My BDSLviv Privacy Policy
The My BDSLviv app (the "App") is developed and provided by the NGO "Dance Platform" ("we", "us"), Bachata Dance School Lviv, 38 Dzherelna Street, Lviv, Ukraine.
This Policy explains what data the App collects, why, how we store it, and what rights you have.
1. Data we collect
1.1. Account data. Using the App requires a school student account. We process: first and last name, user role, account identifier, and contact details - email address, phone number and Telegram username (as provided to the school or entered in your profile), plus a profile picture if uploaded. You choose that picture yourself through the iOS system photo picker, or take it with the device camera - the App has no access to the rest of your photo library.
1.2. Class and subscription data. Your schedule, class bookings, attendance, purchased subscriptions and their status, and orders created in the App.
1.3. Authentication data. After sign-in the App receives access and refresh tokens, stored only on your device in encrypted storage (the iOS Keychain, encrypted by the operating system). We do not share these tokens with third parties. Your password is not stored in the App.
1.4. Usage analytics. Through Google Firebase Analytics we record pseudonymous usage events: screen views, sign-in and sign-out, schedule filter usage, subscription grouping toggles, subscription selection and invoice opening, language, theme and notification setting changes, profile updates, and opening class or group details. Events may carry a class or group identifier and the selected language and theme. These events are tied to a Firebase-generated app instance identifier, not to your name or email.
1.5. Crash and performance data. Through Firebase Crashlytics and Firebase Performance Monitoring we receive crash reports (stack traces, device model, OS version, app version) and performance metrics (startup time, network request duration). The App is also subscribed to iOS MetricKit, which delivers pseudonymous operating-system diagnostics about hangs, terminations and device resource use.
1.6. What we do NOT collect. The App does not collect location data and does not read your contacts, photo gallery, calendar, SMS or call log. The App does not use an advertising identifier, shows no ads, does not ask for App Tracking Transparency permission and does not track you across other companies' apps or websites. We do not collect or store payment card details.
2. Payments
Subscriptions grant access to in-person classes at the school, i.e. you pay for a real-world service. Payment happens on the secure page of the payment service WayForPay, opened from the App. Card details are entered on WayForPay's side and are not accessible to the App. We only receive the fact and status of the payment. WayForPay's processing is governed by its own documents.
3. Why we process data
- providing the school's services: schedule, class booking, subscription tracking;
- authentication and account security;
- class reminders (generated locally on your device; the App uses no push notifications and sends us no device identifier);
- improving the App: usage analysis, detecting and fixing crashes;
- fulfilling our obligations under the service agreement.
The lawful bases are performance of our contract with you, our legitimate interest in a stable App, and - for analytics - your consent given by installing and using the App.
4. Who we share data with
We do not sell your data. Data is shared only with service providers required to run the App:
| Recipient | What they receive | Purpose |
|---|---|---|
| Google (Firebase Analytics, Crashlytics, Performance Monitoring) | pseudonymous usage events, crash reports, performance metrics | analytics and stability |
| WayForPay | payment data | payment processing |
| UAHosting (OVH infrastructure in Poland and Germany) | account and class data | backend hosting |
Google's processing is described in the Google Privacy Policy.
5. Storage and security
All traffic between the App and our server uses HTTPS/TLS encryption. Access tokens are stored encrypted on the device. The backend is hosted by UAHosting on OVH infrastructure located in Poland and Germany, so your data is stored within the European Union.
Account data is retained for as long as your account exists. Crash reports (Crashlytics) are retained for up to 90 days and analytics data (Firebase Analytics) for up to 14 months, after which they are deleted automatically.
6. Your rights
You have the right to access your data, correct it, delete your account, restrict processing, or withdraw consent to analytics. To exercise these rights, contact bdslviv.app+ios@gmail.com.
7. Account deletion
To delete your account and its associated data, send a request to bdslviv.app+delete@gmail.com from the email address in your profile. We will delete the data within 30 days. Deleted: your profile, contact details, profile picture, class bookings and attendance history. Retained only where the law requires it - in particular accounting records of payments made.
8. Children
The App is intended for adult students of the school. We do not knowingly collect data from persons under 18. If you believe a minor has provided us with their data, contact bdslviv.app+ios@gmail.com and we will delete it.
9. Changes to this Policy
We may update this Policy. The current version is always available at bdslviv.org.ua/mobile/ios/privacy-policy-en.html. We will notify you of material changes in the App or by email.
10. Contact
NGO "Dance Platform"
38 Dzherelna Street, Lviv, Ukraine
Email: bdslviv.app+ios@gmail.com