5. Notice to EU and UK residents. To the extent that the data described in the Turnstile Privacy Notice qualifies as personal data, then:

• When processing this personal data as a processor to protect our customers' websites, our customers, as controllers, determine the lawful basis of this processing, and we process this data under their instruction and on their behalf; and
• When processing this personal data as a controller, we rely on our legitimate interests in improving the effectiveness of Turnstile's bot detection capabilities to process this Turnstile data.

6. Cookies. The Signals collected by Turnstile are strictly necessary for the purpose of detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile. For more information about the cookies used by Cloudflare, please check our Cookie Policy and our Turnstile Developer Docs.

Contact for privacy concerns. If you have questions or concerns about this Turnstile Privacy Notice or your personal data processed through Turnstile, please contact Cloudflare's Data Protection Officer at dpo@cloudflare.com.

Changes

We'll update this page when this policy changes. If a change is material, we'll tell you by email or in the Service before it takes effect.

Contact

Questions about privacy? Email contact@22labs.io.