PRIVACY POLICY

Effective Date: April 30, 2026

Last Updated: November 4, 2026

Introduction

Waking Soul, Inc. d/b/a Soul of Yoga, Soul of Yoga Institute, and related Soul of Yoga programs and services (“Soul of Yoga,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, communicate with us, register for classes, trainings, events, workshops, private sessions, online programs, or otherwise interact with us.

This Privacy Policy applies to information collected through our website, online forms, email communications, class and program registration tools, client portals, payment processes, marketing tools, and related online services. Some third-party services, such as scheduling, payment, video, email marketing, analytics, advertising, social media, customer relationship management, database, and online learning platforms, may also collect information under their own privacy policies.

1. Information We Collect

A. Information You Provide to Us

This may include name, email address, phone number, mailing address, billing information, account information, registration information, class, workshop, training, membership, certification, or program information, communications you send to us, testimonials, reviews, comments, survey responses, and information you provide when registering for yoga classes, teacher trainings, yoga therapy programs, private sessions, events, retreats, livestreams, or online programs.

If you voluntarily provide emergency contact information, accessibility information, accommodation needs, wellness goals, injury information, health limitations, or other sensitive information, we use that information only as reasonably necessary to provide, administer, adapt, or improve the services you request, communicate with you, maintain appropriate records, and comply with legal obligations.

B. Information Collected Automatically

When you use our website or online services, we and our service providers may collect IP address, browser type, device type, operating system, referring website, pages viewed, links clicked, time spent on pages, approximate location information, cookie data, pixel data, tag data, analytics data, ad interaction data, conversion data, and other information about how you interact with our website, emails, ads, and online content.

C. Information Collected Through Platforms and Business Systems

When you register for classes, enroll in trainings, purchase services, participate in online programs, receive emails, or interact with our website or advertisements, information may be collected through platforms we use, including Mindbody, Thinkific, Loyalsnap, FitGrid, Google Workspace, Namaste Light by Emma, Google Analytics, Meta Ads, Microsoft Bing Ads, Reddit Ads, Google Ads, and Keap CRM.

This information may include contact details, account information, course enrollment, class attendance, purchase history, payment-related information, email engagement, website activity, ad interactions, communication history, preferences, administrative notes, and records reasonably necessary to provide services and operate our business.

D. Information from Third Parties

We may receive information from scheduling, class-management, payment, livestream, learning-management, client-portal, marketing, analytics, advertising, customer relationship management, database, social media, business partner, instructor, affiliate, referral, or publicly available sources, where permitted by law.

2. How We Use Information

We use personal information to provide classes, workshops, trainings, memberships, events, private sessions, online programs, and related services; process registrations, purchases, refunds, payments, and account activity; communicate with you about bookings, schedule changes, program requirements, certifications, customer service, and administrative matters; send newsletters, promotional messages, event announcements, and other marketing communications where permitted by law; personalize your experience; improve our website, offerings, programs, and communications; analyze website traffic, marketing performance, and user engagement; protect the security, integrity, and availability of our website, systems, users, and business; prevent fraud, misuse, unauthorized access, and illegal activity; comply with legal, tax, accounting, regulatory, contractual, certification, accreditation, and recordkeeping obligations; and enforce our terms, policies, agreements, and legal rights.

3. Cookies, Analytics, Advertising, and Online Tracking

We and our service providers may use cookies, pixels, tags, web beacons, software development kits, local storage, server logs, and similar technologies to operate our website and online services, remember preferences, analyze website activity, measure marketing performance, deliver advertising, personalize content, and understand how visitors interact with our website, emails, ads, and online programs.

These technologies may be used by us or by third parties such as Google Analytics, Google Ads, Meta Ads, Microsoft Bing Ads, Reddit Ads, Keap, Loyalsnap, FitGrid, Thinkific, Mindbody, and other service providers.

The information collected may include IP address, device identifiers, browser type, operating system, referring pages, pages viewed, links clicked, time spent on pages, approximate location, ad interactions, conversion events, and other online activity information.

For US visitors, advertising measurement and transmission to advertisers, including configured contact matching, are enabled by default unless you opt out through Your Privacy Choices or send Global Privacy Control. We preserve remembered advertising opt-outs. Outside the US, or when we cannot determine your region, optional advertising requires opt-in. Where allowed by these choices, we may send inquiry conversion events and hashed contact details, such as email addresses or phone numbers, to Google Ads, Microsoft Advertising and Meta through website tags and our Keap/Zapier workflows. For US visitors, the advertising choice also controls Google Analytics. An advertising opt-out stops future eligible transmissions; it does not recall data already sent or requests already in flight.

Some advertising and analytics activities may be considered “selling,” “sharing,” or targeted advertising under certain privacy laws, even if we do not sell personal information for money. Where required by law, we will provide appropriate opt-out choices, such as a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link.

You may also manage cookies through your browser settings. Some browsers and devices allow you to send privacy signals, such as Global Privacy Control. Where required by applicable law, we will honor legally recognized opt-out preference signals.

Referral Attribution and Sharing

If you follow an affiliate referral link, we keep limited first-party referral details in your browser for up to 120 days to credit the person who referred you when you submit an eligible inquiry or make a purchase. Ordinary return visits do not extend this period; a new qualifying referral may start a new period. This operational referral attribution works independently of optional analytics and advertising choices and Global Privacy Control. For a referred inquiry, we share your name, email address, phone number, referral code and request identifier with Referral Rock to record the referral and administer our referral program. This does not authorize optional advertising, analytics or advertising contact matching. Referral approval connected with an enrollment continues through our existing course and referral systems. The 120-day period applies to the browser referral record, not to all inquiry, enrollment or provider records. Changing optional measurement choices does not cancel an inquiry's existing referral relationship or automatically delete provider records.

Server-Side Website Measurement

When you allow the relevant measurement, some page-view information is sent through our website server to our advertising providers rather than being sent only by browser tags. Depending on the provider and your visit, this may include the page address without its query string, event time and identifier, advertising or referral identifiers, IP address and browser information. We use this to understand visits and advertising performance and to reconcile browser and server events without counting the same visit twice. Server-side delivery does not bypass your advertising choice or Global Privacy Control. It does not mean that every website visit or inquiry is reported as an advertising conversion.

PostHog Analytics, Heatmaps and Session Replay

For US visitors, our internal measurement, including our own first-party ledger and PostHog, operates independently of advertising opt-out and Global Privacy Control. We use it to understand website use, campaign arrivals, privacy choices and information requests. We do not send records from this internal measurement layer to advertisers. PostHog is a service provider for this internal purpose. Outside the US, or when we cannot determine your region, optional internal analytics requires your analytics opt-in. Our ledger uses browser and visit identifiers, limited campaign labels, page paths and privacy-state reasons to connect visits with saved requests. It does not store contact details, advertiser click identifiers or full URL query strings in arrival and choice events. PostHog may receive page-view and interaction information, heatmaps, masked session replay, and a saved-request event with program and internal identifiers. Our replay configuration masks text and form inputs and excludes forms and embedded frames; analytics events exclude raw inquiry answers, contact fields, advertiser click identifiers and URL query strings. Advertising choices and analytics choices outside the US apply to future collection and delivery. Requests concerning information already collected use the privacy contact process below.

4. Marketing Communications

You may receive marketing emails from us if you sign up, register for a service, attend a program, make a purchase, or otherwise consent to receive communications. You may unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us at info@soulofyoga.com.

Even if you unsubscribe from marketing communications, we may still send transactional or administrative messages, such as registration confirmations, class updates, payment notices, policy updates, safety notices, and customer-service communications.

5. Third-Party Service Providers and Business Tools

We use third-party service providers and business tools to help operate our website, manage registrations, deliver online programs, communicate with students and clients, process business information, analyze website activity, and market our services. These providers may process personal information on our behalf or collect information directly through their own platforms.

Depending on how you interact with us, these providers may include:

• Mindbody - class registration, scheduling, purchases, memberships, client account management, and related studio operations.
• Thinkific - online courses, trainings, educational content, student accounts, and learning-management services.
• Loyalsnap - client communications, retention, marketing, promotions, and customer engagement.
• FitGrid - class-related communications, confirmations, livestream links, teacher/student communications, and engagement tools.
• Google Workspace - email, document storage, internal administration, calendars, forms, and business communications.
• Namaste Light by Emma - email communications, newsletters, spiritual/wellness content, and related audience engagement.
• Google Analytics - website analytics, traffic measurement, usage trends, and performance reporting.
• Meta Ads - advertising, campaign measurement, retargeting, audience insights, and conversion tracking.
• Microsoft Bing Ads - advertising, campaign measurement, retargeting, audience insights, and conversion tracking.
• Reddit Ads - advertising, campaign measurement, audience insights, and conversion tracking.
• Google Ads - advertising, campaign measurement, retargeting, audience insights, and conversion tracking.
• Keap CRM - customer relationship management, lead management, email marketing, sales workflows, and client communications.
• PostHog - internal website analytics, heatmaps, masked session replay and usability measurement; independent of US advertising opt-out, and subject to analytics opt-in outside the US or when region is unknown.
• Referral Rock - operational attribution of affiliate-linked inquiries and purchases and administration of our referral program, independently of optional analytics and advertising choices.
• Cloudflare - website delivery and security, including Turnstile verification to protect forms against automated abuse.
• Zapier - workflow automation connecting Keap and advertising providers for permitted inquiry conversion measurement.

These providers may collect or receive identifiers, contact information, commercial information, registration information, payment-related information, website activity information, device/browser information, communication history, class or program participation information, and other information reasonably necessary to provide their services.

We do not control the privacy practices of third-party platforms when they collect information directly from you. Their use of your information is governed by their own privacy policies, terms, and settings.

Mindbody Scheduling and Booking

Our class schedules and booking tools are provided by Mindbody and may load their own cookies, tags or other technologies when the schedule or booking service loads. These tools operate within a third-party service, and our site's privacy controls do not necessarily control every tag inside it. Mindbody may process booking, account, payment and device information under its own privacy policy. Where available, you can use the direct booking link and review Mindbody's choices and privacy information before continuing.

6. How We Disclose Personal Information

• Studio, scheduling, and registration platforms, including Mindbody, for class bookings, memberships, purchases, attendance records, and client account management.
• Online learning platforms, including Thinkific, for online courses, trainings, student accounts, progress tracking, and educational content.
• Communication and engagement tools, including Loyalsnap, FitGrid, Namaste Light by Emma, Keap, and Google Workspace, for email, class communications, newsletters, promotions, confirmations, reminders, and customer support.
• Advertising and analytics providers, including Google Analytics, Google Ads, Meta Ads, Microsoft Bing Ads, and Reddit Ads, for website analytics, ad delivery, conversion tracking, retargeting, and campaign measurement.
• Database and operations tools for internal recordkeeping, program administration, workflows, and business operations.
• Payment processors, banks, and financial institutions to process payments, refunds, and financial transactions.
• Instructors, facilitators, program staff, contractors, and business partners as needed to provide classes, workshops, trainings, private sessions, retreats, events, online programs, certifications, and customer support.
• Professional advisors, including attorneys, accountants, auditors, consultants, and insurers.
• Government authorities, law enforcement, courts, regulators, or other parties where required or permitted by law.
• Successor organizations in connection with a merger, acquisition, financing, sale, reorganization, or transfer of some or all of our business or assets.
• Other parties with your direction, authorization, or consent.

We do not knowingly sell personal information for money. However, our use of certain advertising, analytics, retargeting, and social media technologies may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws. Where required, we will provide legally required opt-out rights.

7. Notice Regarding Sale, Sharing, and Targeted Advertising

We do not sell personal information in the traditional sense of exchanging it for money. However, some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly enough to include the use of third-party advertising, analytics, social media pixels, retargeting tools, and conversion tracking.

Because we use tools such as Google Analytics, Google Ads, Meta Ads, Microsoft Bing Ads, Reddit Ads, Keap, Loyalsnap, and related technologies, certain disclosures of online identifiers, cookie data, device information, browsing activity, ad interaction data, or conversion data may be considered a sale, sharing, or targeted advertising under applicable law.

Where required by law, you may opt out of this activity by using our privacy choices link, cookie preference tool, browser controls, or another method we make available.

8. Third-Party Websites and Services

Our website may link to third-party websites, platforms, or services, including class registration systems, payment processors, video platforms, social media sites, review platforms, and event tools. We do not control the privacy practices of those third parties. Their privacy policies govern their collection and use of your information. You should review the privacy policies of third-party services before providing information to them.

9. Wellness, Yoga Therapy, and Health-Adjacent Information

Soul of Yoga provides yoga, wellness, yoga therapy education, teacher training, private sessions, workshops, and related services. If you voluntarily provide information about your health, wellness goals, injuries, limitations, accessibility needs, or other sensitive matters, we use that information only as reasonably necessary to provide, administer, adapt, or improve the services you request, communicate with you, maintain appropriate records, and comply with legal obligations.

Please do not send sensitive health, financial, government identification, or other highly confidential information by ordinary email unless we specifically request it and provide a secure method.

Soul of Yoga is not a substitute for medical care. Information provided through our services or website is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

10. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to provide services, maintain business records, comply with legal, tax, accounting, certification, accreditation, dispute-resolution, and contractual obligations, protect our rights, and improve our services.

Raw arrival and privacy-choice events in our internal measurement ledger are retained for 90 days. The first-party browser identifier expires after 90 days, and a visit identifier expires after 30 minutes of inactivity. Operational information requests, consent evidence and provider records follow the other retention criteria in this policy. Retention periods vary depending on the type of information, the nature of your relationship with us, legal requirements, and operational needs. When information is no longer needed, we will delete, de-identify, or securely retain it as permitted by law.

Backup Retention

We keep encrypted backups for recovery and business continuity. These backups may contain information submitted with an inquiry and internal measurement records and may retain them for up to 12 months. Access is restricted to authorized recovery and maintenance processes. Backups are not used for marketing and expire under our retention schedule. If we restore a backup, we apply applicable deletion requests, measurement retention limits and communication preferences before using the restored records.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. However, no website, email system, payment system, or online service is completely secure. You are responsible for using strong passwords, protecting account credentials, and using caution when communicating online.

If we become aware of a security incident requiring notice under applicable law, we will provide notice as required by law.

Form Security and Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms against automated abuse. It evaluates technical browser and connection signals, such as IP address, browser information and the site being visited. This security verification operates separately from optional analytics or advertising choices. Cloudflare describes its processing in the Turnstile Privacy Addendum.

12. Children’s Privacy

Our website and services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without appropriate consent. If we learn that we have collected personal information from a child under 13 without required consent, we will delete it as required by law.

Some programs may be available to minors with parent or guardian involvement, consent, or registration. Parents or guardians may contact us at info@soulofyoga.com with privacy-related questions about a minor’s information.

13. California Privacy Notice

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us. California law may provide the right to know what categories of personal information we collect, use, disclose, sell, or share; request access to personal information; request correction of inaccurate personal information; request deletion of personal information, subject to legal exceptions; opt out of the sale or sharing of personal information; limit certain uses or disclosures of sensitive personal information, where applicable; and not be discriminated against for exercising privacy rights.

Even if not covered, this section is included to provide practical transparency and a framework for handling privacy requests.

California Categories of Personal Information

Sources of Personal Information

We may collect information from you directly, automatically through our website and online tools, from service providers, from business partners, from client-portal or scheduling platforms, and from publicly available sources.

Purposes for Collection and Use

We collect and use personal information for the purposes described in this Privacy Policy, including service delivery, registration, payments, communications, marketing, analytics, security, compliance, and business operations.

Disclosure of Personal Information

We may disclose the categories above to service providers, contractors, professional advisors, payment processors, instructors, business partners, government authorities, and other parties as described in this Privacy Policy.

Sale or Sharing

We do not knowingly sell personal information for money. Certain online advertising, analytics, social media, or tracking activities may be considered a “sale” or “sharing” under California law. Where required, California residents may opt out by contacting us or by using any “Do Not Sell or Share My Personal Information” or privacy-choice mechanism we make available.

Sensitive Personal Information

We do not use sensitive personal information to infer characteristics about you except as permitted by law or as necessary to provide requested services.

Retention

We retain personal information as described in the Data Retention section of this Privacy Policy.

How to Exercise California Rights

To submit a privacy request, contact us at info@soulofyoga.com, by mail at Soul of Yoga, 627 Encinitas Blvd, Encinitas, CA 92024 USA, or by phone at 760-943-7685. We may need to verify your identity before processing certain requests. You may also use an authorized agent where permitted by law. We may deny or limit requests where the law allows, such as when information must be retained for legal, security, transactional, or operational reasons.

14. International Visitors

Soul of Yoga is based in the United States. If you access our website or services from outside the United States, your information may be processed in the United States, where privacy laws may differ from those in your location.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date above shows when it was most recently revised. If we make material changes, we may provide additional notice, such as by posting a notice on our website or sending an email where appropriate.

Your continued use of our website or services after an updated Privacy Policy is posted means the updated policy applies going forward.

16. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Soul of Yoga
Waking Soul, Inc. d/b/a Soul of Yoga
627 Encinitas Blvd
Encinitas, CA 92024 USA
Phone: 760-943-7685
Email: info@soulofyoga.com