Legal
Privacy Policy
Last updated: May 2026
1. Who we are
Yogmandu (“we”, “us”, “our”) is a yoga teacher-training and sound-healing centre located at Miteri Marg, Mid-Baneshwor-31, Kathmandu, Nepal. We can be reached at info@yogmandu.com.
2. What we collect
- Account information — name, email, phone, nationality, yoga experience level, profile photo, bio.
- Contact submissions — name, email, message, program of interest.
- Authentication data — encrypted password hash and session cookie.
- Usage data — anonymised page views, device, country and browser via Google Analytics 4.
- Technical data — IP address (hashed before storage) for spam-prevention and rate-limiting.
3. Why we collect it
- To create and manage your student account.
- To respond to your enquiries and to send programme information you request.
- To improve our website, content and programmes.
- To protect the site against fraud, abuse and automated attacks.
- To comply with our legal obligations under Nepali and applicable international law.
4. How long we keep it
Account data is retained while your account is active. Contact-form submissions are retained for up to 24 months. Analytics data is retained for 14 months. You can request deletion of your account and associated personal data at any time by emailing info@yogmandu.com.
5. Who we share it with
We do not sell your personal data. We share it only with:
- Supabase — our database and storage provider (EU/US data centres).
- Google Analytics — for anonymised usage metrics.
- Cloudflare — for hosting, content delivery and security.
- Resend — for transactional email delivery.
- Law enforcement — only when legally compelled.
6. Cookies
We use the following cookies:
yogmandu_user_session— required for login. Expires after 7 days.yogmandu_admin_session— admin authentication only.- Google Analytics cookies (
_ga,_ga_*) — anonymised traffic measurement. You can opt out via your browser settings or by installing the Google Analytics Opt-Out add-on.
7. Your rights
Under GDPR, UK GDPR, CCPA and equivalent regulations you have the right to:
- Access the personal data we hold about you.
- Correct or update inaccurate data.
- Request deletion of your data ("right to be forgotten").
- Export your data in a machine-readable format.
- Object to or restrict processing.
- Withdraw consent at any time.
8. Security
Passwords are hashed with scrypt (16-byte salt, 64-byte key). Sessions are HMAC-signed and transmitted over HTTPS with secure, http-only cookies. All connections are encrypted in transit (TLS 1.2+). Despite our efforts, no method of transmission over the internet is 100% secure — please use a strong, unique password.
9. Children
Our services are not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
10. International transfers
Our service providers may store data outside Nepal, including in the EU, UK and US. Where applicable, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page and, where relevant, by email. The “Last updated” date at the top reflects the current version.
12. Contact
For any privacy-related question, contact us at: