Privacy Policy
Studio Connect is the data controller for the personal data described here. We handle
personal data in line with the UK GDPR and the Data Protection Act 2018.
1. What we collect
Account data — name, email address, account type, password (stored only as a hash by
our authentication provider), or your Apple/Google sign-in identifier.
Instructor profile data — profile photo, biography, qualifications, teaching
experience, specialisms, insurance declaration, approximate location, travel radius,
availability, Instagram and website links, optional teaching photos.
Studio profile data — studio name, logo, cover photo, gallery, description, address
and location, contact person details, studio type, Instagram and website links.
Opportunity and engagement data — the opportunities you post or apply to, invitations,
applications, and the messages in each conversation.
Verification documents — where you choose to upload them, copies of qualification
certificates and insurance documents. These are stored in a private, access-controlled
location.
Technical data — device type, app version, push notification token, and coarse
location if you grant permission, used to show nearby opportunities.
Usage data — the times you are active, used to keep match results relevant.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account | Contract |
| Matching instructors and opportunities | Contract |
| Showing your profile to matched counterparties | Contract |
| Enabling opportunity-linked messaging | Contract |
| Reviewing uploaded documents | Consent (explicit, for special-category-adjacent documents) |
| Preventing spam, fraud and abuse | Legitimate interests |
| Keeping the service secure and available | Legitimate interests |
| Product analytics | Consent |
| Marketing emails | Consent |
| Push notifications | Consent |
| Keeping records of terms acceptance | Legal obligation / legitimate interests |
You can withdraw any consent at any time in Settings → Privacy.
3. Location data
We store an approximate location for matching by distance. Instructors are asked for an
area and outward postcode rather than a full address. Precise device location, if you
allow it, is used only on your device to centre the map and to sort nearby results, and is
not stored against your profile.
When you type an area, postcode or address, your phone's built-in location service turns
it into map coordinates. That service is run by Apple on iPhone and by Google on Android,
so the text you type is sent to them for that purpose. On Android the map itself is
provided by Google Maps.
4. Who sees what
- Studios see instructor profiles only where the instructor matches one of their
opportunities, or where a conversation already exists.
- Instructors see studio profiles and open opportunities. A studio's contact details
are released only once a conversation has been opened about a specific opportunity.
- Nobody can browse a general directory of users, send cold messages, or export other
users' data.
- Verification documents are visible only to you and to our moderation team.
5. Sharing
We share data with service providers who process it on our behalf under contract, and
only for the purpose listed:
| Provider | What they do for us |
|---|---|
| Supabase | Hosting, database, file storage and sign-in |
| Resend | Sending account emails, such as password resets and email confirmation |
| Expo, Apple and Google | Delivering push notifications |
| Apple and Google | Sign in with Apple or Google, if you choose it; turning typed locations into map coordinates; the map on Android |
We do not take payments yet. Before studio subscriptions start, we will name the payment
provider here and publish an updated version of this policy.
We do not sell personal data and we do not share it for third-party marketing.
Our database and file storage are hosted in the EEA (Ireland). Some providers, including
Resend and Expo, may process data outside the UK; any such transfer is covered by an
adequacy decision (including the UK–US data bridge) or the UK International Data Transfer
Addendum.
6. How long we keep it
| Data | Retention |
|---|---|
| Active account and profile | While your account is open |
| Photos and documents you remove or replace | Deleted from storage within 3 days |
| Closed conversations and messages | 24 months after the conversation closes |
| Closed or expired opportunities | 24 months |
| Verification documents | Until replaced, withdrawn, or your account is deleted |
| Notifications | 6 months |
| Terms acceptance records | 6 years (evidence of agreement) |
| Deleted accounts | De-identified immediately; uploaded photos and documents deleted from storage within 24 hours; residual records removed on the schedule above |
Under UK GDPR you have the right to be informed, of access, to rectification, to erasure,
to restrict processing, to data portability, to object, and rights relating to automated
decision-making.
In the app:
- Settings → Privacy → Download my data produces a complete machine-readable export.
- Settings → Privacy → Delete my account starts erasure. Your profile is removed and
your details de-identified straight away, and the photos and documents you uploaded are
deleted from storage within 24 hours. Messages you sent are replaced with a placeholder
so the other party's record of the conversation remains coherent.
- If you run a studio on your own, deleting your account also removes the studio's
profile details and closes its open opportunities. If other people run the studio with
you, it stays with them; if you were its only owner, the longest-standing remaining
team member becomes its owner.
- Settings → Privacy lets you switch each consent on or off, and hide your profile
from discovery without deleting it.
We respond to any other request within one month. If you are unhappy with how we have
handled your data you can complain to the Information Commissioner's Office
(ico.org.uk, 0303 123 1113).
8. Automated decision-making
Match ordering is automated: results are ranked by distance, availability overlap,
qualifications, experience, profile completeness and recency of activity. It affects the
order in which profiles and opportunities appear. It does not produce legal or similarly
significant effects — every hiring decision is made by a human at the studio. You can
always search and filter manually rather than relying on the ranked feed.
9. Security
Data is encrypted in transit (TLS) and at rest. Access is enforced at the database level
by row-level security, so a user can only ever read the records they are entitled to.
Verification documents sit in a private store reachable only through short-lived signed
links. Sessions are held in the device's secure keychain/keystore.
10. Children
The platform is not for under-18s and we do not knowingly collect their data.
11. Contact
Data protection enquiries: privacy@studioconnectpilates.com