Customers, portal, users, and security

Customer records

• You can add customers by hand or import a whole list. A customer is also added for you when someone books with a new email address.
• A customer's page can show their contact details, booking history, signed waivers, gift card purchases, whether they want marketing emails, and how they heard about you. Its Total spent figure is the same one the customers list and the Customers report show. It counts the money the customer paid you, for bookings and for the gift cards and class passes they bought, less what you refunded. Unpaid, failed and complimentary bookings count nothing. The part of a booking paid with a gift card or class pass counts for whoever bought the card, not again for the person who booked, so the page shows it on its own as Paid with gift cards.
• Internal notes hold what your team should know every time a customer books, such as a preferred seat or a PO number. Add them on the customer's Edit page (up to 2,000 characters). They show on the customer's page, on each of their bookings, and on the printed class list. Customers never see internal notes. They are not in the customer portal, in emails, or in the customer's data export. A booking's own note is different, because the customer can read that one. Erasing a customer's data removes their internal notes too.
• Get the email address right. Booking confirmations, sign-in links, reminders and cancellation links all go to it.
• Changing a customer's email tells them. If you edit the address on a customer record, we email both the old address and the new one to say it changed. The new address gets a confirmation. The old one matters too. If the change was a mistake, or made on the wrong record, that mailbox is the only place the original person can find out that their booking emails now go somewhere else. If the old address had a typo, the email simply bounces, which does no harm.

Import, export, and privacy requests

• Bulk import. Customers come in through Settings → Import from a spreadsheet, on the template's Customers sheet. Each row needs an Email and a First Name, and can also have a Last Name, Phone, and Marketing Opt In. People are matched by email, so uploading the same list again updates them rather than adding them twice. You see every change, and every row with a problem, before anything is saved. See Setting up from a spreadsheet.
• Export a customer. The export button on a customer's page downloads their data (profile, booking history and referral details) as a JSON file. Use it when a customer asks for a copy of their data. Owners can also export from the … menu on the customer's row in the customers list.
• Erase a customer (right to be forgotten). Erase removes the customer's name, email and phone, and puts placeholders in their place. Their bookings and payments are kept, so your money records stay complete. Erase is permanent and cannot be undone, so check you have the right person first. Erase also takes them off your waitlists and unfinished checkouts, and deletes the emails sent to them and their sign-in links. It clears their details from spots other people booked for them, and from finished private-event orders they were the contact for. It also removes them from a connected mailing list. Private-event orders that are still open are left alone until you close them.

Customer portal

The portal lets customers see and manage their own bookings, with no password needed.

1. The customer opens the portal from your booking page or one of your emails.
2. The customer enters their email address.
3. FullClass™ emails them a sign-in link. For privacy, the page does not say whether that email address has an account.
4. The customer opens the link before it expires.
5. The customer sees their bookings and can cancel one if your cancellation policy allows it.

• Each booking shows the event, what was paid, add-ons, tax, discounts, gift cards used and, if cancelled, any refund.
• From their account, customers can edit their name and phone, change their email, and export their data. A new email only takes effect once the customer opens the confirmation link sent to that address. The old address is then told about the change.
• When a customer has a referral link, they can view and copy it from their account to share with friends.
• The portal uses your logo and colors.

Users and roles

• Roles & permissions. Owners choose exactly which parts of the admin admins and staff can open, in Settings → Roles & permissions. Everyone can always see the calendar and the class lists. Owner-only settings (payments, branding, API keys and billing) are never shared. The page also shows which users can reach each area right now. A change takes effect the next time each person loads a page, and is recorded in the activity log.
• Access for one person. An owner can also change access for a single person, from that user's edit page. For each area, choose Inherit (follow the role), Allow or Deny. For example, you can let one admin see reports but not another, or give one staff member the bookings area. A choice for one person always wins over the role. Owners can even hide areas they don't use from their own account. The Users area is the one thing an owner can never turn off, so they can always get back in to change it.
• Data visibility. A second group of toggles in Roles & permissions and on each user's edit page controls who can see private details on pages they can already open. That is Customer contact (a customer's email, phone and address). Owners see it, and admins and staff do not, unless you change it. Give it to the admin who answers the phone, without showing every customer's details to everyone.
• Each user has an email, a name and a role. They can also have notification settings, profile details, a photo and connected apps.
• If a user has not finished setting up their account, you can send their setup email again.
• Account setup asks for a name. The link in a new user's welcome email opens a Set up your account page that asks for a first name, a last name and a password before it will finish. The name boxes arrive filled in with whatever you entered when you created them, so most people just confirm it. This only happens the first time. Once someone has signed in, a forgotten-password link asks for a password and nothing else.
• You can sometimes restore a deleted user. Always check who has access after staff changes.
• Each user can change their own password from My Profile → Security → Password, which asks for their current password. For a forgotten password, use the Forgot password link on the sign-in page instead.
• Your own name and email. Everyone can correct their own name and change their own sign-in address from My Profile → Account, whatever their role. Your role is the exception, and you cannot change it there. Only an owner changes roles, from Settings → Users.
• Changing your email is two steps. It asks for your current password, then sends a confirmation link to the new address. Nothing moves until you use that link, and your old address keeps working until you do, so a typo can't lock you out. The link lasts two hours, works once, and asking for another one cancels the first. Your old address is told as soon as a change is requested, so if it wasn't you, you hear about it while you can still sign in.
• Security at a glance. The Security card shows where each thing stands. It says whether two-factor is on, how many passkeys you have added, and when your password was last set (or that it has not changed since the account was set up).
• Each user can connect Google Calendar from their profile.
• Role limits. Only an owner can create an owner or make someone an owner. Admins can manage admins and staff, but cannot create an owner. The last owner cannot be moved to another role or deleted, so the account always has at least one owner.

Your own language, dates, and times

Two settings, on the Display card under My Profile, control how the admin looks to you. They sit together, but they are two separate choices, and they are yours alone. Changing either one does not affect your staff, and it does not change anything your customers see. What customers read comes from your booking page language, under Settings → Booking Widget.

• Language is the language of the words, which can be English, French, Spanish, Italian or German. There is also a globe button in the sidebar menu on every page. So if the admin ever opens in a language you can't read, you can always switch it back.
• Date and time is the format. It sets whether a date reads Mar 14 or 14 Mar, and whether a time reads 3:04 PM or 15:04. Every option in the list shows you what it looks like, so pick the one that reads right to you.

The two are separate on purpose. You can read the admin in English and still see British dates and a 24-hour clock, or read it in French with a 12-hour clock. Leave Automatic selected and dates follow your language.

Signing in and sessions

• Everyone signs in on the same Sign in page, with an email and password. Owners and admins then see the dashboard, and staff see the calendar.
• For safety, sign-in has a limit on tries. After several failed attempts in a row, the page asks you to wait about a minute before trying again. A wrong email and a wrong password show the same message on purpose, and take the same moment to answer, so the form never reveals whether an email has an account. The Forgot password page answers the same way, for the same reason.
• A sign-in lasts up to 12 hours, then you sign in again. Sign out from the account menu when you finish on a shared or public computer. Signing out ends your session immediately on every device, not just the one you are using, so a forgotten or borrowed computer cannot stay signed in.
• Finishing a password reset emails you a security alert. Whenever a password is set through a reset link, the account's own mailbox gets a note saying so. If that arrives and it was not you, someone else has been through your inbox, and the alert is your cue to act. Changing your password from your profile page sends the same alert.
• Forgot a password? Use the Forgot password link on the sign-in page. The emailed link works once and expires after 24 hours. To change a password you know, use My Profile → Security → Password, which asks for your current password.
• What makes a password acceptable. Eight characters or more, and not one of the few thousand passwords that turn up in every data breach, such as password, 12345678 or Password1. If you pick one of those, you are told so and asked for another. A password you already use keeps working until you change it. The rule is the same on the reset page and on My Profile → Security → Password.

Two-factor authentication (2FA)

• Each user can turn on two-factor authentication from My Profile → Security using an authenticator app such as Google Authenticator or 1Password. Once it is on, signing in also asks for a 6-digit code.
• Save the one-time recovery codes shown during setup somewhere safe. They let you sign in if you lose the device with your authenticator app. Type a code in however you wrote it down, in upper or lower case, with or without the dash. If a code is refused, you are told so plainly and can try another from your list. It does not mean your codes are used up.
• Turning two-factor authentication off asks for your current password. That way, someone using your signed-in computer can't quietly remove it. Resetting your password also signs you out everywhere else.
• Ask everyone with an owner or admin account to turn on 2FA, because those accounts can reach billing, payments and API keys.

Passkeys (Face ID / Touch ID)

• A passkey lets you sign in with Face ID, Touch ID, or your device PIN instead of typing a password and authenticator code. Add one from My Profile → Passkeys.
• Because a passkey combines your device with your fingerprint, face, or PIN, it already counts as two-factor. Signing in with it skips the separate 6-digit code step.
• On the sign-in page, choose Sign in with a passkey. On a phone this is the smoothest option, including iPhone Chrome where authenticator-code autofill is unreliable.
• You can add a passkey on each device you use, and remove any of them at any time. Your password and authenticator code keep working as a backup, so removing a passkey never locks you out.

Security basics

• Give each person only the access they need for their job.
• Review staff roles monthly and immediately when someone changes responsibilities or leaves.
• Keep your secret API key (starting sk_) private. Never put it on your website, in a screenshot, in an email or in a shared document.
• Your public key (starting pk_) is fine on your website. Give it only the permissions the widget needs, and enter your website's address under Settings → Booking Widget so other websites cannot use it.
• When a web developer or staff member leaves, replace your API keys and reconnect your payment account.
• Give everyone their own login, and keep the email accounts used to sign in secure.
• Use the activity log to find out who changed settings, bookings, gift cards, promo codes or customer details. Activity is kept for 12 months. Older entries are removed automatically, so export anything you need to keep for longer.
• Export only what you need, and keep exported files somewhere safe.

Looking after customer privacy

• When helping a customer, search for them by their full email address so you change the right person.
• Check you are talking to the right person before you discuss their bookings, payments, refunds or portal.
• Never write full card numbers in notes. The booking number and the last four digits of the card are enough.
• Keep your notes professional. Other admins or support teams may read them later.

Closing your account

Go to Settings → Delete account. Only the business owner can do this. It is different from cancelling your subscription. Cancelling stops the billing and keeps everything for 30 days after the subscription ends, so you can come back. Deleting closes the business straight away and deletes your records 30 days later. A cancelled account that is not re-subscribed within those 30 days is deleted in the same way.

If you only want to stop paying, use Settings → Billing instead.

What happens when you confirm

1. Straight away. Your subscription is cancelled, your booking page and widget go offline, and the admin is locked to the delete account page. Nothing is deleted yet. You do not get a refund for the rest of the period you have already paid for.
2. For the next 30 days. Your data sits untouched. The owner can undo the deletion from that same page and pick up where you left off, and you can still download a full data export.
3. After 30 days. Every booking, customer, class, event, gift card, waiver, report and staff login is deleted from our systems, and backup copies are erased within a further 60 days. This cannot be undone, and support cannot recover it for you afterwards. We keep our own record of what we billed you, as the law requires.

To confirm, you type your business name exactly as shown and tick the box. We also email the owner and the billing contact with the deletion date and a link to undo it.

Undoing a deletion brings the studio straight back, but it does not restart your subscription. You choose a plan again from Settings → Billing before you can take bookings.