Privacy Policy.

What Kneady People holds about you, who we share it with, and how to request that we let go of it. Written in plain English — what you see here is how it actually works.

Effective September 10, 2026

1. Who we are

Kneady People is a platform for massage therapists and bodyworkers — content tools, free utilities, a directory, and a private community. The service is operated by Kneady People LLC, 325 NW 21st Ave Ste 103, Portland, OR 97209, United States. For purposes of GDPR and comparable privacy laws, Kneady People LLC is the data controller for the personal data described in this policy.

2. What we collect

We try to collect the minimum we need to run the service. Specifically:

You give it to us

• Email address — when you subscribe to Kneady News, sign up for an account, or contact us.
• Account profile — name, profile photo, and any other field you fill in (modality, city, practice name, bio, specialties). Optional unless noted.
• Generated content — when you use the Content Studio, the text you provide and the text we generate for you, including any images you generate. We may store these in your account library so you can come back to them. Image prompts are sent to our image provider (see “Who we share it with”) to create the image; the resulting image is stored in our own storage.
• Community content — the posts, comments, reactions, direct messages, and profile details you create in the community. Direct messages are not public, but they are stored on our systems (they are not end-to-end encrypted) and may be read by our moderators when a message is reported or where needed to enforce our Terms, investigate abuse, or comply with law. If you join a live event with your camera or microphone on, your audio and video are captured in the event recording (see our Terms).
• Scheduled posts & connected accounts — if you use social scheduling (a Pro feature), the content you queue and basic metadata about the social accounts you connect (such as the platform username reported back to us). The account connections themselves are held by our scheduling provider, PostForMe (see “Who we share it with”).
• Calendar availability — if you connect Google Calendar (optional, on paid plans), we read your free/busy times and the names of your calendars so scheduling can avoid conflicts. We do not read the contents of your calendar events, and we store only an encrypted token to keep the connection working. You can disconnect at any time.
• Affiliate referrals — if you arrive through an affiliate's referral link, we record the referral code so the affiliate can be credited for our in-house affiliate program (The Fascia Network). See “Cookies” below.
• Tool inputs — what you type into tools like Haiku Generator, SOAP Notes, Rate Raiser, Testimonial Request, and Review Cards. We send it to our AI provider to generate your result and return it to you; we don't keep these one-off tool inputs afterward unless you save the result to your library.
• Payment info — when you subscribe to a paid plan, Stripe collects your payment-card details directly. We never receive or store your full card number; we store a Stripe customer ID and basic subscription status (plan, status, renewal date).

We collect automatically

• Server logs — IP address, user agent, requested URL, timestamp. Used for rate-limiting (to keep the AI tools from being abused) and for security investigation if something looks wrong.
• Cookies — Clerk sets a session cookie when you sign in. If you arrive through an affiliate's referral link, we set our own first-party cookie to attribute the referral for our in-house affiliate program (The Fascia Network). See section 6 for the full cookie list.
• QR-code scan telemetry — when someone scans a dynamic QR code that a paid Kneady People member has generated (the ones that resolve via kneadypeople.com/q/… before redirecting to the member's destination), we log a scan event so the code's owner can see aggregate scan counts and coarse breakdowns. The event stores a hashed(one-way, non-reversible) IP address and user agent, coarse geographic hints derived from the IP by Vercel (country, region, city — no precise location), and a coarse device and OS category. No cookies are set, no cross-site tracking or fingerprinting is performed, and no personally identifying data is stored. Static free-tier QR codes are not tracked because they point straight at the destination and never touch our servers.

We don't collect

• Identifiable patient records or protected health information (PHI) — we don't ask for it and don't provide these tools as a place to store it. Kneady People is not an electronic health record (EHR) system, practice-management platform, or HIPAA-compliant records service. The Content Studio, SOAP Notes, and related tools are drafting aids only — not intended for the storage or transmission of identifiable patient records, and not for regulated clinical recordkeeping. The SOAP Notes tool is designed to not require client identifiers, and we ask you not to paste any. Because these tools accept free text, it is technically possible to enter PHI — but if you do, you do so at your own risk. That does not make Kneady People a HIPAA-covered entity or business associate, no Business Associate Agreement (BAA) is offered, and entering PHI through our tools may itself constitute a HIPAA violation on your part as the covered practitioner.
• Precise or background location. The only location we use is what you voluntarily provide — the city on a directory listing, or a search area you type into a tool such as Referral Radar (which we send to Google's Maps/Places service to find nearby businesses; see “Who we share it with”).
• Behavioral advertising data. We don't use ad networks.

3. How we use it

• To operate the service — sign you in, render your account, process tool requests, deliver newsletter issues, send transactional emails (password resets, receipts, etc.).
• To keep the service safe — rate-limiting, abuse detection, security investigation, fraud prevention.
• To improve the service — aggregated analytics about which tools are being used, where errors happen, what's slow. We do not use behavioral profiling for advertising or automated eligibility decisions.
• To communicate with you about Kneady People — newsletter issues (only if you subscribed), product updates, occasional announcements. You can opt out at any time.
• To power per-code scan analytics for the owner of a dynamic QR code. The owner sees aggregate scan counts and coarse geographic/device breakdowns — never individual identities.

4. Lawful bases (EU/UK)

For users in the EU, UK, or other jurisdictions whose data protection law requires us to identify a lawful basis under Article 6 of the GDPR (or its UK equivalent), we rely on:

• Contract (Art. 6(1)(b)) — to provide the account, tools, and paid features you signed up for: storing your profile, processing tool inputs, delivering Studio outputs, handling subscription billing.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, rate-limit public endpoints, investigate incidents, and improve the product through aggregated, non-profiling analytics. We've weighed these interests against your privacy and consider them proportionate; you may object under section 8 below.
• Consent (Art. 6(1)(a)) — for the newsletter and any other optional marketing communication. You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws and respond to lawful requests from competent authorities.

5. Who we share it with

We use a small number of well-known service providers (called “processors” under GDPR) to run the platform. Each one sees only what it needs to do its job, and each is contractually bound to handle your data confidentially.

Some pages also load resources directly from third parties in your browser: OpenStreetMap (map tiles on the directory and site maps) and Google Fonts (web fonts). To deliver those, the provider necessarily receives your IP address. They are not used to track you across sites, and we don't share any account information with them.

We do not sell your data. We do not share it with advertisers. We do not allow our processors to use it for their own marketing.

Data processing agreements (DPAs). Where required by applicable law, we enter into appropriate data-processing agreements with our service providers. We do not currently offer a custom controller-to-controller or controller-to-processor DPA for business customers except where required by law; if you operate in the EU/UK and need a written DPA, contact hello@kneadypeople.com and we will work with you in good faith.

We will disclose your data when legally required — a valid subpoena, court order, or comparable lawful request. If permissible, we will notify you first.

6. Cookies & similar tech

• Session cookies — set by Clerk to keep you signed in. Required for authenticated functionality.
• Affiliate referral cookie — if you arrive through an affiliate's referral link, we set our own first-party cookie to attribute that referral so the affiliate can be credited, for our in-house affiliate program (The Fascia Network). It is not used for advertising or cross-site tracking. Where consent is required for non-essential cookies (for example in the EU/UK), we obtain it before this cookie is set.
• Third-party map & font requests — some pages load map tiles from OpenStreetMap and web fonts from Google Fonts directly in your browser. Those providers receive your IP address in order to deliver the tiles/fonts, but this is not used to track you across sites.
• Analytics cookies — none today. If we add analytics later, we'll update this policy and offer a way to opt out. The QR-code scan telemetry described in section 2 is cookie-less and cannot identify you across sites.
• Ad cookies — never.

7. How long we keep it

• Account data — for as long as your account is active. When you delete your account, we delete your row from Supabase within 30 days. Backup retention may extend this by up to 90 days.
• Generated content — same retention as your account; deleting your account deletes your library, including generated images.
• Community content & live-event recordings — kept while your account is active and the community remains available. Recordings of live events are retained so members can replay them; you can ask us to remove a recording you appear in. Deleting your account removes your posts, messages, and profile.
• Newsletter email — until you unsubscribe. Beehiiv keeps an “unsubscribed” record so it doesn't re-email you accidentally.
• Server logs — Vercel retains request logs for up to 30 days, depending on plan.
• Rate-limit counters — Upstash records have a TTL measured in minutes.
• QR scan telemetry — retained while the associated QR code exists so the code's owner can see historical scan counts. Deleting the QR code removes its scan records. There is no per-record TTL today; a periodic cleanup policy is on the roadmap.

8. Your rights

You have rights over the data we hold about you. Depending on where you live (EU/UK, California, elsewhere), the specific rights differ — but we honor the same baseline regardless:

• Access — ask us what we hold about you and receive a copy.
• Correction — ask us to fix anything that's wrong.
• Deletion — ask us to delete your account and everything in it. Today, deletion is initiated by emailing us (see below); a self-serve flow inside account settings is on the roadmap.
• Portability — ask us for a copy of your generated content in a portable format.
• Withdraw consent — unsubscribe from the newsletter or any other communications at any time.
• Object / restrict — ask us to stop using your data for a specific purpose, where applicable.
• Lodge a complaint — with your local data protection authority. EU/UK residents can reach the ICO, CNIL, or comparable body; California residents can contact the California Privacy Protection Agency.

To exercise any of these, email hello@kneadypeople.com. We respond without undue delay and within one month of receiving your request. For unusually complex requests, we may extend by up to two additional months and will tell you why within the first month, consistent with GDPR Article 12(3).

9. Automated decision-making

We do not use automated decision-making, including profiling, to make decisions about you that produce legal effects or similarly significant effects (such as denying you access, adjusting your pricing based on a behavioral score, or anything comparable). Our AI tools generate content at your request — they do not make decisions about you. This addresses your rights under GDPR Article 22 and equivalent provisions elsewhere.

10. Data breach notification

If we become aware of a personal data breach that affects your data and is likely to result in risk to your rights or freedoms, we will notify you and applicable supervisory authorities without undue delay — and, where feasible, within 72 hours of becoming aware of it, as required by GDPR Article 33. We also comply with applicable US state breach-notification laws, including Oregon's Consumer Information Protection Act (ORS 646A.600 et seq.), which set their own notification timelines.

Notifications will describe the nature of the breach, the categories and approximate number of affected records, likely consequences, and steps we've taken or recommend you take to reduce harm.

11. International transfers

Kneady People is operated from the United States and is primarily targeted at US-based massage therapists and bodyworkers. The processors listed above are primarily US-based. If you're using the service from outside the US, your data will be transferred to and processed in the United States and other countries where our processors operate. We rely on Standard Contractual Clauses (or equivalent transfer mechanisms) for any transfers from the EU/UK that require them.

We are based in the United States and our infrastructure is US-based. Where residents of the EU, UK, or other regions sign up for or purchase the service, we honor the data-protection rights described in this policy and rely on Standard Contractual Clauses (or equivalent mechanisms) for the resulting transfers. If you are an EU/UK resident and prefer not to have your data transferred to the United States, please do not create an account. We are working to formalize EU/UK representation as our presence in those markets grows.

12. Notice to California residents

This section provides the specific disclosures required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months and have no plans to do so.

Categories of personal information we collect (as defined by Cal. Civ. Code § 1798.140):

• Identifiers (email address, account name, IP address).
• Customer records (profile information, billing details).
• Commercial information (subscription status, transaction history).
• Internet activity (server logs limited to security and rate-limiting purposes).
• Geolocation data (only what you voluntarily provide — the coarse, city-level location on a directory listing, or a search area you enter into a tool such as Referral Radar).
• Inferences (none — we don't build behavioral profiles).

Sources, purposes, and retention are described in sections 2, 3, and 6 above and apply equally to California residents.

Sensitive personal information. We do not collect sensitive personal information as defined by the CPRA. If you voluntarily submit such information (for example, by pasting it into a tool input despite our request not to), we do not use it beyond what is necessary to provide the requested service.

Your California-specific rights include the right to know what we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (not applicable since we don't sell or share), and the right to limit use of sensitive personal information (also not applicable since we don't collect it for secondary purposes). To exercise any of these, follow the process in section 7 above.

Non-discrimination. We will not discriminate against you for exercising any of these rights — your access, pricing, and service quality remain the same.

Your privacy choices. Because we do not sell or share your personal information, there is nothing to opt out of — but you can still exercise any of the rights above (access, correction, deletion, portability) by emailing hello@kneadypeople.com with the subject “Privacy request.”

Questions or complaints can also be directed to the California Privacy Protection Agency at cppa.ca.gov.

13. Children

Kneady People is intended for working adults. We do not knowingly collect personal data from anyone under 16. If we learn we've collected data from a child, we will delete it.

14. Security

We follow industry-standard practices to protect your data: server-side authorization checks on every request as the primary access control, with database-level policies as an additional defense-in-depth layer; server-side-only API keys; HTTPS-only with HSTS; rate-limited public endpoints; and regular dependency updates. No system is perfectly secure, but we treat your data the way we'd want ours treated.

15. Changes to this policy

If we make material changes — new processors, new categories of data, new purposes — we'll update the effective date at the top and notify active accounts by email. Continued use of the service after the effective date means you accept the updated policy.

16. Contact

Questions about this policy, or about how we handle your data? Write to hello@kneadypeople.com and we'll get back to you.