Last updated: draft, not yet reviewed by counsel.
1. Information we collect
- Account information: name, email address, and role(s) (organiser, judge, announcer, dancer, guardian).
- Dancer profiles: date of birth, competitive level, competitor number, guardian links, and — where a school or guardian chooses to enter them — emergency contact details, medical notes, and costume/shoe/wig sizes.
- Practice videos: only if a family chooses to add them — short clips of a dancer practising, visible to the dancer and their guardians, and to their school's organisers only for a clip the family shares. Each clip is deleted automatically 12 months after it's added, or sooner if the family deletes it.
- Event data: Feis entries, judging feedback and scores, results, invoices, and messages sent through the platform (e.g. announcements, support tickets).
- Spectator tickets: the name and email you give when buying tickets for a Feis, what you bought, and door check-ins — visible to the hosting school, and used to email you your tickets. You don't need an account to buy.
- Payment data: handled directly by Stripe for entry-fee, invoice and ticket payments — Feis-Out does not receive or store full card numbers.
- Technical data: basic sign-in/session information needed to keep you logged in and to secure the platform, and — only on a device where you turn push notifications on — that device's push token and browser type, delivered through Google's Firebase Cloud Messaging. Turning push off, signing out on that device, or deleting your account removes them.
2. How we use it, and our legal basis
- Running the platform for you — accounts, Feis entries and results, judging, invoicing, classes, tickets and bookings, and the emails/notifications those trigger. Legal basis: performance of a contract with you (or with your dancer's school).
- Keeping it secure and working — sign-in sessions, rate limiting, error monitoring, an audit log of privileged admin actions. Legal basis: legitimate interests in a safe, reliable service.
- Financial records — invoices, payments, refunds and ticket orders are kept to meet schools' accounting and tax obligations. Legal basis: legal obligation.
- Things you choose to turn on — push notifications on a device, practice videos, a public results page for a dancer, and (where the site uses it) Google Analytics. Legal basis: consent, which you can withdraw at any time from the same place you gave it.
We don't sell personal information, use it for advertising, or make automated decisions about you with legal effect.
3. Who can see your information
Access is scoped by role and enforced in the database's own security rules, not just hidden in the app. A dancer's own school organisers and linked guardians can see their full profile; judges and announcers see only what they need for the Feis they're invited to; published results and a school's public profile (including its class timetable) are visible to anyone, by design — but who is enrolled in a class is visible only to the school and that dancer's family. Platform admins can access data to operate and support the platform, and every privileged admin action is logged.
4. Service providers (processors) and international transfers
- Google Firebase — sign-in, database, file storage and push notification delivery.
- Vercel — hosting the website and its server functions.
- Stripe — card payments (Stripe holds the card details, never us). A school that connects its own Stripe account is paid by Stripe directly.
- Resend — sending transactional email.
- Sentry — error monitoring, where enabled.
- Upstash — short-lived rate-limit counters, where enabled.
- YouTube — live streams a host chooses to embed, using YouTube's privacy-enhanced mode (no YouTube cookies until you press play).
- Plausible (cookieless, no personal data) or Google Analytics (only if you accept the cookie banner) — site usage statistics, where enabled.
Some of these providers process data outside your country, including in the United States. Where data leaves the EU/UK, it's protected by the provider's Standard Contractual Clauses (or an adequacy decision such as the EU–US Data Privacy Framework). Each provider processes data only to provide its part of the service.
5. Children
Many dancer profiles belong to children. They're created and managed by a parent/guardian or their dance school, not by the child — a child doesn't need an account at all. If you're a guardian, you're confirming you have parental responsibility for the information you provide. Children's profiles are never shown on public pages; only published results (name, school and placing) are, as they are at any Feis. A family can make a dancer's results page public only by switching it on themselves.
6. Your rights
Depending on where you live (including under the EU/UK GDPR and Australia's Privacy Act), you have the right to:
- Access and portability — Account Settings → Download your data gives you everything we hold about you and any dancer you're guardian of, as one file.
- Correction — edit your own details in Account Settings; a dancer's school or guardian can correct a dancer profile.
- Erasure — Account Settings → Delete your account, which removes your sign-in and personal data except the records described under Data retention. A guardian can delete a child's profile that has no login of its own from that dancer's page, on the same terms.
- Restriction and objection — ask us to limit or stop using your data for a particular purpose.
- Withdraw consent — turn off push notifications, delete practice videos, hide a public results page, or change your cookie choice (Cookie settings in the footer) at any time.
- Complain — to your local data protection authority (for example the OAIC in Australia, the ICO in the UK, or your EU country's regulator).
For anything you can't do yourself, contact us (see below). We reply within one month.
7. Data retention
- Your account and profile — until you delete your account.
- In-app notifications — deleted automatically after 12 months.
- Enquiries sent through a school's public profile — deleted automatically after 24 months.
- Practice videos — deleted automatically 12 months after upload, or sooner if you delete them.
- Announced results and judging feedback — kept as the permanent record of the competition, even after an account is deleted.
- Invoices, payments, refunds and ticket orders — kept as the school's financial records for as long as accounting and tax law requires.
8. Security and breaches
Data is encrypted in transit and at rest by our providers, access is enforced by database security rules, and the app is reviewed against the OWASP Top 10. If a personal data breach is likely to put you at risk, we'll notify the relevant regulator (within 72 hours where the GDPR applies) and tell you without undue delay.
9. Changes
This policy may be updated as the platform changes; the latest version is always on this page.