Privacy Policy

This policy explains how A-Core Pole Fitness Centre collects, uses and protects personal data when you browse this website, create an account, book a class, buy a class pass, membership or gift card, contact us or subscribe to updates.

For UK data protection purposes, A-Core Pole Fitness Centre is the data controller for this data.

Before your first online group class booking, we ask you to complete our Google attendance and health form. This collects your contact details, date of birth, emergency contact, relevant health information, studio-policy agreement and typed electronic signature. Health information is requested with your explicit consent for class safety. Private-session attendees complete paper attendance and health forms at the studio before taking part; the online form is not required to book a private session.

Your form answers are held in the studio’s Google Forms account. The booking website receives only the information needed to verify your submission: your booking email and verification code, form and response references, typed signature, signing time and agreement confirmations. Medical answers and emergency-contact details are not copied into the booking website. Other customers cannot view your responses.

Photo and video permission is a separate choice and is not required to book. Contact the studio using the details above to update your information, discuss your consent or request access to your form.

The mobile app can keep an optional wellbeing journal of food, drinks, substance timing, exercise and sleep, alongside your chosen goals, birthday and body measurements. Optional sky reflections can also store your birth time, birthplace timezone and coordinates you enter. Planetary calculations run on the device; birthplace details are not sent to a geocoding service. These entries are encrypted on your device and separated by studio account. They are not uploaded to the studio booking database or shared with instructors. You can delete entries, remove imported snapshots or delete the complete local journal from Stats.

When you choose to connect Apple Health or Android Health Connect, the app requests read-only access to the relevant activity, sleep, heart-rate and body-measurement information you permit. Apple Health can also supply your birthday if you allow it. Compatible watches and other devices must first share information with the relevant health service. Reads occur when you request a sync or session import; the app does not continuously monitor you or write to your health service. You can revoke access in your device health permissions. Removing the local journal does not delete source records in Apple Health or Health Connect.

Optional food-photo identification runs on your phone. When you choose to download the model, model and tokenizer files are fetched from Hugging Face, which receives normal download request metadata. Photos, meal descriptions and wellness records are not sent to the studio or an AI service. You review suggested food matches and portions before the app calculates approximate nutrients from its bundled food reference. Manual food search and label logging work without the model. You can remove the downloaded model in Food.

Exports are readable files containing your journal, created only when you choose Export. Save or share them carefully. Journal entries are not automatically synced to another phone. Sleep, food and activity figures are planning estimates, not medical measurements or diagnoses; optional astrology reflections do not influence health calculations.

If you choose “Sign in with Google”, Google shares your name, email address and profile picture with us. We use this only to create your account and sign you in securely. We request the minimum information needed to authenticate you — we do not access your Gmail, Google Calendar, contacts or any other Google data.

A-Core Pole Fitness Centre’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review or revoke our access at any time in your Google Account permissions.

• to create and manage your account and log you in securely
• to take payment and confirm, reserve, waitlist, cancel or refund your class bookings, passes and memberships
• to send booking confirmations, reminders and cancellation notices
• to respond to enquiries and referrals, and (with consent) send studio updates
• to operate, secure and improve the website
• to keep records required for accounting, tax and to establish or defend legal claims

• Stripe, to process card payments, subscriptions, gift cards and refunds
• our email provider, to send transactional and (where opted in) marketing emails
• our database and hosting providers (Neon and Vercel) needed to run the site
• regulators, courts or law-enforcement where disclosure is legally required

We do not sell your personal data.

• account, booking and payment records: as long as needed to provide the service and meet accounting/tax obligations (commonly up to 6 years)
• marketing data: until you unsubscribe
• enquiries: only as long as needed to respond and resolve any follow-up

• to request a copy of the data we hold about you
• to have inaccurate data corrected, or deleted where there is no lawful reason to keep it
• to object to or restrict certain processing, and to withdraw consent
• to complain to the UK Information Commissioner's Office (ico.org.uk)

Passwords are hashed using scrypt with a fresh random salt for each password. Hashing is one-way: signing in compares a derived hash rather than recovering your password. Password hashing does not encrypt your booking or profile records.

HTTPS protects data travelling between your browser and the website. The application accesses its Neon database through its HTTPS driver. Storage encryption and backup protection are managed by our hosting and database providers; the application does not separately encrypt each profile or booking field. Authorised staff and services can access records needed to provide the service. This is not end-to-end encryption.

Server-side role and ownership checks restrict access. Request validation, payment-signature verification, rate limits and security headers provide additional protection. Encryption alone cannot prevent misuse of an authorised account or protect data after it has been downloaded.

Contact the controller using the email above to request access, correction, erasure, restriction or a portable copy where applicable, or to object to processing. We may need proportionate identity verification. We normally respond within one month; where a lawful extension applies, we explain it within that month. Withdrawal of consent does not affect earlier lawful processing. Some records must be retained to meet legal obligations.

You can complain to the Information Commissioner’s Office.

We use reasonable technical and organisational measures to protect your data, including hashed passwords and specialist providers for payments and hosting. No online service can be guaranteed completely secure. Questions? Email a.corepolestudio@gmail.com.

See also our Cookie Policy.