MILA FOXLEY · CUSTOMER INFORMATION

Privacy Policy

Effective October 21, 2026 · Version 2026-10-21.1

This notice covers the Mila Foxley movement studio at app.milafoxley.com, studio purchases, account access and support. Sign-in and enrolment remain closed until their service connections and lesson delivery have been verified. The sales website and earlier preorder records also retain the notices provided at that time.

Information and purposes

For studio accounts we process your email, any supplied name, purchase reference, access start/end, lesson completion and saved playback position to deliver your program. We store hashed one-use sign-in tokens and session identifiers, sign-in timestamps and necessary administrative access-grant records. We do not collect symptoms or medical histories in the studio.

• Website requests: Cloudflare processes technical information, such as IP address and request/browser information, to deliver and protect the website.
• Purchases: PayPal processes payments. We receive order information made available by PayPal, such as name, email, transaction reference, amount and payment status, to manage orders, provide purchased access, keep business records and handle support and disputes. Our website does not collect full payment-card numbers.
• Support: We use your email and message contents to answer inquiries and resolve order or access issues. Please do not send sensitive health records, passwords or payment-card details.

Service providers and disclosures

We use Cloudflare Workers/D1 and private R2 storage for hosting, account records and videos; SendPulse for transactional sign-in emails; Gmail for support; and PayPal for payments. Email delivery status is retained to diagnose missing invitations. Transactional sign-in emails do not subscribe you to marketing. Messages to hello@milafoxley.com are forwarded to foxleymila@gmail.com and replies may come from that address. These providers process information under their applicable terms and privacy policies. Relevant records may be disclosed to payment providers to investigate a dispute or where legally required. Access within our team is limited to people who need the information for these purposes.

Provider notices: Cloudflare, Google, PayPal.

Cookies, advertising and social links

We have not installed advertising pixels, visitor analytics scripts or newsletter signup forms on this website. The studio uses an essential first-party session cookie to keep you signed in for up to 30 days (access is still limited by your purchase). A single-use sign-in link expires after 15 minutes. Infrastructure providers may use technical measures needed to deliver or protect their services. PayPal checkout and linked social platforms operate separately and may use their own cookies. Browser settings allow you to manage cookies. This site does not currently change its behavior in response to Do Not Track signals.

We do not sell customer information or share it for cross-context behavioral advertising. We will review this notice and any required choices before introducing advertising or analytics tracking.

Retention and security

Transient sign-in rate-limit records contain hashed email/IP values and are removed by the daily cleanup after they become 24 hours old (up to about 48 hours total). Expired sign-in tokens and sessions are also cleaned up. Account, progress, purchase and support records are retained only while reasonably needed for delivery, support, required business records or unresolved disputes. You may request deletion, subject to those exceptions.

We retain information for as long as reasonably needed to fulfill orders, provide support, maintain required business records and resolve disputes, and remove information when no longer needed for those purposes. Provider retention rules may also apply. We use reasonable safeguards, but no online service can guarantee absolute security.

Your requests

Email hello@milafoxley.com to request access, correction or deletion of information you provided, or to ask about our practices. We may need to verify your identity using proportionate information. Some records may need to be retained for legal obligations or unresolved transactions. Applicable privacy rights depend on your location and the laws that apply to our business. We will not ask for your full card number to verify a request.

Age, location and changes

The program is intended for adults aged 18 or over. We do not knowingly solicit personal information from children under 13. Contact us if you believe a child has supplied information. Providers may process information in the United States and other countries. Material changes will be reflected in the effective date, with additional notice or consent where required. We will not apply a new purpose retroactively where consent is required.