Privacy Policy

What we collect

• Account: your email, password (stored only as a secure hash), name, language and, if you add it, your phone number.
• Profile: your username and, if you upload one, a profile photo. Other Sivrce members can see your name, username and photo, for example when they search for friends. Photos are kept in public file storage, so anyone with the link can open them.
• Friends: the people you add as friends and the invitations you send. Your friends can see which classes you've booked, so you can go together.
• Reviews: the star rating and text you leave for a class. Reviews appear publicly on the studio's page with your name.
• Activity: the studios you save and the classes you book, cancel, join the waitlist for or attend.
• Wallet: your credit balance, plan, subscription status and transaction history.
• Payments: Bank of Georgia handles your card on its own payment page. We never see or store card numbers; we keep only the order number, amount and result.
• Location (only if you allow it): your approximate location, used on your device to show nearby studios. It is never sent to our servers.
• Calendar (only if you allow it): write-only access, used only to add a booking to your calendar when you ask. We can't read your calendar.
• Notifications (only if you allow it): your device's Apple push token, used to send booking reminders and account notices.
• Reports and blocks: the reviews and users you report or block, and the reason you give, so we can act on reports.

How we use it

• To run the service: accounts, bookings, cancellations, waitlists, credits, payments and subscription renewals.
• To keep you informed: booking reminders, receipts, payment problems and changes to your classes.
• To keep Sivrce safe: preventing fraud and abuse, reviewing reports and enforcing our Terms.
• We don't sell your data, show you ads, track you across other apps or websites, or use third-party analytics.

Legal basis

We process your data under Georgia's Law on Personal Data Protection, on these grounds:

• Contract: to provide the service you signed up for (account, bookings, payments).
• Legal obligation: to keep payment and accounting records as Georgian tax law requires.
• Consent: for notifications, location, calendar access and your profile photo. You can withdraw consent at any time.
• Legitimate interest: to secure the service and prevent fraud and abuse.

Who we share data with

We share data only with the partners and providers we need to run Sivrce, and only for that purpose:

• Partner studios: when you book, the studio sees your name and email (and phone, if you added one) so it knows who's coming. Studios can't see your wallet, payments or friends.
• Supabase: our database, sign-in and file storage, hosted in the EU (Paris, France).
• Bank of Georgia: processes card payments and subscription renewals.
• Resend: sends our emails, such as receipts and password resets (EU region).
• Apple: delivers push notifications and powers address search on the map.
• Vercel: hosts sivrce.space and the studio dashboard.

We may also disclose data when Georgian law requires it, for example to a court or a regulator.

Where your data is stored

Our database is in the European Union (France), which is recognised as providing an adequate level of data protection. Some of the providers above may process data in other countries; when they do, they're bound by appropriate safeguards.

How long we keep it

We keep your data while your account is open. When you delete your account (Profile → Delete account), your profile, photo, bookings, reviews, friends and notification settings are deleted straight away. Payment records are kept for 5 years, as Georgian tax law requires, in anonymised form that is no longer linked to you.

Your rights

You have the right to:

• Access: get a copy of the data we hold about you.
• Correction: fix inaccurate data. You can edit most of it yourself in the app.
• Deletion: delete your account in the app at any time, or ask us to do it.
• Restriction: ask us to limit how we use your data.
• Portability: receive your data in a machine-readable format.
• Withdraw consent or object: turn off notifications, location or calendar access in iOS Settings at any time; the app keeps working.
• Complaint: complain to Georgia's Personal Data Protection Service (personaldata.ge).

To use any of these rights, email hello@sivrce.space. We reply within 10 working days.

Security

All connections are encrypted (TLS), and data is encrypted at rest. Access rules on every table let you reach only your own data, and studio bank details are encrypted separately. No system is perfectly secure; if a breach affects you, we'll tell you and the regulator as the law requires.

Changes

If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.

Contact

Questions or requests: hello@sivrce.space. Data controller: Sivrce, Tbilisi, Georgia.