elastudio Cookie Notice

Version 1.9. Effective date: 27 October 2026. Version 1.8 applied earlier that day. Version 1.7 applied from 21 October 2026. Version 1.6 applied from 18 October 2026. Version 1.5 applied from 16 October 2026. Version 1.4 applied earlier that day. Version 1.3 applied from 15 October 2026. Version 1.2 applied from 14 October 2026. Version 1.1 was the first version for the live elastudio website, from 13 October 2026. Version 1.0 applied only to a preview of this website before elastudio went live.

This notice explains the cookies and similar technologies (such as browser storage) used on elastudio.app, on the elastudio sign-in and sign-up pages at app.elastudio.app, in the studio dashboard, on studio booking pages served by elastudio, and in the elastudio booking widget on studios’ own websites. It is part of our Privacy Policy.

A cookie is a small text file a website saves in your browser so it can remember something, for example that you are signed in. Browser storage (localStorage, which stays until it is cleared, and sessionStorage, which is cleared when you close the tab) works in a similar way.

The short version

• Analytics cookies are off until you say yes. We load Google Analytics 4 and Microsoft Clarity only on elastudio’s own website pages (the home, pricing, help and legal pages), and Microsoft Clarity alone on elastudio’s sign-in and sign-up pages at app.elastudio.app, never on studio booking pages or the studio dashboard, and only after you click “Accept all” or switch analytics on in “Cookie settings”. app.elastudio.app asks for its own choice, because it cannot read the choice you made on elastudio.app (and the other way round). Studio booking pages and app.elastudio.app share the elastudio.app address, so if you accepted analytics, your browser keeps those cookies and may send them along when you open one of these pages. Studio booking pages never load the analytics tools and elastudio does not read those cookies there; app.elastudio.app loads Microsoft Clarity only if you accepted analytics on app.elastudio.app itself, and, if you also accepted analytics on elastudio.app, Clarity may recognise its own cookie from there, so a visit that goes from our website to sign-in or sign-up counts as one visit.
• “Reject all” is as easy as “Accept all”, and you can change your mind at any time through the “Cookie settings” link at the bottom of every public page and of the pages at app.elastudio.app.
• The studio dashboard, studio booking pages and the booking widget use only strictly necessary cookies and storage, and so do elastudio’s sign-in and sign-up pages at app.elastudio.app unless you accept analytics there, plus one note in your browser tab of how you arrived at a studio’s booking pages (never for visitors from the European Union, the European Economic Area, the United Kingdom or Switzerland). No analytics tools, no advertising cookies. When you pay on a booking page, Stripe, the payment provider, sets its own fraud-prevention cookies (listed below). The note (els.attr.first:<studio>) and the booking steps the widget tells the studio’s own website about are explained in “How you found the studio” below.
• Language and currency by country use no cookie. elastudio.app chooses the page language (Brazilian Portuguese for Brazil; Spanish, on the pages under elastudio.app/es, for Spanish-speaking countries; English elsewhere) and the currency of prices from the country your connection comes from, as worked out by our hosting provider Cloudflare, and does not store it (see section 2 of our Privacy Policy). Only if you use the language switch, or open a link that asks for a specific language (such as the links in the elastudio dashboard and on the sign-in page), do we set the els_lang cookie to remember that language.
• Campaign links. If you reach elastudio.app through a link with campaign tags (such as utm_source), the sign-up links on the page carry the same tags, whether or not you accept analytics; we do not store them unless you accept, apart from our hosting provider’s security logs, which keep the addresses of pages opened for up to 7 days. Only if you accept analytics do we also remember, for 90 days and only in your browser, which campaign links brought you here (els_attr, listed below), and only then do sign-up links also carry an ad click id.
• We do not use advertising cookies ourselves and we do not sell your data. Microsoft Clarity sets a Microsoft identifier (MUID) that Microsoft may also use across its own services, including advertising, under the Microsoft Privacy Statement.

Who is responsible

elastudio is operated by Edilson Brito Bezerra Junior, operating as BRITO.AI, a sole proprietorship registered in Ontario, Canada, 73 Watt Street, Guelph, Ontario N1E 6W6, Canada. We are the controller for elastudio.app, including the sign-in and sign-up pages at app.elastudio.app. On studio booking pages and in the widget, the studio is responsible for its members’ data and elastudio provides the service on its behalf. On a studio’s own website, the studio is responsible for its cookie notice; elastudio gives studios a short description of the widget’s storage to include.

Legal basis. Strictly necessary: needed to provide the service you asked for (LGPD art. 7, V), and our legitimate interest in keeping it secure and in remembering choices you make, such as your language (LGPD art. 7, IX); for visitors from the EU or UK, GDPR art. 6(1)(b) and (f), and exempt from consent under ePrivacy rules because each one is needed for a service you asked for or is set only when you make a choice or open a link that asks for a language. Analytics: your consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can withdraw at any time. Because analytics data goes to Google and Microsoft in the United States, the banner tells you so before you choose, and your consent also covers that international transfer (LGPD art. 33, VIII).

Contact. Privacy officer and encarregado (data protection officer under Brazil’s LGPD): Edilson Brito Bezerra Junior, privacidade@elastudio.app.

Strictly necessary (always on)

These make the site work, keep it secure and remember choices you make, such as your cookie choice and your language. The law allows them without consent. You can block them in your browser, but then sign-in and booking will not work, and the site will not remember your choices (such as your cookie choice, language or theme).

Name	Set by	Purpose	Lasts
els_consent	elastudio	Remembers your cookie choice (accept or reject) so we do not ask on every page: one on elastudio.app and a separate one on app.elastudio.app, each for its own address	6 months
els_lang	elastudio	Set on elastudio.app only when you use the language switch or open a link that asks for a specific language (such as the links in the elastudio dashboard and on the sign-in page): remembers English, Brazilian Portuguese or Spanish, so we stop picking the language from the country you visit from	1 year from when it was last set
__Host-sla_session_<studio>	elastudio	Keeps you signed in to one studio’s pages (one per studio)	30 days, renewed while you use it
__Host-sla_oauth, __Host-sla_oauth_bind_<studio>	elastudio	Protects Google sign-in against forgery	10 minutes
__Host-sla_pwwin_<studio>	elastudio	Keeps you signed in inside the secure elastudio window where you create or change your password, when you start from a studio’s website (one per studio); it works only in that window and gives no access to the rest of your account	10 minutes, deleted when you save the password or cancel
__Host-sla_hub	elastudio	Keeps you signed in at app.elastudio.app, elastudio’s sign-in page where you choose which studio to open	30 days
__Host-sla_hub_pre, __Host-sla_hub_g, __Host-sla_hub_open	elastudio	Protect against forgery at app.elastudio.app: the sign-in code and link work only in the browser that asked for them, Google sign-in only in the browser that started it, and opening a studio only in the browser that chose it	__Host-sla_hub_pre 15 minutes, __Host-sla_hub_g 10 minutes, __Host-sla_hub_open 2 minutes
__Host-sla_hubbind_<studio>	elastudio	Set by a studio’s pages when you open that studio from app.elastudio.app, so the one-time sign-in works only in your browser	2 minutes
els_gcal_state	elastudio	Protects a teacher’s Google Calendar connection	10 minutes, deleted when the connection finishes
Browser storage: sign-in tokens of the booking widget	elastudio	Keeps you signed in inside the booking widget on a studio’s website, without third-party cookies	Up to 30 days
Browser storage: language choice (sla.locale in the app; els.hub.lang on app.elastudio.app, set only if you switch the language; els_lang_hint on elastudio.app, set when you dismiss the language suggestion)	elastudio	Remembers your language	Until you clear it
Browser storage: staff preferences (els.reports.delimiter, els.admin.sidebarRail.<staff id> and els.recentActivity.kind.<staff id>, studio dashboard only)	elastudio	Remembers the column separator a staff member chose for report downloads, that a staff member collapsed the dashboard menu on this device, and which kind of recent activity a staff member chose to see on Today, each set only if a staff member makes that choice	Until you clear it
Browser tab storage (sessionStorage, deleted when you close the tab)	elastudio	Keeps your place while you book, buy or request a private session, the schedule view you chose, the step you are on while signing in with Google or with your password in the secure window, and that the page just reloaded itself after an update (so it does not reload again)	Until you close the tab
Browser storage: theme (els_theme, elastudio.app only)	elastudio	Remembers light or dark mode, set only if you change it	Until you clear it
Browser storage: copy of your cookie choice (els_consent_log, elastudio.app only)	elastudio	Keeps the date, banner version and choice together with the els_consent cookie	6 months, removed with the cookie
Browser storage: your agreement to the help assistant’s notice (els_help_consent, elastudio.app help centre only)	elastudio	Remembers that you agreed that your questions go to Anthropic in the United States, so the assistant does not ask on every page: a random identifier, the version and language of the notice and the date and time, never your questions. Set only when you click “I agree, continue” in the assistant; removed when you click “Withdraw agreement”	6 months, or until the notice changes (then removed the next time you open the help centre); removed at once if you withdraw
Record of your cookie choice (on our server, not in your browser)	elastudio	For each choice made on elastudio.app or on app.elastudio.app: a random identifier (the same one stored with your cookie choice in your browser), your choice, the banner version (which also tells which of the two addresses it was), the language of the banner and the date and time, plus a scrambled code (a keyed hash) of your network (the first part of your IP address), used only to limit abuse. We do not store your name, your full IP address or your browser details. It lets us prove consent was given	20 months
Record of your help assistant agreement (on our server, not in your browser)	elastudio	The same random identifier as in els_help_consent, the version and language of the notice and the date and time. We do not store your questions, your name, your IP address or your browser details. It lets us prove consent was given	20 months
__stripe_mid, __stripe_sid	Stripe	Prevent payment fraud when you pay on a booking page or for an elastudio plan	__stripe_mid 1 year, __stripe_sid 30 minutes
m	Stripe, on its own domain (m.stripe.com)	Fraud detection: helps Stripe assess the risk of a payment attempt when you pay on a booking page or for an elastudio plan	Up to 2 years, as Stripe states; some browsers, such as Chrome, keep a cookie for at most 400 days (about 13 months)
Cloudflare security cookies (for example __cf_bm, cf_clearance, _cfuvid)	Cloudflare	Tells real visitors apart from automated bots and protects against attacks	30 minutes to 1 year, set only when needed

How you found the studio (studio booking pages and the booking widget)

When you open a studio’s booking page on elastudio, or its booking widget on the studio’s own website, elastudio notes in your browser tab where that visit came from, so the studio can see which of its links and campaigns bring new members. The studio is responsible for this (it is the controller of its visitors’ and members’ data); elastudio does it on the studio’s behalf, as its processor. Legal basis: in Brazil, the studio’s legitimate interest in knowing how people find it (LGPD art. 7, IX, and art. 10); in Canada, the studio tells you about it in this notice and in its privacy notice, and you can object at any time. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, this note is not made at all, because the law there requires your consent before anything that is not strictly necessary is stored in your browser. It is never used for advertising, never sent to advertising platforms, never shared with other studios and never combined across websites.

Name	Set by	Purpose	Lasts
els.attr.first:<studio> (browser tab storage, sessionStorage; one per studio)	elastudio, on the studio’s booking page or on the studio’s website where the widget runs	The first page of the visit you opened in this tab: its campaign tags if the link had them (utm_source, utm_medium, utm_campaign, utm_term, utm_content), whether the link came from an ad on Google, Meta or Microsoft (only which one, never the ad’s click code), the name of the website you came from (only its address, such as www.instagram.com, never the page), the page where you first landed, on the studio’s website or on its booking page on elastudio (its route only, such as /ela/class/:id, with any codes in it removed and never its query), and the date and time. Nothing that names you: values that look like an e-mail address are dropped, and a visit that starts on a sign-in, password, invite or payment link is never recorded. If you sign up or buy in that tab, it is sent once to the studio with your sign-up or purchase and kept in your member profile as “how you arrived”, where only the studio’s team sees it. It is included in your data download, and you can ask the studio to delete it at any time	In your browser: until you close the tab. In your member profile, if you sign up or buy: until your account is deleted, or sooner if you ask the studio to delete it

Booking steps on the studio’s own website. The widget tells the web page it runs on when you go through a booking step (for example “class viewed”, “checkout started”, “purchase”), as an event inside your browser named elastudio:step. elastudio sets no cookie for this and does not send these steps to any server; they stay in the page unless the studio’s website passes them on. A step carries only codes and amounts (such as the class or product code, the order number, the price and the page language), never your name, e-mail, phone or anything you typed. The studio’s website may pass these steps to its own analytics tools (such as Google Analytics or Microsoft Clarity), only as its own cookie notice and your choices on that website allow. If that website asks for it and you accepted analytics there, the steps also carry a member code: a pseudonymous code that elastudio derives from your profile with a secret key only elastudio holds (not your name or e-mail), the same on every device, so the studio’s analytics can link your visits to your booking profile. Without that consent no member code is given. The member code is different for each studio, so it cannot be used to link you across studios, and the studio can match it to your booking profile: it is pseudonymised personal data, not anonymous. elastudio’s own pages never give it to any analytics tool. When the studio’s website passes it to its analytics tools, those providers receive it (for Google Analytics and Microsoft Clarity, in the United States) under the studio’s responsibility. The member code is described in the studio’s privacy notice.

Analytics (only with your consent, only loaded on elastudio’s own website pages and, for Microsoft Clarity, on app.elastudio.app)

Name	Set by	Purpose	Lasts
_ga, _ga_2RLVE1LQCG	Google Analytics 4 (Google LLC), on elastudio.app	Counts visits and shows which pages are used, which buttons and links are clicked (such as sign-up, language and price period) and how visitors arrived (the referring website and campaign tags such as utm_source), so we can improve the site. A click on a sign-up button such as “Start free”, or on our support e-mail address, is counted as a lead (interest in elastudio), together with which button it was, the page language and the currency shown	13 months, not extended by later visits
els_attr (browser storage, localStorage)	elastudio, on elastudio.app	Remembers the first and the most recent time you arrived through a campaign link: its campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the ad click id if the link had one (gclid, gbraid or wbraid, which Google adds to links in its ads), the page you landed on and the date and time. We use it to measure which campaigns bring studios to elastudio: sign-up links carry these tags, so the sign-up page, and Google Analytics, can tell which campaign brought you. Set only after you accept analytics and only when you arrive through such a link. The record itself stays in your browser; when you click a sign-up link, the tags it adds go with that link to our sign-up page, where our hosting provider’s logs keep them for up to 7 days and Google Analytics records them with the page address	90 days from the last visit through a campaign link (each new campaign visit restarts the 90 days, so the first visit it remembers can be older); after that it is no longer used and is removed on your next visit. Deleted at once if you reject or withdraw analytics
_clck, _clsk	Microsoft Clarity, on elastudio.app and on app.elastudio.app (Clarity may set them for the whole elastudio.app address)	Shows how people use pages (clicks, scrolls, session recordings with all text on the page hidden) and counts clicks on sign-up buttons and on our support e-mail address, so we can fix confusing parts. On app.elastudio.app it shows where people get stuck signing in or creating a studio: all text on the page is hidden in your browser before a recording is sent, including anything you type (your e-mail address, name and studio name), and we label each recording only with the screen, the sign-up step, the type of business, the country and the language you chose, never with your name, e-mail address or studio name. A visit that arrives through a sign-in link, a Google sign-in or the opening of a studio is not recorded	_clck 1 year, _clsk 1 day
CLID, ANONCHK, MR, SM, MUID	Microsoft, on clarity.ms and Microsoft domains	Used by Clarity to connect visits; MUID is a Microsoft-wide identifier	From the end of the session up to 1 year (names checked against Microsoft’s Clarity cookie list on 11 October 2026)

Before you consent, these scripts are not loaded at all. If you withdraw consent, we stop loading these tools and delete the analytics cookies and storage on elastudio.app (_ga, _ga_2RLVE1LQCG, _clck, _clsk, els_attr). On app.elastudio.app, withdrawing in its own “Cookie settings” stops Microsoft Clarity there and deletes _clck and _clsk; your choice on elastudio.app stays as it was, and you change it there. Cookies Microsoft stores on its own domains (such as MUID) can be removed in your browser settings. Google deletes the detailed data about your visits after 14 months; summary statistics that do not identify you can remain in our reports after that. Microsoft Clarity keeps data for up to 13 months. Google and Microsoft process it in the United States; see section D of our Sub-processor list.

How long your choice lasts

We remember your choice, whether you accept or reject, for 6 months, then ask again. If we add a new type of cookie or a new provider that needs consent, we ask again sooner.

Changes to this notice

We post every new version here with its date. Earlier versions are available on request. If we add a cookie or provider that needs consent, we ask for your choice again.

Contact

privacidade@elastudio.app. Other questions: support@elastudio.app (support is in English and Brazilian Portuguese only).