Effective Date: September 29, 2026
This Privacy Policy describes how Gafarova Tanzilia ("we," "us," or "our") collects, uses, and protects your information when you use The Art of Practice application and website (the "Service").
The data controller is Gafarova Tanzilia, an individual Hungarian sole proprietor, registered at Szondi utca 2/A, 1201 Budapest, Hungary. Further identifying details are available in our Impressum.
Account Information: When you create an account, we collect your name, email address, date of birth (to confirm you are 16 or older) and payment information. Payment processing is handled by our third-party payment processor (Stripe); we do not store your full credit card details. Where a form or checkout takes personal data without an account, we record that you confirmed you are 16 or older, and when.
Practice Data: The Service collects data you voluntarily enter, including your skills, practice sessions, progress tracking, goals, and related notes.
Community Data: If you participate in community features, we collect your posts, replies, reactions, and any other content you share in community areas. This includes your community profile (your discipline, the line you write under Working on now, and your practice stats only if you turn on Show my practice stats), private messages and message requests you exchange with other members, the members you block, and the reports you make. We do not read private messages between members. If the person who received a message reports it, we keep a copy of that one message with the report so we can review it.
Video and File Uploads: If you upload practice videos or other files, these are stored on Google Cloud Storage. We collect metadata about your uploads (file type, size, upload date) in addition to the files themselves.
Coaching Data: If you use the coach marketplace, we collect data related to your coaching sessions, messages with coaches, reviews, and payment transactions for coaching services.
Usage Data: We collect usage information including login frequency, features used, session duration, pages visited, and actions taken within the Service. This data is collected through our internal analytics system to improve the Service.
Device and Technical Data: We collect your IP address (used for security, rate limits, referral-fraud checks and our records of consents and account actions) and device and technical data such as browser type, operating system, and device identifiers. We do not look up your location from your IP address.
Error and Diagnostic Logs: Our servers keep error and diagnostic logs to monitor stability and fix problems, with email addresses masked. Where switched on, error reports about the AI coach also go to Sentry.
Email Engagement: For email we send through Resend (course and book messages, the launch email, announcements) we receive delivery, bounce and spam-complaint events, and for the launch email whether it was opened and a link clicked.
Notification Data: If you enable push notifications, we collect and store your push notification subscription endpoint to deliver notifications to your device.
If you connect with a coach, book a session, or accept a coaching agreement, that coach becomes a recipient of the data you share with them. Depending on what you choose to share, a coach can see: your name and profile, the skills and practice sessions you share with them, any videos or clips you send for review, your messages with them, your session history and attendance with them, and the reviews you leave. Coaches do not see your practice data for skills you have not shared, your data with other coaches, your payment card details, or your account settings.
Each coach is an independent controller of the data you share with them and is bound by our Data Processing Agreement and Coach Agreement, which require them to use it only to coach you, keep it confidential, and delete it when your engagement ends. You can end a coaching connection at any time in your profile, which stops any further sharing.
If you mentor others. You can sort your students into lists and label clips, reviews and posts. Only you can see your lists and labels, and they use only information you can already see. When you send a message now or schedule it for later, we store it until it is sent and keep a record of what was sent and to whom. When you enroll students in a program, we store who is enrolled and which steps have been sent.
Clips in the mentoring chat. When a mentor sends one of their clips to a student in the mentoring chat, we store a copy that only the two of them can open, and the student can open it only while they are connected.
Read records. We record when a message or group post is first read, so its sender or the group's host can see who has read it. People who are no longer connected to them are counted, not named.
Sessions. If you book or host a mentoring session, we store the session, who holds a place or is on its waitlist, cancellations and attendance. Reminders follow your notification settings.
Calendar links. You can subscribe to your sessions from another calendar app with a private link. Anyone who has the link can see each session's title, who is taking part, the place and the meeting link, and your notes on sessions you host, so keep it private. We store only a scrambled form of the link. Getting a new link stops the old one working.
Connected calendars. A mentor can paste the address of a calendar they keep elsewhere so that its busy times block their bookable hours. We store the address. From the calendar we read only when each event starts and ends and whether it is marked free or cancelled, and we keep only the busy times. We never read event titles, descriptions or guests. You can remove a connected calendar at any time, which deletes its address and busy times, and it is deleted with your account.
Your data is stored on secure servers. We use industry-standard security measures to protect your information. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.
We use the following service providers, each with its own privacy policy. Each receives only the data needed for its function. The full table, with data categories and regions, is on our Subprocessors page.
Content from YouTube, Vimeo and Instagram embedded in the app loads only on the pages that show it, under those services’ own terms (see the YouTube privacy notice). Voice input uses your browser’s own speech service. Our web fonts are served by the app itself.
Where personal data is transferred outside the European Economic Area (for example, to providers located in the United States), the transfer is protected by Standard Contractual Clauses, adequacy decisions where applicable, and other appropriate safeguards.
Essential cookies keep you signed in and remember your cookie choice. Nothing optional runs until you choose: the banner asks every visitor, and Essential Only is as easy as Accept All. If you accept, we record which features you use (sent to our own server, no third-party analytics script), and on the Accelerator checkout page the Meta Pixel measures visits and purchases from our ads. You can change your choice at any time with Cookie Settings. The Cookie Policy lists every cookie.
You have the right to:
If you would prefer that we handle these requests for you, or if you no longer have access to your account, contact us at support@theartofpractice.com.
We retain your account and practice data for as long as your account is active. When you delete your account from Settings → Privacy & Data, your personal data is erased immediately: your profile, practice history, uploaded media, private messages and notifications are removed from our systems on submission. Community posts and replies you have authored are kept but shown as “Deleted user” so other members’ conversations remain readable. Reports you made, or that were made about you, stay in our moderation record without your name and without the reported words. Purchase, booking and signed coaching-agreement records are kept for the period required by tax and consumer-protection law. Purchases and bookings you made no longer point to your account, bookings keep the notes you wrote on them (such as a booking note or a dispute reason), and a coaching agreement you signed keeps your account reference and the IP address and browser you signed from, as evidence of your signature. If you sold through the Service as a mentor, your sales keep your account reference and the notes you wrote on them, each agreement a student signed with you keeps the seller name they saw, and the invoices we issued to you and your seller registration (country, business type, tax status, and the IP address and browser you registered from) are kept too.
If you unsubscribe from our marketing email, we keep your email address on a do-not-mail list, including after you delete your account, so that we never send you marketing again. That list holds only the address and when you unsubscribed. The terms you agreed to when a subscription started (price, renewal, how to cancel) are kept with the subscription at Stripe as proof of your consent.
The Service is not directed to children and does not knowingly collect personal information from anyone under 16 (and, under the US Children's Online Privacy Protection Act, under 13). Sign-up asks for your date of birth before any account exists, including for Google sign-ups, and forms and checkouts that take personal data without an account ask you to confirm that you are 16 or older. We refuse anyone under 16 and keep nothing from the attempt, apart from a cookie that gives the same browser the same answer for 24 hours. If we discover that we hold an account belonging to someone under these ages, we delete that account and its personal data. If you believe a child has provided us with personal information, contact us at support@theartofpractice.com and we will take steps to delete it.
If you are accessing the Service from outside Hungary, your data may be transferred to and processed in countries with different data protection laws. By using the Service, you consent to this transfer.
If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability, the right to restrict processing, and the right to object to processing. Our legal basis for processing your data is the performance of our contract with you (providing the Service) and your consent.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before they take effect.
Where you join The Art of Practice as a student under a Studio license (you accepted an invitation from a studio owner), the following applies in addition to the rest of this Policy.
What the studio owner can see. Studio owners (and their instructor seats) see an aggregate instructor dashboard scoped to their Studio. For each Licensed Student, the dashboard surfaces: display name, email, date joined, last-practiced date, current streak, total practice minutes (all-time, 7-day, 30-day), and inactivity status flags (active / idle 7d / idle 14d). Studio owners do not see the contents of your private sessions, journal entries, clips, or messages, and they do not see your data after you leave the Studio.
Lawful basis. Practice-data visibility to your studio is processed on the basis of your explicit, separately-recorded consent given at invitation acceptance. The exact consent text and the timestamp are stored as an immutable audit record. You can withdraw consent by leaving the Studio (contact your studio owner or support@theartofpractice.com); once you leave, the studio owner's visibility into your data ends.
Roles. For Licensed Student data surfaced in the studio dashboard, the Studio owner is the Data Controller for the teaching context and Gafarova Tanzilia (the operator of the platform) is the Data Processor handling the underlying systems. Your account-level personal data continues to be controlled by us as described elsewhere in this Policy.
Studio audit logs. We retain immutable audit records of: each consent you gave at invitation acceptance (with verbatim text and timestamp), and significant Studio lifecycle events (subscription changes, free-access grants, removals). These exist for accountability and dispute resolution and are accessible only to platform administrators and the relevant studio owner where applicable.
If a Studio cancels. Licensed Students retain Service access for 30 days after the Studio's cancellation event. After that, the Studios-derived entitlement ends and the studio owner can no longer see your practice data. Your personal account, practice history, and any independent subscription you may have remain unaffected.
For privacy-related questions or requests, contact us at:
support@theartofpractice.com