Privacy Policy

1.Who We Are & Scope

ProDB Studio ("ProDB," "we," "us," "our") is a management platform for dance schools, martial-arts gyms, and similar studios ("Studios"). Each Studio operates its own workspace on its own subdomain, where its staff manage students, classes, enrollments, attendance, and billing, and where parents and students access a family portal.

This Privacy Policy explains how we collect, use, share, and protect personal data when you:

• visit our marketing website;
• use ProDB Studio as a Studio owner, administrator, or teacher ("Staff");
• use the family portal as a parent, guardian, or student ("Portal Users"); or
• submit a public enrollment form for a Studio.

We serve Studios and users in multiple countries — including the Philippines, the United States, and The Bahamas — so this Policy is written to a global standard modeled on the EU General Data Protection Regulation ("GDPR"), which meets or exceeds the requirements of most privacy laws that apply to our users. Region-specific supplements appear in Sections 13–16.

2.Our Two Roles: Controller & Processor

Understanding who is responsible for your data depends on which of two roles we are playing:

3.Personal Data We Collect

a. Staff account data (we are the controller)

• Identity & contact: first and last name, email address, role (admin/teacher), and for teachers an optional bio and specializations.
• Authentication & security: one-time login codes (stored only as cryptographic hashes), session records, and — if you enable two-factor authentication — a TOTP authenticator secret. We never collect or store passwords; the platform has none.

b. Student & family records (the Studio is the controller)

• Student profiles: name, date of birth, gender, contact details, address, and any notes Studio staff record.
• Parent/guardian profiles: name, contact details, address, and relationship to each student.
• Activity records: class enrollments, attendance history, and announcements delivered.
• Billing records: invoices, amounts, due dates, payment status, and payment-proof images uploaded by families or staff (for example, a photo of a bank-transfer or GCash receipt). We do not process card payments and never collect card numbers.
• Enrollment form submissions: the information above when submitted through a Studio's public enrollment page.

c. Technical data (we are the controller)

• Usage & log data: IP address, browser type, requested pages, timestamps, and error logs, collected automatically to operate and secure the service.
• Approximate region: derived from your Studio's configured country for formatting, currency, and payment-method display — not from tracking.

We do not collect biometric data, precise geolocation, government identifiers, or health information, and we ask Studios not to enter such data into free-text fields.

4.How We Use Personal Data

What we do not do: we do not sell personal data; we do not share it for cross-context behavioral advertising; we do not use student or family data for marketing; and we do not use personal data to train artificial-intelligence models.

5.Legal Bases for Processing

Where a law (such as the GDPR or the Philippine Data Privacy Act) requires a legal basis, we rely on:

• Contract — processing needed to provide the service you or your Studio signed up for (most processing falls here);
• Legitimate interests — securing the platform, preventing abuse, and improving reliability, balanced against your rights;
• Legal obligation — retention and disclosure required by applicable law; and
• Consent — where a Studio collects data on the basis of consent (for example, a parent submitting an enrollment form), the Studio is responsible for obtaining it; we process on the Studio's documented instructions.

6.Children's Personal Data

Studios routinely enroll minors — that is the nature of dance schools and martial-arts gyms — so children's data is processed deliberately and narrowly, never incidentally:

• Student records are created and controlled by the Studio, which is responsible for having a lawful basis (typically parental consent gathered during enrollment) before entering a child's data.
• The family portal is designed for parents and guardians. A student may only sign in with their own email when no parent account is linked to them; when a parent is linked, the student is directed to use the parent's account.
• We collect only what Studio operations need: identity, contact, enrollment, attendance, and billing. No behavioral profiling, no advertising, no selling — for anyone, and categorically not for minors.
• We do not knowingly collect personal data directly from children for our own purposes. If you believe a child's data was submitted to us outside a Studio relationship, contact us (Section 19) and we will delete it.

7.Sharing & Service Providers

We share personal data only with:

• Your Studio. Staff of the Studio you belong to can see the records that Studio holds about you, according to their role. Data is never visible to other Studios — every Studio's data is isolated at the database level (Section 10).
• Service providers (subprocessors) that host and operate parts of the platform on our behalf, bound by contracts limiting them to our instructions:

  Provider	Purpose
  Cloud hosting provider	Application and database hosting
  Mailgun (Sinch)	Transactional email delivery (login codes, invoices, notices)
  Cloudflare R2	Storage of uploaded payment-proof images

  The current list of subprocessors is available on request (Section 19).
• Legal and safety recipients — when required by law, subpoena, or court order, or when necessary to protect the rights, safety, or property of our users, the public, or ProDB. Where lawful, we will notify the affected Studio before disclosing its data.
• Business transfers — if ProDB is involved in a merger, acquisition, or asset sale, personal data may transfer as part of that transaction under this Policy's protections, with notice to affected Studios.

We do not sell personal data or share it with data brokers or advertising networks.

8.International Data Transfers

ProDB Studio serves Studios in multiple countries, so personal data may be stored and processed in a country other than the one where you live — including countries whose privacy laws differ from your own. Wherever data is processed, it remains protected by this Policy and by contractual safeguards with our service providers.

Where a transfer requires a specific legal mechanism (for example, transfers of EEA/UK personal data), we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

9.Data Retention

• Studio-controlled records (students, parents, enrollments, attendance, invoices, proofs) are retained as long as the Studio's account is active and as directed by the Studio. When a Studio's contract ends, we delete or return its data within 90 days, except where law requires longer retention.
• Staff and Portal account data is retained while the account exists and deleted or anonymized within 90 days of account removal.
• Authentication artifacts are short-lived by design: one-time login codes expire after 10 minutes; inactive sessions expire after 14 days; revoked sessions are unusable immediately.
• Logs and backups are kept on rolling schedules (typically 30–90 days) and then deleted or overwritten. Financial records may be kept longer where tax or accounting law requires.

10.How We Protect Your Data

Security is built into the platform's architecture, not bolted on:

• Tenant isolation at the database layer. Every Studio's rows are segregated using PostgreSQL Row-Level Security, enforced by the database itself on every query — one Studio can never read another's data.
• No passwords to steal. Sign-in uses one-time emailed codes. Codes and session tokens are stored only as SHA-256 hashes, so a database leak does not yield usable credentials.
• Brute-force resistance. Login codes expire in 10 minutes, die after 5 wrong guesses, and are rate-limited per address; comparisons are constant-time.
• Two-factor authentication. Authenticator-app (TOTP) MFA is built in — always on offer for platform administrators, and available to Studio staff when their Studio enables it.
• Revocable sessions. Staff sessions can be revoked server-side immediately — signing out or removing a staff member cuts access at once.
• Encryption in transit. All traffic is served over TLS (HTTPS).
• Least-privilege operations. The application's database role is non-privileged, and role-based access controls restrict what each staff role can see and do.

No system is perfectly secure, but we design so that a single failure does not expose your data, and we notify affected parties of breaches as described in Section 17.

11.Cookies & Local Storage

We keep this simple: we do not use advertising or analytics tracking cookies.

• The application stores your session token in your browser's local storage so you stay signed in. It exists only to authenticate you and is cleared when you sign out.
• Strictly necessary technical storage may be used for security and load-balancing purposes.

Because we use no non-essential cookies, there is no cookie-consent banner to manage.

12.Your Privacy Rights

Regardless of where you live, we extend these baseline rights to all users:

• Access — obtain a copy of the personal data we hold about you;
• Correction — have inaccurate or incomplete data fixed;
• Deletion — have your data erased, subject to legal retention duties;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Objection & restriction — object to, or ask us to limit, certain processing;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• No discrimination — we will never degrade your service for exercising a privacy right.

How to exercise them: contact us using Section 19. If your request concerns records held by your Studio (student, parent, enrollment, attendance, or billing records), we will refer it to the Studio and assist them in responding — the Studio, as controller, makes the final decision on those records. We respond to requests within 30 days, extendable where the law allows for complex requests. We may need to verify your identity before acting; for children's records we verify parental or guardian authority.

You also have the right to complain to your local data-protection authority (see the regional supplements below).

13.Philippines Supplement (Data Privacy Act of 2012)

For data subjects in the Philippines, we process personal data in accordance with Republic Act No. 10173 (the Data Privacy Act of 2012), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

• Under the DPA, ProDB acts as a Personal Information Controller for Staff and account data, and as a Personal Information Processor for Studio-controlled records; Studios are the Personal Information Controllers of their students' and families' records.
• You have the rights granted by the DPA: to be informed; to object; to access; to rectification; to erasure or blocking; to damages; and to data portability, exercisable as described in Section 12.
• Where required, personal data breaches are notified to the NPC and affected data subjects within 72 hours of knowledge of the breach (Section 17).
• You may lodge complaints with the National Privacy Commission (privacy.gov.ph).

14.United States Supplement

For residents of US states with comprehensive privacy laws (including the California Consumer Privacy Act as amended by the CPRA, and similar laws in other states):

• We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We use no third-party advertising or analytics trackers, so there is no "Do Not Sell or Share" choice you need to make — the answer is already no. We honor Global Privacy Control signals to the extent they apply.
• The categories of personal information we collect, the purposes, and the recipients are described in Sections 3, 4, and 7. We collect no "sensitive personal information" categories beyond what is listed there, and we do not use personal information for profiling with legal or similarly significant effects.
• You may exercise the rights to know, access, correct, delete, and port your data, without discrimination, via Section 19. Authorized agents may submit requests on your behalf with proof of authority.
• When we act as a service provider to a Studio, we process its records only for the business purposes in our agreement with that Studio and not for our own commercial purposes.

15.The Bahamas Supplement

For data subjects in The Bahamas, we process personal data consistently with the Data Protection (Privacy of Personal Information) Act, 2003 and the oversight of the Office of the Data Protection Commissioner.

• Personal data is obtained fairly, held for the lawful purposes described in this Policy, kept accurate and no longer than necessary, and protected with appropriate security measures (Section 10).
• You may exercise your rights of access and correction as described in Section 12, and may direct complaints to the Office of the Data Protection Commissioner of The Bahamas.

16.EEA & UK Supplement

Although our primary markets are the Philippines, the United States, and The Bahamas, this Policy is modeled on the GDPR, and if we process personal data of individuals in the European Economic Area or the United Kingdom:

• the legal bases in Section 5 apply as written;
• international transfers are protected as described in Section 8;
• you may exercise all rights in Section 12, and may complain to your national supervisory authority or the UK Information Commissioner's Office.

17.Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights or a real risk of serious harm, we will:

• notify affected Studios without undue delay so they can meet their own controller obligations;
• notify regulators where required — including the Philippine NPC within 72 hours where the DPA's criteria are met — and affected individuals where the law requires direct notice; and
• describe what happened, the data involved, the measures taken, and the steps you can take to protect yourself.

18.Changes to This Policy

We may update this Policy as the service and the law evolve. The "Last updated" date at the top always reflects the current version. For material changes, we will give Studios advance notice by email or in-app notice before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the updated Policy.

19.How to Contact Us

For privacy questions, rights requests, or complaints:

• Email: privacy@prodb.app

If you are a parent or student, you may also contact your Studio directly — its staff can view, correct, or delete your family's records from within the platform.

We will acknowledge your message promptly and respond in full within 30 days.