Privacy policy

Who this policy covers

SHEEDance, operated as Shashila Dance Troupe & Theatre, provides in-person dance and fitness classes, event performances, and the SHEEDance website, portal and iOS and Android apps. This policy covers those services. For privacy questions, contact [email protected] or +61 450 488 312.

Information we collect

Account information includes your name, email address, optional Australian phone number, account identifiers, sign-in provider identifiers, and your registration agreements. We record the policy versions and text you accepted, acceptance time and registration channel.

Class and account records include bookings, family profiles, attendance, credits, vouchers, subscription details, payment and refund references, and communications. If you provide them, we also hold emergency contacts, medical conditions, allergies, medications, treatment permission and a membership photo. Medical information is sensitive information; provide only information needed for class safety and obtain permission before supplying another person’s information.

If you request a bank refund, we collect the account name, BSB and account number. Bank details are encrypted in the database and used by authorized staff to arrange the requested transfer and resolve refund enquiries.

For security and support, the service records access and activity information such as timestamps, IP addresses, browser/device information, app version and error logs. Contact forms collect your name, email, subject and message so staff can respond. Newsletter forms collect your email and your separate marketing choice; subscriptions become active only after email confirmation. Do not include payment-card details, passwords or unnecessary health information in contact messages.

Why we use information

We use information to create and secure accounts, register students, manage class capacity and attendance, maintain credits and billing records, issue receipts, provide support, and send operational notices. Authorized staff use relevant student safety and emergency information when running classes.

Registration acceptance does not sign you up for marketing. Newsletter subscription requires a separate, unticked choice and email confirmation. Each newsletter must offer an unsubscribe method; you can unsubscribe without signing in. Service and account messages, including receipts, security messages and deletion confirmations, are separate. Optional photos and medical information are not required to create an account; withholding information needed for safe participation may affect the classes we can provide.

Family profiles and younger students

A parent or guardian should manage registrations and safety information for children. Supply family-member and emergency-contact details only if you have authority to do so, and explain this policy to them where appropriate. Contact us to correct or remove information for a family member.

Payments and service providers

Stripe processes card payments and recurring billing. SHEEDance stores payment references, amounts, status and limited card display details such as brand and last four digits; the portal and app do not store complete card numbers or security codes. Credit and voucher balances are maintained in the portal.

If you choose Apple, Google or Facebook sign-in, that provider verifies your identity and supplies the account information you authorize. Hosting and email providers process information needed to operate the service. If reCAPTCHA is enabled on a web form, Google processes browser/device and interaction information for abuse prevention under its Privacy Policy (https://policies.google.com/privacy) and Terms (https://policies.google.com/terms). We use providers for these service purposes and require appropriate protection of information. We may disclose information where required or permitted by law, to resolve payment disputes, or to respond to emergencies.

Service providers may process information outside Australia. Processing locations depend on the providers and services used. Contact us for information about current providers and overseas processing before supplying information if this is important to you.

We do not sell personal information. The SHEEDance apps do not include advertising or cross-app advertising tracking. We do not use health or children’s information for advertising. Any future materially different collection or use will require an updated notice and consent where required.

Cookies, device storage and permissions

The portal uses essential session cookies and security protections. The app stores sign-in credentials in protected device storage on iOS and Android. If you enable biometric sign-in, your device performs the biometric check; SHEEDance does not receive your face or fingerprint template.

Camera and photo-library access are optional. A membership photo can be taken or selected by you. Authorized staff can use the camera to scan membership QR codes for attendance. If you set up a passkey, your authenticator keeps the private credential; the portal stores its public key and credential identifiers. Your device or browser handles biometric checks; we do not receive biometric templates. Links to WhatsApp, maps and social media open services with their own privacy policies.

The app does not request location, contacts-address-book or microphone access for ordinary class booking. You can decline optional camera/photo permissions and still manage bookings. Change permissions in device Settings. Marketing consent can be withdrawn using an unsubscribe link or by contacting us; withdrawing marketing consent does not close your account.

Security, retention and account deletion

Access to administration and student records is restricted by role. We use access controls and safeguards for credentials and sensitive records. Contact us promptly if you suspect someone has accessed your account without permission.

We retain active account information while you use the service. On verified deletion we remove or de-identify operational profile data. Necessary invoices, payment/refund and credit records and related consent/audit evidence may remain for financial, safety, dispute and legal obligations; these are restricted to those purposes rather than keeping an active account. Their period depends on the applicable recordkeeping obligation and any unresolved claim or balance. Contact us for the period applying to a specific record. Backups are kept separately for recovery and removed through the backup rotation; if a backup is restored, deletion restrictions must be reapplied before normal use.

Delete your account in the iOS or Android app under Account & security → Request account deletion, or visit https://portal.sheedance.com/account-deletion without signing in or reinstalling the app. Enter your account email and confirm ownership using the emailed link, then confirm permanent deletion on the page. Opening the email link alone does not delete your account. Links expire after 3 days; you can request a new one. Processing normally completes within 24 hours of confirmation; provider outages can delay completion and we send a completion email. Deletion revokes sign-in and passkey/session access, revokes Apple sign-in tokens when applicable, cancels recurring billing, and removes or de-identifies profile, family, medical, emergency-contact and membership-photo data. Matching website enquiries and newsletter subscriptions are also removed. Necessary financial and consent/audit records remain as explained above. Outstanding credit, refunds and consumer rights are preserved for settlement; contact us using your member reference.

Website enquiries are removed after 12 months, or sooner when staff delete them. Newsletter requests awaiting confirmation expire from our records after 7 days. Active newsletter records remain until you unsubscribe; unsubscribed records are removed after 30 days. Temporary confirmation-email payloads are removed after 7 days. Unconfirmed account-deletion requests expire from our records after 7 days. Abuse-prevention counters use short-lived keys, including keyed email hashes, rather than copying form messages into logs. Verification links and temporary security tokens expire automatically.

Access, correction and complaints

Contact [email protected] to request access to or correction of your information, discuss retention or overseas processing, withdraw an optional permission, or raise a privacy complaint. We may verify your identity before releasing or changing information. Withdrawing optional permission does not invalidate processing already carried out lawfully.

We will review your complaint and respond within a reasonable time. If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992, where applicable.

Changes to this policy

We publish a dated version when this policy changes. Registration records preserve the exact policy text accepted at the time. Where a change requires further permission or notice, we will request it or notify you before applying that change.