DanceFlow
Legal

Privacy Policy

Last updated: October 12, 2026

1. Who we are and whose data this is

DanceFlow (“we”, “us”) provides DanceFlow, software that dance studios, independent teachers and competition organizers use to run lessons, students, schedules, packages, payments, registration, signed agreements, messages and competitions. This policy explains how personal data is handled when you use DanceFlow on the web, in our iOS app or on Apple Watch, and when you visit danceflow.io.

Who decides about your data depends on whose data it is:

  • Your login (we are the controller). When you create a DanceFlow login, as a studio owner, staff member, teacher, student, parent, organizer or judge, we decide how your login details are handled, and this policy applies to us directly.
  • A studio's records (the studio is the controller, we are its processor). Students, families, lessons, payments, registration answers and signed documents are the studio's records. The studio decides what to collect and why, and we process that data only to provide the service, on the studio's instructions and under our agreement with it. If you dance or teach at a studio, ask the studio first about your data. We will help it answer you.
  • Competitions (the organizer is the controller). Entries, heats, marks and results of a competition are the organizer's records, which we process on the organizer's behalf. Results an organizer publishes are covered in section 8.

2. Information we collect

Depending on how you use DanceFlow, we process:

  • Account and profile: name, email address, phone number, a password stored only as a secure hash by our sign-in provider, your role at each studio or competition, language, time zone, notification choices and an optional profile photo.
  • Studio and teacher details: the studio's name, legal name, address, phone, time zone, logo, branding and settings; a teacher's name, contact details, bio, photo, qualifications, rates, availability and pay records.
  • Student records kept by a studio: name, contact details, address, date of birth, level, goals and experience, attendance and lesson history, packages and balances, partners and couples, family links, staff notes, answers to the studio's own questions, and any other detail the studio chooses to record, such as gender or pronouns.
  • Children and families: for a student under the studio's adult age, a parent or guardian's name, email, phone and relationship, the family the child belongs to, and an emergency contact.
  • Health and accessibility notes: only if a studio, a dancer or a parent records them: allergies, conditions, medication, injuries, accommodations, or answers to a studio's own health questions. See section 5.
  • Registration and sign-up: what a person enters when signing up at a studio without an account. See section 3.
  • Signed waivers and agreements: the signed text and the evidence kept with it. See section 4.
  • Enquiries and bookings from a studio's public pages: name, contact details, the message, dances and experience, how the person heard of the studio, and the campaign tags (UTM) in the link that brought them.
  • Lessons and schedules: bookings, booking requests, group classes, studio events, rooms and floors, attendance, lesson notes, ratings and feedback.
  • Payments and invoices: invoices, payments, refunds, packages, memberships and payment plans, and their status. For a saved card we keep only the brand, the last four digits and the expiry date that Stripe returns. Card numbers are typed on Stripe's own payment page, and we never receive or store them.
  • Competitions: entries, partners, studio and teacher, back numbers, heats and schedules, judges' marks, results, competition sign-ups through a studio and their prices, and the names and contact details of officials.
  • Messages: chats and group chats with the pictures attached to them, announcements, the emails and text messages sent through DanceFlow and whether they were delivered, your consent to text messages and any STOP reply, and anything you send us through the contact form.
  • Calendar links: your private calendar link and when it was last fetched. See section 9.
  • Device, security and diagnostics: the push notification token of your device, the app version and whether you use the web or the iOS app, IP addresses and browser or device type kept with a signature or a sign-up attempt, the studio's activity log of which staff member changed which record and when, the request logs of our hosting providers, and crash reports (section 6).
  • How a studio found DanceFlow: when you first open our website we note, in your browser only, the campaign tags (UTM) in the link you followed, the domain of the site that linked to you and the page you opened. Nothing is sent to us at that point. If you later create a login or a studio, that note is saved with it, and for a studio also the system its owner says it used before. We use it to learn where studios come from; we do not use it to follow you across sites, a tag that looks like an email address or a phone number is discarded, and no studio can read it. Nothing is noted when your browser sends a Global Privacy Control or Do Not Track signal.
  • Cookies and storage on your device: your sign-in session, your language, theme and similar choices, what the app keeps on your device to work offline, and the note described above of how you first reached our website. We use no advertising or cross-site tracking cookies.

3. Registration and sign-up at a studio

A studio can let people sign up without a DanceFlow account: at its front desk, on a kiosk iPad, or on its public registration page. Depending on what the studio asks, the form collects the person's name, email, phone, date of birth and emergency contact, a parent or guardian's details for a child, the answers to the studio's own questions, and the details of two people when a couple signs up together.

If the studio already has a record of the person, for example from an enquiry or a booked first lesson, and the name and the email or phone match, the sign-up completes that record instead of creating a second one. It fills in details that are blank and never changes the name or address already on file.

To prevent abuse, we keep a record of each sign-up attempt, with the studio, the email address and the IP address, for one day, and we limit how many sign-ups can come from one address.

A sign-up creates a DanceFlow login only if the studio offers one and the person asks for it. For a child, the login is given to the parent or guardian, never to the child.

4. Electronic signatures and signed documents

A studio can ask you to sign a liability waiver, a package or membership agreement, or the terms of a competition in DanceFlow, by typing your name, drawing your signature, or both. A parent or guardian signs for a child. Before you sign, you are asked to agree to sign and keep the document electronically.

So that a signature can be proven later, we keep with each signed document:

  • the full text you signed, a fingerprint (hash) of that text and its version, and the translation you read if the studio provided one
  • your name, the person you signed for, and your relationship to them
  • the date and time of signing, and the time zone it is shown in
  • your IP address and your device or browser (user agent)
  • your drawn signature or typed name, and the language of the screen
  • the statements you ticked, such as agreeing to the terms, agreeing to sign electronically and, for a parent, declaring that they are the child's parent or guardian
  • how it was signed (kiosk, web page, front desk or app) and which staff member presented it
  • the studio's legal name and address at the time

A signed document cannot be changed or deleted by the studio. It is kept for as long as the studio's account exists, even after a student leaves the roster, because it is the studio's legal record. If you delete your DanceFlow account, the IP address and device details on the documents you signed are cleared; the signed text, the names and the date remain.

When you sign, a copy is emailed to you if the studio has this turned on (it is on unless the studio turns it off), and you can read your signed documents and your children's in the app at any time. The studio's owners and the staff it chooses can read them too.

5. Health information and children

Some details a studio, a dancer or a parent may record are sensitive: allergies, medical conditions, medication, injuries, accommodations for a disability, or answers to a studio's own health questions. They are optional and are entered by the studio, the dancer or their parent. They are visible to the studio's staff and, for a child, to the child's parent or guardian, and we process them only to provide the service to the studio. We never use them for anything else.

DanceFlow is not directed to children. A child's information is entered by their studio or by a parent or guardian, a parent or guardian signs on the child's behalf, and when a child is registered online with a login, the login belongs to the parent or guardian. We do not knowingly allow a child under 13 (or the minimum age where they live) to create an account or knowingly collect personal data directly from such a child. If you believe a child has given us personal data directly, contact us and we will delete it.

Studios are responsible for having a lawful basis and any consent they need, including a parent's consent for a child, before they record this information.

6. How we use information

We use personal data to:

  • Provide the service: schedules, bookings, packages, balances, attendance, invoices, registration, signed documents, messages and competitions
  • Process payments to studios through Stripe
  • Send the messages you or your studio choose, such as reminders, confirmations, receipts, copies of signed documents, announcements and summaries, by email, text message and push notification
  • Keep the service secure, prevent fraud and abuse, and limit automated sign-ups
  • Find and fix problems, using our own crash reports
  • Provide support and answer your requests
  • Comply with the law and enforce our terms

Crash reports. When a screen fails, the app sends us a short report: the error message, where in the code it happened, the page, the app version and whether it was the web or the iOS app. Email addresses, phone numbers, long numbers, ids and keys are removed before it leaves your device and again on our server. It is stored with your account and studio, so that the studio owner can see problems on the studio's devices, and it is deleted after 30 days. We use no third-party crash reporting or analytics service.

We do not sell personal data or share it for cross-context behavioral advertising, we show no ads, and we do not track you across other companies' apps or websites. We do not use your data to train AI models, and we send it to an AI model provider (Anthropic) only when your studio turns on call summaries or suggested replies, and then only the call or conversation someone asks about.

7. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies and we act as a controller, we rely on: performance of a contract (to provide your account and the service); our legitimate interests (to secure the service, prevent abuse, fix crashes and support you); your consent where we ask for it (for example text messages and push notifications); and compliance with legal obligations. Where we act as a processor, the studio or the competition organizer is responsible for the legal basis.

8. How we share information and our subprocessors

We share personal data only as needed to run the service:

  • Within your studio: owners, staff and teachers see what their role and the studio's settings allow, and a parent sees their own children's records.
  • Within a competition: organizers, judges and scrutineers see the entries and marks of their event.
  • Subprocessors: providers that process data on our behalf under contract:
    • Supabase · Database, sign-in, file storage and server functions, hosted in the United States
    • Netlify · Hosting of the website and the web app
    • Stripe · Card payments from students and families to their studio, through the studio's own Stripe account
    • Resend · Sending email
    • Twilio · Sending text messages and receiving STOP replies
    • Anthropic · Writing summaries of AI receptionist calls, suggested replies for studio staff to edit, and draft receptionist answers from a studio's own website (Claude)
    • Apple · Push notifications to iPhone, iPad and Apple Watch (Apple Push Notification service)
    • Web push services · Notifications in a web browser, if you turn them on there, delivered by your browser's own push service (for example Google, Mozilla or Apple)
  • Public pages: a studio may publish booking and registration pages showing its teachers' names, photos and bios. A competition organizer may publish results at a public link. Any dancer can withhold their name from public results in the app; the placing stays so that nobody else's place changes, and a studio may withhold a dancer's name but never show it again once withheld.
  • Legal and safety: where required by law, or to protect the rights, property or safety of users or the public.
  • Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.

9. Calendar subscription links

You can subscribe to your DanceFlow schedule in Apple Calendar, Google Calendar, Outlook or another calendar app. Each person gets a private link that contains a long random key. Your calendar provider's servers fetch that link on their own schedule, often hourly, and receive what your calendar shows: lesson and class times, the names of teachers, students or partners, rooms, studio events, and competition sessions and heats. The copy they fetch is then held by your calendar provider under its own privacy terms. We record when the link was last fetched.

Anyone who has the link can read that calendar, so keep it private. You can reset the link (the old one stops working at once) or turn it off where you set it up in the app, in Settings or your profile. A studio decides which staff may subscribe to the whole studio's schedule and how names appear in it.

10. Data retention and deletion

We keep personal data while the account or the studio records it belongs to exist. A studio decides how long it keeps its own records.

  • Deleting your account: choose Delete account in the app, in Settings or your profile. This removes your login and clears your personal details from every record that is you: contact details, date of birth, emergency and guardian contacts, health and staff notes, photos, push tokens and notifications. Your name on a studio's student record is replaced with "Deleted student" and your name in published results with "Withheld". If you own a studio, hand it over to another owner first; if nobody can take it over, write to us and we will close it.
  • What is kept: records a studio needs for its accounts and legal obligations, without your contact details: invoices, payments and the payment ledger (which cannot be edited), packages, lessons that took place, and signed documents (section 4). A teacher who taught or was paid stays named on those records.
  • What a studio can delete: a studio can remove a student from its roster, and its owner can clear the contact details of former students after a period the studio chooses.
  • Short-lived records: crash reports are deleted after 30 days, and sign-up attempt records after one day.
  • Backups: we do not currently keep separate backup copies of the database that we can restore from, so deleted data does not remain in backups. If that changes, this section will say how long deleted data can remain in them.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your local data protection authority.

In the app you can change your notification settings, withhold your name from public competition results, reset or turn off your calendar link, and delete your account. You can stop text messages by replying STOP and unsubscribe from emails with the link in each one.

California residents. In the past 12 months we collected the categories described in section 2: identifiers (such as name, email, phone, account id and IP address); customer records and financial information (such as address, invoices, payments, and a card's brand and last four digits); characteristics of protected classifications where a studio records them (such as age, gender or a disability accommodation); commercial information (packages and purchases); internet activity limited to security records and crash reports; sensitive personal information (your login and any health notes); and other information you or your studio provide. We collect it for the purposes in section 6 and disclose it only to the recipients in section 8. We do not sell or share personal information, and we use sensitive personal information only to provide the service. You may ask to know, delete or correct your information, use an authorized agent, and you will not be treated differently for doing so.

To exercise these rights, contact us with the Email us button at the end of this policy. If your data was provided by a studio or a competition organizer, we will pass your request to them as the controller, or act on their instructions.

12. Security

We apply technical and organizational safeguards, including:

  • Encryption of data in transit using TLS
  • Encryption at rest through our cloud infrastructure (Supabase)
  • Row-level access rules in the database, so each person reaches only what their role allows
  • Passwords stored only as secure hashes, and least-privilege access for staff
  • Signed documents that cannot be edited, each with a fingerprint (hash) of the signed text
  • Crash reports with personal details removed before they are sent

No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authorities of incidents where the law requires it.

13. International data transfers

Our database and servers are hosted in the United States, and our subprocessors may process data in the United States and other countries. Where data is transferred from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

14. The iOS app, Apple Watch and the App Store

The iOS app collects the same categories of data as the web app. In addition:

  • Push notifications are delivered through Apple only if you allow them, and you can turn them off in iOS Settings at any time.
  • The camera and photo library are used only when you choose to take or attach a picture, such as a profile photo, a picture in a message or announcement, or a studio logo.
  • Widgets, Live Activities and the Apple Watch app show your lessons from a copy kept on your device. The Watch app contacts our servers as you to mark a lesson complete or add a note.
  • The app does not use your location, your contacts, Apple Health data or the microphone.
  • We do not use the App Tracking Transparency framework because we do not track you, and the app contains no advertising or analytics SDKs.
  • You can delete your account in the app, as described in section 10.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date, and we will give additional notice where the law requires it.

16. Contact us

For privacy questions or to exercise your rights, use the Email us button below.

We aim to respond to privacy requests within 30 days.