What personal information London Handstand Academy collects, why, who it is shared with, how long it is kept, and the rights you have over it.
Last updated 14 October 2026
The data controller is Elliott Staley, trading as London Handstand Academy, a sole trader established in England. We decide what personal information is collected and what happens to it.
Contact. info@londonhandstandacademy.com
Correspondence. Email is the fastest way to reach us. A postal address for formal correspondence is available on request to the address above.
ICO registration. London Handstand Academy is registering with the Information Commissioner's Office; the registration number will be shown here once issued.
This policy is written to the UK GDPR and the Data Protection Act 2018.
| What | Where it comes from |
|---|---|
| Name and email address | You, when you sign up or apply |
| A password, stored only as a one-way hash | You. We never see or store the password itself |
| Your answers to the level quiz and the intake questions: goal, location, training history, availability | You |
| Training activity: sessions opened and completed, hold times, ratings, test results, written feedback | Recorded as you use the app |
| Messages between you and your coach | You and us |
| Video, photos and voice notes you send your coach | You |
| A token for your phone, if you turn notifications on | Your phone |
| Injuries, pain, conditions, pregnancy and medication you tell us about | You, in the waiver and in messages |
| Payment records: what you bought, when, the outcome, and a Stripe customer reference | Stripe |
| Marketing preference | You, by ticking or not ticking the box |
We never see your card details. Payment is handled entirely by Stripe on their own pages. We hold a reference to your Stripe customer record, not a card number.
Two categories deserve to be called out plainly.
Details about injuries, pain, conditions, pregnancy or medication are special category data and get extra protection in law. We ask for them only because coaching you safely is impossible without them.
We rely on your explicit consent to hold this information, which you give when you complete the waiver and health declaration. You can withdraw that consent at any time by emailing us, though if you do, we may not be able to keep coaching you safely, and we will talk to you about that rather than simply stopping.
Video and photos of you training are personal information, and often show your home. They are used for one purpose: so your coach can watch your technique and give you feedback.
Being straight with you about one limitation. Your clips are stored at addresses that are long and effectively impossible to guess, but which are not yet individually access-controlled. Anyone who was given the exact address of a clip could open it. We are moving these to signed, expiring addresses. Until that is done, we mention it so you can judge for yourself what you are comfortable filming.
| Purpose | Lawful basis |
|---|---|
| Running your account and giving you what you paid for | Performance of a contract |
| Writing your programme and giving feedback on your footage | Performance of a contract |
| Holding health and injury information so we can coach you safely | Explicit consent (Article 9(2)(a)) |
| Taking payment and preventing fraud | Performance of a contract, and legal obligation |
| Service emails: password resets, receipts, a reply from your coach | Performance of a contract |
| Marketing emails about tips and workshop dates | Consent, which you can withdraw at any time |
| Keeping accounting records | Legal obligation |
| Understanding which drills people get stuck on, so the coaching improves | Legitimate interests: improving the service, balanced against your privacy |
| Using your footage or words publicly | Separate, specific, optional consent |
Where we rely on consent, saying no costs you nothing but the thing you said no to, and you can change your mind whenever you like.
We do not sell your information and we do not share it for anyone else's marketing. We use these providers to run the service, each of which processes data only on our instructions:
| Provider | What it handles |
|---|---|
| Netlify | Hosting the site and the app, and storing photos |
| Supabase | The database holding accounts, messages and progress |
| Apple and Google | Delivering notifications to your phone, if you turn them on: a token for your phone and the words of each notification |
| Cloudflare | Storing and delivering video, including your form checks |
| Stripe | Payments, subscriptions and card details |
| Apple | Payments for the Ladder bought in the iPhone app. Apple holds the card; we only see that the subscription is active and when it renews |
| Resend | Sending our emails, including the newsletter if you signed up for it: your email address and first name |
| Calendly | Booking the free 15 minute call, if you book it there: your name, email and the time you pick |
| Microsoft Clarity | Only if you accept cookies on the website: how pages are used, such as taps, scrolling and anonymous recordings of a visit, with anything typed into a form hidden |
| Formspree | A backup for coaching applications, used only when our own server cannot be reached |
We may also share information with an accountant, or with a professional adviser, and we will disclose it if the law requires it. If the business is ever sold or transferred, your information may pass to the new owner under this same policy.
| What | How long |
|---|---|
| Account and training records | While your account is open, then 12 months, then deleted |
| Messages with your coach | The most recent 200 messages per client; older ones drop off automatically |
| Your form-check footage and photos | 12 months from upload, then deleted, or sooner if you ask |
| Health and injury information | While you are coached, then 12 months, then deleted |
| Payment and accounting records | 6 years, as UK tax law requires |
| Marketing consent and the record of it | Until you unsubscribe, then a minimal record that you did |
Worth knowing: deletion of footage is currently done by hand rather than automatically. We are building the automatic version. Until then, if you want a clip gone before the twelve months are up, email us and we will do it. That route works today.
Our providers operate globally, so your information may be processed outside the UK, including in the United States. Where that happens, transfers are covered by the safeguards UK law requires: an adequacy decision, or the International Data Transfer Agreement or Addendum. You can ask us for details of the safeguards that apply.
No system is perfectly secure. If a breach ever put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
You have the right to: see the information we hold about you; correct it; delete it; restrict or object to what we do with it; receive it in a portable format; and withdraw consent at any time. You will never be charged for exercising a right, and it will never affect the standard of coaching you get.
Email info@londonhandstandacademy.com and we will respond within one month. We may ask you to confirm who you are first, so that nobody else can get at your records.
You can also delete your account yourself, from Your account in the app. That removes your account, your plan, your progress and your messages straight away and cancels any subscription. Payment records stay for six years, as tax law requires, and footage follows the twelve months above.
The app stores a sign-in token and your progress in your own browser so you stay signed in and see your plan straight away. That is necessary for the app to work at all.
The main website uses a cookie banner, and anything beyond the strictly necessary is set only if you agree. The one thing it controls is Microsoft Clarity, which shows us how pages are used so we can make them clearer. You can change your mind from the "Cookie settings" link in the site footer.
Separately, the website counts its own visits: how many times each page is opened and which site sent the visitor there, such as Google or Instagram. These are totals kept on our own server. No cookie is set, nothing is stored on your device, and nothing in them says who you are.
The app keeps the same kind of totals about how it is used: which screens are opened, the screen it was on when it was closed, how far through the questions and the sessions people get, and the reason picked if a session is stopped early. They are added up by day on our own server so we can see where the app is hard to use and fix it. Like the visit counts, nothing in them says who you are.
The service is for people aged 16 and over. We do not knowingly collect information about anyone younger. A participant under 18 needs a parent or guardian to agree to the terms and the waiver on their behalf. If you believe we hold information about a child, tell us and we will delete it.
If we change this policy in a way that materially affects you, we will email you before it takes effect.
If you are unhappy with how we have handled your information, please tell us first. We would rather put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.