Privacy Policy

This app is operated by NovaCity Ltd, trading as NovaCity Centre, with sites in Rotherham and Barnsley, United Kingdom. We are the data controller for personal data you share with us through this app and at our centres.

• Email: novacitycentre@gmail.com
• Rotherham: 01709 801 261
• Barnsley: 01226 102 059

We collect only what we need to run sessions and keep people safe.

• Account details: name, email, phone, date of birth, password (hashed). Children added to a parent account include name and date of birth.
• Bookings & payments: sessions booked, payment status, refund credit balance. Card data is handled by our payment processor; we never see or store your card number.
• Waivers: signed liability waiver, signature, date, IP at time of signing.
• Health & emergency contact: only what you choose to add (e.g. medical notes, emergency contact). Used by coaches in an incident. Health information is special-category data under UK GDPR. You or a parent/guardian provide it only if you choose to, and we use it solely to keep you safe during sessions.
• Device data: push notification token, app version, crash logs (via Sentry, anonymised where possible).

• To take bookings, send confirmations, and run classes.
• To send you booking, cancellation, and important update push notifications. You can disable these at any time in iOS Settings.
• To process payments and apply membership pricing.
• To meet our safeguarding and insurance obligations.
• To debug crashes and improve app reliability.

We do not sell your data. We do not run advertising trackers. We do not share your data with third parties for marketing.

• NovaCity coaches and reception staff: see attendee lists, waiver status, and emergency notes for sessions they're running.
• Our hosting & infrastructure: Vercel (app hosting, London), Supabase (database, EU/Ireland region), Apple (push notification delivery), Resend (sends our booking and account emails), Sentry (crash diagnostics).
• Payment processors: Stripe processes in-app card payments. Payments taken in person at reception are handled by our card providers, Square and Zettle (PayPal). In every case your card details go directly to the payment company from your device or the reception card terminal; we never see or store your card number, and we receive only a transaction reference and status.

CCTV at the centres: our buildings are covered by CCTV for safety and security. Footage is held on a short rolling retention and is separate from this app.

Photography at events: we sometimes photograph or film sessions. We will tell you in advance and you can opt out on the day.

• Account & booking history: while your account is active.
• Financial and payment records: 6 years, as required by UK tax law (HMRC record-keeping).
• Signed waivers and health declarations: retained as proof of liability acknowledgement for as long as that protection is needed. If you delete your account, your waiver signature is scheduled for removal by our deletion clean-up process once it is no longer needed.
• Push tokens & device logs: up to 90 days after last use.

When you delete your account we anonymise your account details straight away. Residual records such as your waiver signature, the IP recorded at signing, and the waiver PDF are then scheduled for removal by our deletion clean-up process once they are no longer legally required. We keep only the minimum the law requires (mainly waiver and financial records).

Under UK GDPR you can ask us to access, correct, delete, or export your data. You can delete your account directly in the app under You → Delete account. For anything else, email novacitycentre@gmail.com. You also have the right to complain to the UK ICO (ico.org.uk).

Children's accounts are only created and managed by a parent or guardian through their own account. Children do not sign in themselves. Notifications about a child's bookings are sent to the parent's device only.

The app uses two cookies. A secure sign-in cookie keeps you logged in; it stays valid for up to 7 days and cannot be read by scripts in your browser. A venue preference cookie remembers which centre you last viewed; it lasts up to 12 months. Neither holds advertising or tracking information. We do not use analytics or advertising cookies, tracking pixels, or any third-party tracking tools.

We'll update this page when things change and revise the date at the top. Significant changes will also be highlighted in the app.