Privacy policy

We may process merchant, staff, and instructor account details; store and class data; customer names, email addresses, phone numbers, Shopify customer and order references; bookings, attendee and check-in records; waitlist entries; waiver signatures, safety notes, emergency contacts, custom form responses, and communication preferences.

Information is provided by merchants, staff, instructors, customers, or guardians and is also received from Shopify through authorized APIs and signed webhooks. We may collect limited technical information such as IP address, browser details, timestamps, and security logs when a waiver is signed or the service is used.

We use information to operate the app, publish classes, synchronize paid orders and inventory, manage capacity, rosters, waitlists, waivers and attendance, deliver service messages, provide support, bill merchants, prevent abuse, protect the service, and meet legal obligations.

For customer and attendee information submitted through a merchant's store, the merchant controls the purpose of processing and Counter Academy acts as its service provider. Customers should contact the relevant merchant first about a booking, cancellation, waiver, or request concerning that merchant's records.

We disclose information only as needed to operate the service, including to Shopify, Vercel for application hosting, Supabase for database infrastructure, and Resend for transactional email. We may also disclose information when legally required, to protect rights and safety, or as part of a business reorganization subject to appropriate safeguards. We do not sell personal information.

Counter Academy reports aggregate paid-seat quantities and reversals to Shopify for app billing. These events contain the Shopify shop identifier, event time, quantity, and an idempotency key. They do not include customer or attendee names, email addresses, phone numbers, or waiver information.

We keep information only as long as needed for the service, merchant instructions, security, disputes, and legal or accounting requirements. Valid Shopify customer data and shop redaction requests are processed through mandatory privacy webhooks. We delete or anonymize covered personal information unless it must be retained by law; archived transaction records are stripped of personal and sensitive waiver details where deletion would damage required business records.

We use access controls, least-privilege permissions, encrypted network connections, signed Shopify webhooks, restricted database policies, secret management, audit logs, and retry-safe processing. No system is perfectly secure; report a suspected issue to us promptly and do not send passwords or payment card numbers by email.

Counter Academy is based in British Columbia, Canada. Our providers may process data in Canada, the United States, or other locations where they operate. Information may therefore be subject to the laws of those jurisdictions, with contractual and technical safeguards used where appropriate.

Depending on applicable law, you may request access, correction, deletion, or a copy of your information, or withdraw consent for optional communications. Merchant customers can make a request through the merchant or contact us with the merchant's store domain so we can route and verify it. Withdrawing consent does not affect earlier lawful use.

Counter Academy is a business tool and is not directed to children. A merchant may run classes for minors, in which case a parent or guardian and the merchant are responsible for providing required information and consent. We do not knowingly invite children to create independent Counter Academy accounts.

Send privacy questions or requests to support@counteracademy.com. We may update this policy as the service or law changes. The current version and effective date will remain posted here, and material changes will be communicated where required.