Privacy Policy

Effective date: 9 October 2026

Applies to kilnflo.com, the Kilnflo application and studio subdomains (for example yourstudio.kilnflo.com) (together, the "Service"). Kilnflo is operated by Kilnflo (ABN 79 893 326 063) ("Kilnflo", "we", "us"). We provide software that pottery studios use to manage classes, bookings, pieces, kilns, firings, members and billing.

Privacy contact: hello@kilnflo.com

This policy sits alongside our Terms of Service. A studio that signs up accepts those terms, and section 10 of them describes how long we keep a studio's data.

1. Who this policy covers, and our role

There are three groups of people whose information we handle:

1. Visitors to kilnflo.com. People browsing our marketing site or signing up.
2. Studio account holders. Studio owners and staff who sign up and use Kilnflo.
3. Studio customers. People who book a class, submit a piece, hold a membership or pay a studio through a studio's Kilnflo page.

For groups 1 and 2, Kilnflo decides how the information is used, and this policy describes that.

For group 3, the studio decides what to collect and why. Kilnflo stores and processes that information on the studio's behalf, only to provide the Service to that studio. If you are a studio customer, the studio is your first point of contact for access, correction and deletion requests. We will help the studio respond. You can also contact us at hello@kilnflo.com and we will pass your request to the right studio.

Each studio is responsible for its own privacy notice to its customers and for having the right to enter their information into Kilnflo.

2. Information we collect

Collected automatically

• Technical and usage data: IP address, approximate location (country or region), browser and device type, pages visited and page performance. This comes from our hosting provider and from privacy-oriented analytics and performance tools (see sections 5 and 6).
• Cookies that keep you signed in, protect sign-in and payment flows, remember your region and remember display choices. See section 6.

Provided by studio account holders

• Name, email address and phone number.
• Studio name, chosen web address (subdomain), time zone, studio contact details, logo and branding.
• Login credentials (passwords are stored hashed).
• Subscription details: your plan, trial and billing dates, and identifiers that link your studio to your Stripe customer and subscription. Card details are entered directly on Stripe's payment page and are never stored on Kilnflo systems. Stripe also collects your email and billing country, and handles its own fraud checks.
• While you are signing up, we hold your email, studio name and chosen subdomain for a short time so we can complete your account once payment details are confirmed. This is cleared when signup finishes or expires.
• Messages and settings you configure, for example notification templates.
• Emails you send us (for example through the contact form, which opens your own email program).

Entered by studios or provided by studio customers (processed on the studio's behalf)

• Name, email address and phone number.
• Class bookings (including attendee details), attendance, gift certificates and discount code use.
• Piece records: photos, notes, firing details and pickup status.
• Membership details, wallet or credit balances, invoices and payment records.
• Payment method references, such as a card-on-file identifier from Square. Card numbers themselves are held by the payment provider, not by Kilnflo.
• Records of email and SMS notifications sent on the studio's behalf, including the message content and recipient.

Studios may record details of minors (for example a child attending a class) supplied by a parent or guardian. Studios are responsible for having that parent's or guardian's consent.

We do not intentionally collect sensitive information (such as health information) and ask studios not to enter it.

3. How we use information

Visitors and studio account holders

• To create and run your account and provide the Service.
• To bill your subscription and process payments.
• To send service messages: receipts, trial reminders, failed-payment and billing notices, security notices, account notices and support replies. These are not marketing.
• To show pricing in a suitable currency, and to limit sign-up to Australia, using approximate location worked out from your IP address by our hosting provider. We do not store that IP address in our database.
• To keep the Service secure, prevent abuse and fraud, and fix faults.
• To measure and improve the Service's performance.
• To send marketing emails, only where you have opted in. You can unsubscribe at any time using the link in the email.

Studio customers

• Only to provide the Service to the studio: managing bookings and pieces, sending notifications the studio has configured, and processing payments for the studio.

We do not sell personal information, and we do not use it for advertising.

4. Who we share information with

We share information only as needed to run the Service, with:

• Studios. Studio customers' information is available to the studio they dealt with, and to that studio's staff according to their roles.
• Service providers. Companies that process data for us under their own security and privacy terms (see section 5).
• Authorities or advisers, where required by law, for legal proceedings, or to protect our legal rights.
• A buyer, if Kilnflo's business is sold or restructured. We would require the buyer to honour this policy.

We do not sell or rent personal information. Links from our Service to other websites are not covered by this policy and we are not responsible for those sites' practices.

5. Service providers and overseas disclosure

We use the following providers. Some are located overseas, so personal information may be processed outside Australia, including in the United States.

Stripe and Square run their own privacy policies for the payment details you give them directly (see Stripe's privacy policy).

6. Cookies and analytics

We use:

• Essential cookies for sign-in sessions, security, the Square connection step (studios only) and short-term booking holds. Cloudflare's bot check on sign-up may also use a short-lived token.
• Preference cookies that remember display settings (list length and view type) and, on kilnflo.com, your region for showing prices (kept for 7 days).
• Vercel Web Analytics and Speed Insights to measure traffic and page performance. These do not use advertising cookies or track you across other sites.
• Stripe's payment page sets its own cookies. They are covered by Stripe's policy.

We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but sign-in will not work without essential cookies.

7. How long we keep information

• Studio account holders and studio customers: while the studio's subscription is active. After a studio is cancelled we keep its data for 90 days (for a failed payment, from the end of the read-only week; otherwise from the date of cancellation), after which we may delete it. Deletion is done by us on request or as part of a regular review, so it can take a little longer than 90 days.
• Billing and financial records (invoices, payments, subscription history): for as long as the law requires us to keep them.
• Message and technical logs: only as long as we need them to run and support the Service.
• Backups: removed on the provider's normal backup rotation cycle.

You can ask us to delete your information earlier (section 10). We may need to keep some records by law.

8. Security

We take reasonable steps to protect personal information, including:

• Encrypting data in transit (HTTPS).
• Separating each studio's data and restricting access by role.
• Storing passwords in hashed form.
• Using payment providers so that card numbers are not stored on Kilnflo systems.
• Checking payment notifications from our payment providers before acting on them.
• Limiting repeated requests, and using Cloudflare Turnstile on sign-up to block bots.
• Limiting access to systems and keys to those who need it.

No system is completely secure.

9. Children

Kilnflo is a business tool and is not directed at children. We do not knowingly create accounts for people under 16. Studios may record a child's details (for example for a class) as supplied by a parent or guardian. A parent or guardian can ask the studio, or us, to access or delete a child's information.

10. Your rights: access, correction, deletion

You can ask us:

• what personal information we hold about you and how we use it;
• to correct information that is inaccurate or out of date; or
• to delete your information, subject to records we must keep by law.

Contact us at hello@kilnflo.com. We may need to verify your identity first. If you are a studio customer, we may direct you to the studio, or pass your request to it.

Complaints. If you are unhappy with how we handled your information, contact us at hello@kilnflo.com so we can try to fix it.

11. Changes to this policy

We may update this policy from time to time. We will update the effective date above and, for material changes, notify studio account holders by email.

12. Contact

Privacy contact: hello@kilnflo.com