1. Introduction
Tay Yuh Feng LLC ("GOAT OSS," "we," "us," or "our") operates the GOAT OSS gym and studio management platform, including the staff dashboard and the parent-facing web portal (collectively, the "Service").
This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information. It applies to:
- Gym Owners and Staff — businesses and individuals who create a GOAT OSS account to manage their gym or studio
- Families and Parents — parents and guardians who access the parent portal through a gym that uses GOAT OSS
By using the Service, you agree to the collection and use of information as described in this policy.
2. Information We Collect
From Gym Owners and Staff
When you create or manage a GOAT OSS account, we collect:
- Name, email address, and phone number
- Gym or studio name, business address, and primary sport/discipline
- Payment information — processed by Stripe; GOAT OSS does not store full card numbers
- Account credentials (password is stored in hashed form; we never store it in plaintext)
- Communications and support requests submitted to GOAT OSS
From Families and Parents (via the Parent Portal)
When a gym using GOAT OSS invites families to its parent portal, the gym may input or invite families to provide:
- Parent or guardian name, email address, and mobile phone number
- Student (child) name, date of birth, and class enrollment information
- Emergency contacts and health notes (if entered by the gym)
- Communications with the gym through the portal messaging system
Families access the portal through the gym's invitation. The gym, not GOAT OSS, is responsible for the data they collect from their members.
Automatically Collected Information
When you use the Service, we automatically collect:
- IP address and approximate location derived from it
- Browser type, operating system, and device information
- Pages visited, features used, and time spent in the platform
- Session identifiers and authentication tokens
- Error logs and performance data used to diagnose and fix issues
3. How We Use Information
We use the information we collect to:
- Provide, operate, and maintain the GOAT OSS platform
- Process billing and manage your subscription
- Send transactional SMS and email communications — account confirmations, one-time passcodes (OTP) for login, billing receipts, and service notifications
- Enable gyms to send operational SMS messages to parents (class reminders, schedule changes, billing alerts) via the GOAT OSS messaging tools
- Respond to customer support requests
- Detect, investigate, and prevent fraudulent or illegal activity
- Improve the platform through aggregate analysis of usage patterns
- Comply with legal obligations
We do not use your data or your members' data for advertising purposes, and we do not build advertising profiles.
4. SMS Messaging
GOAT OSS sends SMS messages to parents and gym owners in two categories:
- Authentication (2FA/OTP) — one-time passcodes sent to verify your phone number when logging in to the parent portal. You will receive one message per login attempt. You cannot opt out of OTP messages while using phone-based login.
- Operational gym communications— class reminders, schedule changes, billing alerts, make-up class availability, and other messages sent by the gym you are enrolled with, delivered through GOAT OSS. Message frequency varies based on your gym's activity and your enrollment.
Message and data rates may apply. Message frequency varies.
To opt out of operational gym SMS messages at any time, reply STOP to any message. To request help, reply HELP or contact us at support@goatoss.com. After opting out, you may still receive a single confirmation message. You can re-subscribe at any time by replying START.
No mobile information collected by GOAT OSS for SMS messaging is shared with third parties or affiliates for marketing or promotional purposes. Phone numbers collected for SMS messaging are not shared, sold, or rented to any third party for their own marketing use.
5. Information Shared with Third Parties
GOAT OSS uses a small number of trusted third-party service providers to operate the platform. These providers process data only on our behalf and are bound by their own privacy commitments.
- Stripe — payment processing. Your payment card information is transmitted directly to Stripe and is subject to Stripe's Privacy Policy. GOAT OSS does not store full card numbers.
- Twilio — SMS delivery and phone number verification. Phone numbers and message content are transmitted to Twilio to deliver SMS. Twilio is subject to Twilio's Privacy Policy. Phone numbers are never shared with Twilio for marketing purposes.
- Supabase — database hosting and authentication infrastructure. Platform data is stored on Supabase servers and is subject to Supabase's Privacy Policy.
- Resend — transactional email delivery. Emails sent through GOAT OSS are delivered via Resend and are subject to Resend's Privacy Policy.
We do not sell, rent, or trade your personal information or your members' personal information to any third party for their own marketing or commercial purposes.
We may disclose information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of GOAT OSS, our users, or the public.
6. Children's Privacy (COPPA)
GOAT OSS is a business-to-business platform sold to and operated by gyms and studios. GOAT OSS does not directly market to or knowingly collect personal information from children under 13.
When a gym uses GOAT OSS to manage student records that include children, the gym (not GOAT OSS) is the "operator"for purposes of the Children's Online Privacy Protection Act (COPPA). Gyms are solely responsible for:
- Obtaining verifiable parental consent before collecting personal information from or about children under 13
- Providing parents with the required disclosures about data collection practices
- Complying with COPPA and any applicable state children's privacy laws
If you are a parent and believe that your child's personal information has been collected without proper consent, please contact the gym directly or reach out to us at privacy@goatoss.com and we will assist with directing your inquiry.
7. Data Retention
- Active accounts: Data is retained for as long as your account remains active and for a reasonable period afterward to handle support requests, disputes, or legal obligations.
- After account termination: Gym owner account data and associated records are scheduled for deletion 90 days after the account termination date. You may export your data at any time within this window.
- What you can export: your business operating data — families, students, contacts, enrollments, attendance, invoice and payment history, and signed waivers. Message history and login credentials are not exported, and payment card and bank details are never stored by us (they are held by our payment processor).
- Family/member data: Families and parents who wish to have their data deleted should contact their gym directly. Gyms may request deletion of member data by contacting privacy@goatoss.com.
- Backups: Data may persist in encrypted backups for up to 90 days after deletion from the live database.
8. Security
We take the security of your data seriously and implement industry-standard safeguards, including:
- Encryption of data in transit using TLS (HTTPS)
- Encryption of data at rest in our database infrastructure
- Row-level security controls limiting data access to authorized tenants only
- Authentication token management with short expiry windows
- Access controls limiting employee access to production data
Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information and are not responsible for unauthorized access that results from circumstances beyond our reasonable control.
In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.
9. Your Rights (CCPA / GDPR)
Depending on your location, you may have rights regarding your personal information:
- Right to access — request a copy of the personal information we hold about you
- Right to correction — request that we correct inaccurate or incomplete personal information
- Right to deletion — request that we delete your personal information, subject to legal retention obligations
- Right to data portability — request your data in a machine-readable format
- Right to opt out of sale — we do not sell personal information, but California residents under the CCPA may formally assert this right
California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of your personal information (we do not sell it). You will not be discriminated against for exercising these rights.
EU/EEA and UK residents (GDPR): Where GDPR applies, you have the additional right to object to processing, to restrict processing, and to lodge a complaint with your local supervisory authority.
To exercise any of these rights, contact us at privacy@goatoss.com. We will respond within the timeframe required by applicable law (typically 30–45 days).
10. Cookies
GOAT OSS uses a minimal set of cookies necessary to operate the platform:
- Session cookies — used for authentication. These cookies allow you to stay signed in and are deleted when you close your browser or sign out.
- Security cookies — used to detect and prevent cross-site request forgery (CSRF) attacks and other security threats.
We do not use third-party advertising cookies, tracking pixels, or behavioral retargeting technologies. We do not share cookie data with advertising networks.
11. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes — those that meaningfully affect how we collect, use, or share your information — we will provide at least 30 days advance notice via email to the address on file for your account. The updated policy will also be posted at this URL with a revised "Last updated" date.
Your continued use of GOAT OSS after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.
12. Contact
For privacy-related questions, data access requests, or to report a concern about how your data is handled, please contact:
Tay Yuh Feng LLC
Email: privacy@goatoss.com
12950 E. Colonial Drive #106, Orlando, FL 32826