Privacy Policy

1. Who this policy applies to

Dance101 has three types of users, and we collect slightly different data for each:

• Students — people who discover, book, and attend classes.
• Instructors — people who list classes, sell places, and receive payouts.
• Guests — people who book a class without creating an account.

2. Information we collect

• Account & identity — your name, email address, phone number, and (for students who register directly) a password, which we store only as a secure hash. If you sign in with Apple or Google, we receive your name and email from that provider.
• Instructor profile — bio, city, profile image, intro video, contact details, and class listings you create.
• Instructor payout & identity verification — to pay instructors we use Stripe Connect, which collects bank account and identity details directly through Stripe's onboarding. We receive a Stripe account reference and payout status, not your full bank details.
• Booking data — the classes and sessions you book, attendance, and any notes you add. If you book as a guest, we store the name, email, and phone number you provide at checkout.
• Payment data — payments are processed by our payment providers (Stripe for cards, and TrueLayer for bank-to-bank / open banking payments where offered). We never receive or store full card numbers; we receive limited transaction details such as amount, status, and a payment reference. We also record credits, memberships, and wallet balances tied to your account.
• Saved cards — if you choose to save a card, it is stored by Stripe, not by us: your card number and security code never reach our servers. We store only a reference to your Stripe customer record against your account. The card brand, last four digits, and expiry date shown on your Cards page are read from Stripe at the moment you view it and are not stored by us. We keep the reference for as long as you have an account; you can remove individual cards at any time from Account → Cards, and deleting your account removes the reference. Our basis for storing a card is your consent, which you withdraw by removing it. Stripe retains payment records under its own policy and for as long as the law requires.
• Content & media — videos, audio, images, class previews, session recaps, and reviews you upload or record, including any transcriptions we generate from them.
• Messages & community chat — direct messages between students and instructors, and messages you post in community/group chat channels.
• Dance Agent (AI) input — the questions and messages you send to our in-app AI assistant ("Dance Agent" / "Dans Guide") and a session identifier used to manage your conversation and usage limits.
• Location — with your permission, your approximate or precise location, used to show dance classes and studios near you.
• Device & usage data — a device push-notification token, device/platform type, app interactions, and log and diagnostic data. This includes limited analytics and diagnostic data collected automatically by the Google Firebase SDK (see "Service providers" below).
• Connected accounts — if you choose to connect them: Google Calendar or Calendly (for scheduling) and Instagram (for instructors importing class posts). Access tokens for these are stored in encrypted form.

3. How we use your information

• Create and manage your account and authenticate you.
• Process bookings, payments, refunds, credits, and instructor payouts.
• Show classes near you and personalise recommendations.
• Enable messaging, community chat, and video playback.
• Answer your questions to the Dance Agent and enforce fair-use limits.
• Send booking confirmations, reminders, and service notifications (email and push).
• Generate class descriptions, transcriptions, and recaps to help instructors.
• Prevent fraud, keep the Service secure, and enforce our Terms.
• Comply with legal, tax, and accounting obligations.
• Send marketing messages where you have consented (you can opt out any time).

4. Legal bases for processing

Under the UK GDPR we rely on: contract (to provide bookings, payouts, and the Service you request); legitimate interests (to secure, operate, improve, and promote the Service, and to prevent fraud); consent (for optional marketing, location access, and certain device permissions); and legal obligation (for tax, accounting, and fraud-prevention records). Where we rely on consent, you can withdraw it at any time.

5. Service providers we share data with

We do not sell your personal data. We share it only with providers who process it on our instructions to run the Service:

• Supabase — authentication, database hosting, and media storage.
• Stripe — card payments and instructor payouts (Stripe Connect).
• TrueLayer — open-banking (bank-to-bank) payments, where offered.
• Mux — video processing and streaming.
• Google Firebase — push notifications (Cloud Messaging). The Firebase SDK also includes Google Analytics for Firebase, which may automatically collect limited app-usage and diagnostic data (such as app opens, device model, operating system, and a randomly generated app-instance identifier) to help us understand app performance and stability.
• OpenAI — powers the Dance Agent and features such as class-description generation and audio/video transcription. We use it through our own processing pipeline; your inputs are not used by us to train public models.
• Stream (GetStream.io) — community and group chat.
• Resend / SendGrid — transactional email (magic links, confirmations, reminders).
• Google Calendar & Calendly — optional instructor calendar sync.
• Instagram / Meta — optional Instagram connection for instructors.

We also share booking details with instructors so they can run their classes, and we may disclose data to authorities or third parties where required by law or to protect rights, safety, and the Service.

6. AI features and automated processing

The Dance Agent and certain instructor tools use AI models (via OpenAI and a retrieval-augmented pipeline) to answer questions, generate class descriptions, and transcribe media you upload. The messages and content you submit to these features are processed to produce a response. AI outputs can be inaccurate and are provided for general guidance only. These features do not make legal or significant automated decisions about you without human involvement.

7. International transfers

Some of our providers process data outside the UK (for example in the EU or the US). Where that happens, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses.

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we remove your profile and associated personal records, except where we must retain certain records — such as transaction and payout history — for legal, tax, fraud-prevention, or dispute-resolution obligations.

9. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, email support@banditsaimarketing.com. You can delete your account directly in the app — see our account deletion page. You may also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Device permissions

The app asks for these device permissions, only when needed and with your consent:

• Location — to show classes and studios near you.
• Camera, Photos & Microphone — to capture or choose cover images, preview videos, and voice notes for classes.
• Calendar — to add your booked classes to your device calendar.
• Notifications — to send booking reminders and updates.

You can change these permissions at any time in your device settings.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data. Where a child attends a class, bookings should be made by a parent or guardian. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Security

We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, encrypted storage of third-party access tokens, and access controls. No system is completely secure, so we cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes may also be notified in the app.