Privacy Policy

Last updated: 11 May 2026

This Privacy Policy explains how Switch-Kick Mafia (“we”, “us”) collects, uses, and protects your personal data when you use the Switch-Kick Mafia mobile booking app (the “App”). We are the data controller for personal data processed through the App.

1. Data we collect

When you create an account and use the App we collect:

Account details — email address, full name, phone number, password (stored hashed), role (student / teacher / admin).
Booking and attendance — classes and 1-to-1 sessions you book, attend, cancel, or waitlist for.
Payment information — payment is processed by Stripe. We receive and store a Stripe customer reference, the last four digits of any saved card, the membership tier you hold, and records of charges, refunds, and subscription status. We do not see or store full card numbers.
Push notification tokens — only if you grant notification permission. Used to deliver booking and class reminders.
Device and diagnostic data — basic crash and error logs to keep the App working. These do not include the content of your sessions.

2. How we use your data

To create your account and let you sign in.
To take bookings, manage waitlists, and run memberships.
To take and refund payments via Stripe.
To send booking confirmations and class reminders.
To meet our legal and accounting obligations (e.g. HMRC record retention).

The lawful bases under UK GDPR are: performance of a contract with you (taking bookings and payments), our legitimate interests (running and securing the App), and legal obligation (tax records).

Stripe — for payment processing. See Stripe’s Privacy Policy.
Supabase — our database and authentication provider (hosted in the EU).
Apple and Google — for push notification delivery, if you opt in.

We do not sell your personal data, and we do not share it with advertising networks.

4. International transfers

Supabase hosts your data in the European Union. Stripe may process payment data in the United States under Standard Contractual Clauses.

5. How long we keep your data

Account profile (name, phone, push token) — until you delete your account, after which it is anonymised.
Payment and booking records — retained for at least 6 years after the end of the relevant tax year, as required by HMRC, even after account deletion. These records are de-linked from your personal details on deletion.

6. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Ask us to correct inaccurate data.
Ask us to delete your data (subject to our retention obligations above — see also “Deleting your account” below).
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent at any time where processing relies on consent.

You can also lodge a complaint with the UK Information Commissioner’s Office (ICO) — ico.org.uk.

7. Deleting your account

You can delete your account from inside the App at Settings → Account → Delete Account.

When you delete your account we:

Cancel any active membership subscription immediately.
Release your future class bookings and 1-to-1 slots.
Remove your name, phone number, and push notification token from our records.
Permanently disable sign-in for your email address.

We retain anonymised booking and payment records as described in section 5.

8. Security

Account passwords are hashed and never stored in plain text. Payment card details are stored only by Stripe, never by us. Transport between the App and our servers is encrypted with TLS.

9. Changes to this policy

If we make material changes we will update the “Last updated” date and, where appropriate, notify you in the App.

10. Contact

For privacy questions or to exercise your rights, email support@switchkickmafia.com.