Privacy Policy
Studio Connect is the data controller for the personal data described here. We handle
personal data in line with the UK GDPR and the Data Protection Act 2018.
1. What we collect
Account data — name, email address, account type, password (stored only as a hash by
our authentication provider), or your Apple/Google sign-in identifier.
Instructor profile data — profile photo, biography, qualifications, teaching
experience, specialisms, insurance declaration, approximate location, travel radius,
availability, Instagram and website links, optional teaching photos.
Studio profile data — studio name, logo, cover photo, gallery, description, address
and location, contact person details, studio type, Instagram and website links.
Opportunity and engagement data — the opportunities you post or apply to, invitations,
applications, and the messages in each conversation.
Verification documents — where you choose to upload them, copies of qualification
certificates and insurance documents. These are stored in a private, access-controlled
location.
Technical data — device type, app version, push notification token, and coarse
location if you grant permission, used to show nearby opportunities.
Usage data — the times you are active, used to keep match results relevant.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account | Contract |
| Matching instructors and opportunities | Contract |
| Showing your profile to matched counterparties | Contract |
| Enabling opportunity-linked messaging | Contract |
| Reviewing uploaded documents | Consent (explicit, for special-category-adjacent documents) |
| Preventing spam, fraud and abuse | Legitimate interests |
| Keeping the service secure and available | Legitimate interests |
| Taking subscription payments | Contract / legal obligation |
| Product analytics | Consent |
| Marketing emails | Consent |
| Push notifications | Consent |
| Keeping records of terms acceptance | Legal obligation / legitimate interests |
You can withdraw any consent at any time in Settings → Privacy.
3. Location data
We store an approximate location for matching by distance. Instructors are asked for an
area and outward postcode rather than a full address. Precise device location, if you
allow it, is used only on your device to centre the map and to sort nearby results, and is
not stored against your profile.
4. Who sees what
- Studios see instructor profiles only where the instructor matches one of their
opportunities, or where a conversation already exists.
- Instructors see studio profiles and open opportunities. A studio's contact details
are released only once a conversation has been opened about a specific opportunity.
- Nobody can browse a general directory of users, send cold messages, or export other
users' data.
- Verification documents are visible only to you and to our moderation team.
5. Sharing
We share data with service providers who process it on our behalf under contract:
our hosting and database provider (Supabase), the push notification service (Expo/Apple/
Google), and our payment provider for studio subscriptions. We do not sell personal data
and we do not share it for third-party marketing.
Data is hosted in the UK or EEA. Where any transfer outside the UK is necessary, it is
covered by an adequacy decision or the UK International Data Transfer Addendum.
6. How long we keep it
| Data | Retention |
|---|---|
| Active account and profile | While your account is open |
| Closed conversations and messages | 24 months after the conversation closes |
| Closed or expired opportunities | 24 months |
| Verification documents | Until replaced, withdrawn, or your account is deleted |
| Notifications | 6 months |
| Terms acceptance records | 6 years (evidence of agreement) |
| Deleted accounts | De-identified immediately; residual records removed on the schedule above |
Under UK GDPR you have the right to be informed, of access, to rectification, to erasure,
to restrict processing, to data portability, to object, and rights relating to automated
decision-making.
In the app:
- Settings → Privacy → Download my data produces a complete machine-readable export.
- Settings → Privacy → Delete my account starts erasure. Your profile is removed and
your details de-identified straight away. Messages you sent are replaced with a
placeholder so the other party's record of the conversation remains coherent.
- Settings → Privacy lets you switch each consent on or off, and hide your profile
from discovery without deleting it.
We respond to any other request within one month. If you are unhappy with how we have
handled your data you can complain to the Information Commissioner's Office
(ico.org.uk, 0303 123 1113).
8. Automated decision-making
Match ordering is automated: results are ranked by distance, availability overlap,
qualifications, experience, profile completeness and recency of activity. It affects the
order in which profiles and opportunities appear. It does not produce legal or similarly
significant effects — every hiring decision is made by a human at the studio. You can
always search and filter manually rather than relying on the ranked feed.
9. Security
Data is encrypted in transit (TLS) and at rest. Access is enforced at the database level
by row-level security, so a user can only ever read the records they are entitled to.
Verification documents sit in a private store reachable only through short-lived signed
links. Sessions are held in the device's secure keychain/keystore.
10. Children
The platform is not for under-18s and we do not knowingly collect their data.
11. Contact
Data protection enquiries: privacy@studioconnectpilates.com