Privacy Policy

This Privacy Policy explains how Westra ("Westra", "we", "us") collects, uses, and protects personal data in connection with Westra (the "Service"). It should be read alongside our Terms of Service.

This is a general‑purpose template intended to be reviewed by qualified legal counsel and completed with your registered business and contact details — including under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and any other law applicable to your business — before being relied upon in production.

1. Controller vs. processor — who's responsible for what

Westra is multi‑tenant software used by independent businesses ("Studios") to manage their own clients, providers, and leads. For a Studio's own account data (e.g. the business name, the admin's name/email/phone, and billing details), Westra acts as the data controller. For personal data a Studio enters about its Clients, Providers, and Leads ("Studio Data"), the Studio is the data controller and Westra acts only as a data processor, processing that data solely to provide the Service on the Studio's instructions. If you are a client, provider, or lead of a Studio and have a question about your personal data, please contact that Studio directly — we will assist the Studio in responding to your request.

2. Information we collect

• Account data — name, email and/or phone number, password (hashed), role, and language/theme preferences, for anyone who logs into the Service (admins, managers, providers, clients).
• Studio Data — records a Studio enters or generates while using the Service: client/provider/lead profiles and contact details, custom fields, tags, session bookings and attendance history, credit packages and enrollments, payments and payment status, notes, and file/photo attachments.
• Communications — messages you send us for support, and outreach we send during the closed beta (e.g. WhatsApp or email) to help with onboarding.
• Usage & log data — pages visited, actions taken, IP address, device/browser information, and timestamps, used for security, debugging, and abuse prevention (e.g. login‑attempt throttling, integration call logs).
• Cookies — strictly necessary cookies for authentication/session management, CSRF protection, and remembering your light/dark theme preference. We do not use third‑party advertising or cross‑site tracking cookies within the app.

3. How we use information

• To provide the core Service: scheduling, attendance/clock‑in‑out, credit tracking, billing records, and reporting for each Studio;
• To send in‑app notifications (e.g. low‑credit alerts, renewal reminders, follow‑up reminders) and, where a Studio enables it, to help staff send manual WhatsApp reminders or push sessions to a connected Google Calendar;
• To operate the closed beta — including reviewing signups and reaching out to activate accounts;
• To maintain security, investigate suspicious activity, and enforce our Terms;
• To improve and troubleshoot the Service, and to comply with legal obligations.

We do not sell personal data, and we do not use Studio Data to serve advertising.

4. Third parties & sub‑processors

• Google Calendar — if a Studio connects its own Google account, we store the OAuth access/refresh tokens in encrypted form and use them only to create, update, or remove calendar events for that Studio's own sessions on a calendar it controls, per the toggles it sets (e.g. whether to invite the client/provider).
• WhatsApp — reminder messages are opened as a pre‑filled "click‑to‑chat" link on the logged‑in staff member's own device and WhatsApp account. Message content is not routed through a WhatsApp Business API by Westra's servers.
• Hosting & infrastructure providers — we use third‑party infrastructure (hosting, database, and, once configured, transactional email delivery) to operate the Service; these providers process data only as necessary to deliver that infrastructure and are bound by appropriate confidentiality/data‑processing terms.
• We may disclose information if required by law, to protect our rights or the safety of our users, or in connection with a merger, acquisition, or sale of assets (with notice where required).

5. Data retention

We retain account and Studio Data for as long as the relevant account/tenant is active. Certain records (e.g. deleted clients, sessions, or leads) are initially soft‑deleted and recoverable for a limited period before permanent deletion. When a Studio closes its account, we retain its data for a reasonable period to allow export, after which it is deleted or anonymized, except where we are required to retain it for legal, accounting, or security purposes.

6. Data security

Access to Studio Data is scoped per tenant and further restricted by role‑based permissions within each Studio. Passwords are hashed, sensitive integration tokens (e.g. Google Calendar credentials) are encrypted at rest, and uploaded files are served through access‑checked, non‑public storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Depending on your location and applicable law (including Indonesia's Personal Data Protection Law), you may have rights to access, correct, delete, or export your personal data, to withdraw consent, or to object to certain processing. Studio admins/managers can access, correct, and delete data through the Service itself; account holders may update their own profile from within the app. If you are a Studio's client, provider, or lead, please direct these requests to that Studio in the first instance — we will support the Studio in fulfilling them as its processor. Otherwise, contact us at hello@getwestra.com.

8. International data transfers

Depending on where our infrastructure providers operate, personal data may be processed in a country other than where you or the relevant Studio are located. Where this occurs, we take reasonable steps to ensure appropriate safeguards are in place consistent with applicable data protection law.

9. Children's data

The Service itself is intended for use by business staff, providers, and their adult clients — it is not directed at children as account holders. Some Studios (e.g. music schools, swim schools, tutoring centres) may store records about minors as part of their own client base (for example, a child's name, date of birth, or guardian contact). That data is Studio Data controlled by the Studio, which is responsible for ensuring it has an appropriate legal basis (such as parental/guardian consent) to collect and store it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by other reasonable means, and the "Last updated" date above will reflect the most recent revision.

11. Contact

Questions about this Privacy Policy or how your data is handled can be sent to hello@getwestra.com.

See also our Terms of Service.