Aligned Ashtanga YogaTherapy Insight Academy Online yoga school Ulm yoga school Community Shop
DE EN

Privacy at AYI

Learn what data AYI processes for your account, bookings, learning and community, which services are involved, and how to exercise your rights.

Last updated: 2 November 2026

On this page

1. Data controller and contact

The controller responsible for processing your personal data is:

AYI® – owner: Dr. Ronald Steiner
Leimgrubenweg 31
89075 Ulm, Germany

Phone: +49 731 92602151
Email: office@ayi.info

You can also use this email address for privacy questions and to exercise your rights.

2. Your rights

Subject to the legal requirements, you can request access to, correction or deletion of your data, restriction of processing, and data portability (Articles 15 to 20 GDPR). You can withdraw consent at any time with effect for the future. This does not affect processing carried out before your withdrawal.

Right to object: Where processing is based on legitimate interests, you can object on grounds relating to your particular situation (Article 21 GDPR). You can object to direct marketing at any time without giving a reason; this also applies to related profiling.

To do so, write to office@ayi.info. You can also complain to a data protection supervisory authority, particularly in the place where you live or work, or where you believe an infringement occurred. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

3. Why we process data

This notice applies to ayi.info: your AYI account, yoga in Ulm and online, OnDemand, memberships and yoga passes, workshops, retreats, teacher training, eLearning, community and shop.

We process the data needed for services you request or agree to under Article 6(1)(b) GDPR. We meet legal obligations under Article 6(1)(c) GDPR. Voluntary consent is covered by Article 6(1)(a) GDPR. For security, preventing misuse and responding to general enquiries, we rely on Article 6(1)(f) GDPR; we explain the relevant interests below.

We need the mandatory details in forms to provide the relevant function. For example, we cannot confirm an account without an email address or fulfil an order without the necessary payment or delivery details. Public profile information and newsletter subscriptions are voluntary.

Most data comes from you. Payment status and transaction references also come from payment services and banks; newsletter status comes from Brevo; and training and attendance records come from the responsible teachers and staff. When moving from ashtangayoga.info to ayi.info, we transfer existing account, contract, booking and learning data to continue providing the same services.

4. Website, hosting and security

When you visit the website, we process your IP address, the time of the request, the page or file requested, browser and device information and, where applicable, the referring page and technical error data. This enables us to deliver the website, investigate errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR; our interest is to operate a secure and reliable service.

Hosting and technical service providers process the data needed for these purposes. Authorised staff and technical support have access where necessary to operate the service, provide support or resolve errors. Full backups allow us to restore the service after a failure and are retained for 30 days. Retention depends on security and recovery needs; evidence relating to a specific incident may need to be kept for longer.

The website runs on Hetzner Cloud servers in Nuremberg, Germany. Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Further information: Hetzner privacy information.

Regular web access, web error and TYPO3 logs are configured for daily rotation, retaining up to 14 older log files. For files written every day, this represents approximately two weeks plus the current file. This rule does not cover every other application log or backup.

5. Cookies and browser storage

We use cookies and browser storage for functions you request. Where they are strictly necessary for those functions, section 25(2), point 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies. Subsequent processing of personal data is based on performance of a contract or our legitimate interest in secure operation, depending on the purpose.

  • Sign-in and booking: fe_typo_user maintains the TYPO3 session; rs_felogin_return_url remembers the return page for up to 15 minutes. Session data also supports the shopping basket and booking process.
  • Your choices: rs_cookie_consent and rs_preferred_language store your cookie choice and language respectively for up to 365 days.
  • Navigation and video: ayiAreaContext and rsVideoPlayer.watchState.* are held in session storage for the browser session.
  • Price display: rsMembershipBilling remembers your chosen monthly or quarterly billing view in local storage for up to 365 days after you actively select it.

Vimeo, YouTube, embedded Google Maps and VG WORT article counting pixels are activated only after you agree. These optional accesses are covered by section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change or withdraw your choices at any time through “Cookie settings” in the footer. You will also find information there about the providers’ storage. Clearing browser data removes local entries, but does not delete data stored in your account.

Additional functional storage supports secure sign-in with Google or Apple (cookies containing rs_sociallogin in their name, limited to the sign-in process), returning after a booking (rs-checkout:refresh:* in Session Storage) and your chosen Sanskrit display (ayi.sanskrit.display.v1 in Local Storage until you clear your browser data). Full details are available in the cookie settings.

6. Your account and signing in

For your account, we process your name, email address, verification status, sign-in and session data, and any optional profile information. If you use a password, we store its hash, not the password in plain text. Verification and sign-in links contain security tokens that expire. This enables access, protects your account and allows us to provide your services (Article 6(1)(b) GDPR).

If you choose to sign in with Google or Apple, we receive the provider identifier, email address and, where applicable, name or profile picture details needed for sign-in. The selected provider learns that you are signing in to AYI. Our account sign-in is based on Article 6(1)(b) GDPR; your choice initiates the external sign-in process.

The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google’s privacy policy), and Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland (Apple’s privacy policy).

7. Bookings, memberships and yoga passes

For classes, workshops, retreats and teacher training, we process contact and billing details, the selected service and dates, booking, payment and cancellation status, participation type and attendance. The responsible teachers and staff see the information needed for organisation, teaching and support. This may include organisational notes and messages sent about the event.

For memberships and yoga passes, we also process the plan, term, billing arrangement, access rights, pass balance and usage. We also document changes, pauses, cancellations, statutory withdrawals and how these are handled. Where access to articles or videos is limited, we record content unlocked and allowances used.

During booking, we also save your selection and the contact and address details you enter as a temporary draft so that you can continue and confirm your booking. The legal basis is Article 6(1)(b) GDPR. We retain legally required records under Article 6(1)(c) GDPR and rely on Article 6(1)(f) GDPR to prevent misuse.

8. SEPA, bank transfer and PayPal

Depending on the service, payment options include SEPA direct debit, bank transfer and PayPal. We process the amount, currency, due date, payment method, contract or order reference, and payment, refund and returned direct debit status. We use bank transactions, payment references and transaction identifiers to match payments to outstanding amounts.

SEPA direct debit and bank transfer

For a SEPA mandate, we store the account holder, IBAN, mandate reference, and records of the mandate being granted, changed or revoked. The data needed to collect payment is passed to the banks involved. For bank transfers, we process the details received with the payment so that we can allocate it correctly.

PayPal

If you choose PayPal, we send PayPal the order and payment details needed. We receive payment status and references for the order, payment or subscription. For recurring fees, we also process the payment authorisation you confirmed with PayPal and its status. You enter your PayPal sign-in details directly with PayPal.

The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal also processes data as a controller in its own right, for example to meet legal obligations and prevent fraud. See PayPal’s privacy statement for details.

Our payment processing is based on Article 6(1)(b) GDPR and legally required retention on Article 6(1)(c) GDPR. Resolving payment discrepancies and preventing misuse serve our legitimate interests under Article 6(1)(f) GDPR.

Earlier payments through Stripe

Where earlier transactions were processed through Stripe, customer, payment, invoice and subscription references and their status may remain stored for contract administration and record-keeping. Stripe is not a general payment option in the current booking process. Provider: Stripe Payments Europe, Limited, Ireland; Stripe privacy information. The legal bases for contracts and retention described above apply.

9. Invoices and Microsoft SharePoint

For invoices, electronic invoices and cancellation documents, we process your name, billing address, company and VAT number where applicable, services, amounts, taxes and payment allocation. You can download available documents from your account; documents may also be sent by email.

We archive PDF and XML document files in Microsoft SharePoint. The website retrieves them through our server for authorised downloads and invoice emails. Invoice metadata and protected invoice records are also processed in the AYI system.

Microsoft provides this service as part of Microsoft 365; its European contact entity is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Further information: Microsoft’s privacy statement and Microsoft’s Data Protection Addendum.

The purposes are issuing invoices, making them available and meeting statutory retention requirements. The legal bases are Article 6(1)(b) and (c) GDPR.

10. Shop orders

When you order from the shop, we process your basket, products and quantities, contact details, billing and delivery addresses, and order, payment and shipping status. This data is used to fulfil and deliver your order and handle enquiries or returns (Article 6(1)(b) GDPR). Delivery providers receive the details needed to deliver your order. Payment and retention information is provided in the relevant sections of this notice.

11. eLearning, training records and practice diary

For learning activities, we process task status, written answers, uploads, quiz answers and results, progress, submitted reflections and feedback. The responsible teachers and authorised staff can view submissions to provide guidance and assess them. For training records, recognition of prior learning, certificates and licences, we process completed modules, attendance, assessment and approval status.

For videos, we record information in your account including playback position, sections watched, progress and completion times. This allows you to continue your practice and follow your learning progress. Video feedback may be linked to your account.

Your practice diary brings together existing learning, video and attendance activities. Your own entries may include the date, start time, duration, type of practice, title and a private note. These are used to create personal practice overviews. Diary notes and learning answers are not published in your public profile.

This processing provides the learning, documentation and training functions you use (Article 6(1)(b) GDPR). Voluntary feedback helps improve teaching and content; our interest in these improvements is the basis under Article 6(1)(f) GDPR.

Health information: Please do not enter diagnoses or other sensitive information in general comments, messages or free-text fields. If health data is needed for specific support, an additional basis under Article 9 GDPR is required, such as separate explicit consent. Simply entering the information in a free-text field does not replace this.

12. Your profile, YogiFinder and “Who is joining”

Your profile may contain your name, picture, description, interests, the year you started practising, favourite module, and optional location, phone, website and social media details. Visible profiles may also show training levels, completed modules, articles, teaching dates and summaries of previous participation. This information comes from the data stored in your account.

  • YogiFinder: With your permission, your profile may be publicly visible and discoverable through search, subject to your access and licence eligibility. This includes the location and contact details you share. Public means accessible without signing in and potentially through search engines.
  • “Who is joining”: If both people enable this function and share an event date, they can see each other’s profile and contact details. Shared and other upcoming dates may also be shown.
  • Authors and teachers: People publicly named as authors or teachers may have a public profile even without YogiFinder permission. This alone does not make their contact details public.

Your account email address is not displayed in your public profile. Personal messages are available for getting in touch. Details you choose to share, such as your phone number or website, may be visible.

Voluntary publication and connections are based on your consent (Article 6(1)(a) GDPR). You can withdraw the relevant permission in your profile. Other reasons for visibility, such as your publicly named role as a teacher, remain separate. These role details make it clear who is responsible for teaching and content (Article 6(1)(f) GDPR).

Place search and distance

For manual place or postcode searches and locating published profile places, the YogiFinder uses Nominatim, provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. Our server sends the search text and language to nominatim.openstreetmap.org; it does not forward your account ID or browser IP address. Successful place responses are held in a shared cache for up to 30 days. This supports the search you request and an efficient, reliable distance display (Article 6(1)(b) or (f) GDPR). Further information: OpenStreetMap Foundation privacy policy.

When you open the YogiFinder, we request your device location through your browser’s location feature. This requires your browser permission; your browser may reuse permission you have already granted. AYI uses the coordinates it receives to sort teachers by distance. If you do not grant permission or your location cannot be determined, you can enter a place or postcode. You can request your location again using “Use my location”. You can withdraw permission in your browser’s website settings.

Voluntary use of your location is based on Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. Your browser and operating system may use their own services to determine your location; their privacy notices apply to those services.

13. Comments and personal messages

For comments, we process the text, name, account link, reply reference, time and, where applicable, rating and attachments. Comments appear in the relevant content area and are visible to its visitors. The associated email address is used for administration and notifications, not publication.

Personal messages contain the sender and recipient accounts, text, conversation reference and times. On the website, only the participating accounts can open the conversation. The function is not end-to-end encrypted; administrative access remains possible where needed for operation or support. Existing conversations can continue after YogiFinder permission is withdrawn.

We store a read status for your conversation overview. If you have enabled the associated email notifications, a daily email may contain names and short excerpts from new comments and personal messages. You can change this email preference.

This processing provides the communication you request (Article 6(1)(b) GDPR). Moderation, preventing misuse and handling complaints are based on our legitimate interest in a safe community (Article 6(1)(f) GDPR).

14. Newsletters with Brevo

For newsletters you subscribe to, we process your email address, selected topics and language, subscriptions and unsubscriptions, and records of consent. New subscriptions through our website are confirmed by email. Sending newsletters is based on your consent (Article 6(1)(a) GDPR).

We use Brevo as our newsletter service. The email address, list choices, and unsubscribe or suppression information needed for this are synchronised between AYI and Brevo. Existing Brevo contacts, including names held there, may be imported into our local newsletter administration. This allows us to keep track of your choices when changes are made in either system.

You can unsubscribe using the link in a newsletter or by contacting us. Records needed to document your choice and suppression information may be retained so that we can respect your unsubscribe request and demonstrate previous consent (Article 6(1)(f) GDPR). Further information: Brevo’s privacy policy.

Booking confirmations, invoices and other necessary contractual messages are separate from newsletters. They relate to the relevant service and are sent even without a newsletter subscription.

Open and click tracking

Since 2 November 2026, we have enabled Brevo’s anonymous open and click tracking for newsletter campaigns sent from that point onwards. According to Brevo, opens and clicks in these reports are not associated with individual contacts. We use these reports to understand how our newsletter campaigns are received. We do not use this data to personalise the content.

Opens and clicks are still recorded technically, for example through small remotely loaded images and specially tagged links. This may involve technical access data such as the time, IP address and information about your email application or browser.

Where personal data is processed for newsletter analysis, this requires your corresponding consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies where information is stored on or accessed from your device and consent is required for that access. You can withdraw consent for the future, including by unsubscribing from the newsletter. The website cookie settings do not change tracking in emails you have already received.

15. Contact and service emails

When you contact us, we process your contact details, the content of your enquiry and the information needed to handle it. Contract-related enquiries are covered by Article 6(1)(b) GDPR; general enquiries by our legitimate interest in responding under Article 6(1)(f) GDPR.

The website sends system emails through our own mail server on hosting infrastructure provided by Hetzner Online GmbH in Germany. These include account and booking confirmations, invoices and notifications. Address and connection data required for delivery is processed for this purpose. Newsletters and their associated automated emails are sent through Brevo, as described in the newsletter section.

For account, booking, invoice and notification emails, we store the recipient address, message content, attachments where applicable, and delivery and error status. Hosting and email providers process the data needed for delivery and operation. Temporary copies in our sending system follow the deletion periods set out below; required business correspondence and documents are retained separately.

We also use anonymous open and click reporting for automated and transactional emails sent through Brevo in future. According to Brevo, these events are not associated with individual contacts in the reports. Opens and clicks may still be recorded through images and links.

16. Online teaching, videos and maps

Online teaching with Zoom

We use Zoom for online sessions. When you join, Zoom processes information including your display name, IP address, device and connection data, and the audio, video and chat contributions you enable. Other participants can see your name and receive contributions you share. AYI processes event and access details to provide the teaching (Article 6(1)(b) GDPR). Any recording and its intended use must be explained separately for the session concerned; this notice does not provide consent for recording.

Provider: Zoom Communications, Inc., USA. Further information: Zoom’s privacy statement.

Vimeo and YouTube

External players are loaded after you agree. Even when starting an OnDemand video directly, you are first asked for Vimeo consent if you have not already given it. When the player loads, providers receive information including your IP address, device and browser data, and details of the video request. Player privacy options do not prevent all data transfers.

The providers are Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA (Vimeo’s privacy policy), and, for YouTube, Google Ireland Limited, Ireland (Google’s privacy policy).

Google Maps

Maps on location, event and profile pages share one Google Maps consent setting. A map is loaded from Google Ireland Limited only after you agree. This may transfer your IP address, device and usage data to Google. If you withdraw consent through the cookie settings, embedded maps are disabled again. Addresses remain readable. A direct map link opens Google independently of the embedded map.

Optional embeds are covered by Article 6(1)(a) GDPR and section 25(1) TDDDG. Ordinary external links, such as links to Instagram, do not send data to the destination simply by being displayed. After you click a link, the privacy information of the relevant website applies.

Article counting by VG WORT

Some articles contain a counting tag from Verwertungsgesellschaft WORT (VG WORT), Untere Weidenstraße 5, 81543 Munich, Germany. It records article views for author remuneration. AYI loads the counting image only after you consent. Your browser then connects to the measurement service and technically transmits information including your IP address and details of the request. The METIS process may use a session identifier; details are provided in VG WORT’s information on view counting.

Our activation is based on your consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. You can withdraw it in the cookie settings. Articles remain readable without this permission. Further information: VG WORT privacy information.

17. Recipients and processing outside Europe

Depending on the function you use, the services named above receive the data they need. Other recipients may include the banks involved, delivery providers, tax advisers, accounting and legal advisers, and competent authorities, where necessary to fulfil an order or legal obligation. Hetzner processes data on our behalf for website hosting, Brevo for sending our newsletters, and Microsoft for the SharePoint invoice archive. Payment services and providers of external sign-in and media features also process data for their own purposes as independent controllers; their privacy notices linked above apply to that processing.

Some of these services also process data outside the EU and the European Economic Area (EEA), particularly in the United States. Access to data and available legal remedies may differ there. Transfers require a basis under Chapter V GDPR: an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses (SCCs) or approved binding corporate rules (BCRs). The EU-US Data Privacy Framework (DPF) provides an adequacy framework for transfers to the certified US organisations covered by it.

  • Brevo – newsletters and transactional emails: This French provider also uses companies outside the EEA. Its data processing terms name, among others, Brevo CRM Solutions Limited in India for customer support and maintenance, with SCCs and supplementary safeguards. Brevo also cites the DPF for certain transfers to US companies. The subprocessors involved also depend on the function used. Brevo: data processing and subprocessors, Appendix 3.
  • Microsoft – SharePoint invoice archive: Transfers outside the EEA, including to Microsoft Corporation in the United States, are subject to the SCCs set out in Microsoft's Data Protection Addendum. Microsoft Corporation also participates in the DPF. Microsoft's EU Data Boundary does not exclude certain transfers outside Europe. Microsoft Data Protection Addendum and EU Data Boundary.
  • Zoom – online classes: Zoom Communications, Inc. in the United States is covered by the DPF. Zoom's Data Processing Addendum provides for SCCs where a transfer is not covered by an applicable adequacy decision. Zoom also publishes the countries and transfer mechanisms for its subprocessors. Zoom: privacy and data processing and subprocessors.
  • Vimeo – embedded videos: Vimeo.com, Inc. in the United States participates in the DPF. This provides the basis for transfers to the United States that fall within its scope. Vimeo: privacy and international transfers.
  • Google – sign-in, YouTube and Maps: Data may be transferred to Google LLC in the United States, among other recipients. Google relies on the DPF for US transfers within its scope and uses SCCs where a transfer is not covered by an adequacy decision. Google's frameworks for data transfers.
  • Apple – sign-in: Apple Distribution International Limited in Ireland may have data processed by Apple Inc. in the United States and other affiliates. Apple cites SCCs for international transfers of data collected in the EEA. Apple Privacy Policy, transfer of personal data between countries.
  • PayPal – payments: Data may also be processed outside the EEA, including in the United States. PayPal cites approved BCRs for transfers within its corporate group. For other transfers, PayPal cites adequacy decisions or SCCs in particular. PayPal: international data transfers.
  • Stripe – earlier payments: Where Stripe continues to process data relating to earlier payments, this may take place in the United States and India, among other countries. Stripe cites adequacy mechanisms and SCCs in particular. Stripe: international data transfers.
  • OpenStreetMap – address searches with Nominatim: The OpenStreetMap Foundation names the United Kingdom and the Netherlands as storage locations for request information. Transfers to the United Kingdom are covered by a European Commission adequacy decision. OpenStreetMap Privacy Policy and European Commission adequacy decisions.

The linked information provides details of these transfer mechanisms. You can request information and a copy of the safeguards relevant to your data by contacting us at office@ayi.info.

18. Retention and deletion

We retain personal data for as long as it is needed for its purpose. We then delete it or remove the link to an identifiable person. Statutory retention duties and records needed for existing claims may require longer retention. Use of these records remains restricted to the relevant purpose.

Temporary data

We carry out due cleanup at least weekly, no later than seven days after the following retention periods end:

  • Abandoned booking drafts: These expire seven days after creation and are deleted within another seven days, provided they have not resulted in a booking and no valid access credentials require their retention.
  • Unconfirmed new accounts: After 30 days without confirmation, these are removed from normal use and held in restricted-access storage for a further 30 days. They are then permanently deleted. Including processing intervals, this takes no more than 74 days from the start of registration. This applies only to new registrations without bookings, attendance or other required records.
  • Unconfirmed changes to existing accounts: Expired confirmation requests are removed within seven days of expiry. The existing account is retained.
  • Temporary copies of system emails: Our sending system retains content and contact details that are no longer needed for seven days after successful sending, or 30 days after final failure or cancellation. Including processing time, the limits are 14 and 37 days respectively after the sending process ends.
  • Technical delivery logs in our system: These are cleared after 90 days, no later than 97 days after the sending process ends. Ongoing delivery attempts and required contractual or delivery records are assessed separately.

Accounts, attendance and training records

We need account, contract and booking data to provide and administer your services. Learning and training data supports your course access and records your achievements; diaries, activity histories and community contributions serve the features you choose to use. Cancelling a membership does not automatically close the account or end the need for training records.

When an account is closed or a purpose ends, we assess which data is still needed. Past attendance, bookings, invoices and payments remain linked to the individual where this is required for record-keeping. Current contact and profile details that are no longer needed, such as name, email and address, are removed following an individual assessment; access is disabled when the account is closed. This is not complete anonymisation while retained records still identify the person. Past attendance alone does not justify keeping all profile data indefinitely.

Business records, email enquiries and newsletters

Invoices and accounting records are generally retained for eight years, business correspondence for six years, and accounting books and annual financial statements for ten years. These periods generally start at the end of the relevant calendar year; for invoices, this is the year of issue. Statutory extensions, for example due to ongoing tax proceedings, still apply. Necessary original details and identity links are preserved during these periods. The legal bases include section 14b of the German VAT Act (UStG) and section 147 of the German Fiscal Code (AO).

Ordinary email enquiries are retained until the matter is resolved and afterwards only where further correspondence, necessary evidence or statutory duties require this. The short retention periods for our sending system do not apply to business correspondence and documents that must be retained.

Newsletter data is needed for the duration of your subscription. After that, consent records are retained only as long as needed to demonstrate a lawful signup or defend against claims. A minimal suppression record is kept for as long as needed to honour your unsubscribe request during future data synchronisation.

Backups

Data deleted from the live system may remain in protected backups for up to 30 days. These backups are used to recover from an outage. After a restore, deletions made in the meantime are applied again. Server logs and browser storage follow the periods stated in their respective sections.