Privacy Policy

Last updated 4 November 2026

Who we are

Shaolyn Skateboards is a trading name of Shaolin Skateboards Limited, a private limited company registered in England and Wales under company number 11708722. We are the data controller for the personal data described here.

This policy covers everything we run under shaolynskateboards.com — the brand site, the web shop, the app download page — and the Shaolyn mobile app, which is used to book skateboard lessons with independent teachers.

Questions, requests or complaints: info@shaolynskateboards.com.

What we collect, and why

Your account

When you create an account we store your email address, the display name you choose, when you accepted our terms, and whether your email address is confirmed. If you set one, we store a short bio and a profile photo. If you sign up with a password, we store only a one-way hash of it — never the password itself. If you ask to reset it, we email you a six-digit code and a one-time link from hello@shaolynskateboards.com and keep only one-way hashes of them, with when they were sent and how many wrong guesses were made; the code stops working after 15 minutes and the link after 24 hours, both stop once your password has been reset, and the record is deleted after two days. To slow down password guessing we count failed sign-ins for each email address, and separately for each device that has signed in to the account before, in the server's memory only, for 15 minutes. Any photo you upload has its location and other hidden details removed before we store it.

The devices you sign in on. Each time you sign in, we give the app a random token for that phone or browser, so that someone typing wrong passwords for your email address elsewhere can't lock you out of a device you already use. The app keeps the token, with the email address it is for, for the last five accounts signed in on that device: in the phone's secure storage (the Keychain on iOS, the Keystore on Android) or, in a web browser, in its local storage. It stays when you sign out, so the device is still recognised next time, and is removed when you delete your account from it. We keep only a one-way hash of each token, with when it was first and last used, for at most ten devices per account. A device unused for 400 days is forgotten, and so is every other device when your password is reset or changed or you sign out everywhere, and all of them when you delete your account. The token can't sign anyone in by itself.

If you sign in with Google, Google tells us your Google account identifier, your email address, your name and your profile photo URL. We ask Google for nothing else: not your contacts, not your calendar, not your Drive, not your other Google data. We store the identifier so we recognise you next time, the email and name to create your account, and the photo URL so your profile has a picture. If an account with that email already exists, we link the two rather than create a second one; if that account's email address had never been confirmed, we also remove its password and sign it out of every device, so whoever set it up can't keep using it, and email the address to say so. We never receive or store your Google password.

If you sign in with Apple, Apple tells us an identifier for you and, the first time, the name and email address you choose to share, which may be a private relay address that forwards to you. We store the identifier so we recognise you next time, and the email and name to create your account. Linking to an existing account works as for Google. We never receive your Apple ID password.

If you add a spot or a photo of one to the skate map, the photo is public to everyone using the app, shown with your display name, once the spot is on the map. Until then only you, our approved teachers (who vote on new spots) and our admins can see it, through links that stop working after about an hour. If the spot is turned down, its photos are deleted 30 days later, and a photo still waiting after 90 days is deleted then. You or an admin can remove it at any time.

If we suspend an account we record when, by whom and why.

Lawful basis: performance of our contract with you.

Booking and paying for lessons

When you book we store the lesson time, duration, price, the meetup spot, any note you add, whether the lesson is for someone under 18 (a yes or no that the teacher sees; we hold nothing about the child), and the resulting booking status.

Payments are processed by Stripe. Your card details go directly to Stripe and never reach our servers. We hold a Stripe customer identifier so your payment can be matched to your booking, and Stripe tells us whether a payment succeeded, failed or was refunded. Teachers are paid through Stripe Connect; we retain a percentage of each lesson as a platform fee, stated in the app before you pay.

Lawful basis: performance of our contract; legal obligation for tax and accounting records.

Location

This is the most sensitive data the app handles, so it is worth being exact.

• Finding teachers. Before you grant location access we estimate your city from your IP address, which we send to ipwho.is for that and whose answer we keep for 24 hours, so the map is not pointing at nowhere. If you grant location access, your device position is used to centre the map and sort teachers by distance.
• Arriving at a lesson. Around the time of a confirmed lesson — and only then — the app shares your position with our server so that you and the other party are marked as arrived automatically once you are within 150 metres of the agreed spot. There is no manual check-in button. This is how we can tell whether a lesson happened, and it is what lets us refund you automatically if a teacher never turns up.
• What is stored. Each position we receive during that window is stored with its accuracy, the distance to the meetup spot and the time. Our administrators can view this trail when investigating a disputed lesson or a refund. The positions are deleted 180 days after the lesson ends, which leaves time to answer a card dispute; when each of you arrived stays with the booking.
• Live on the map. This is off by default. If you turn it on, you choose who can see you — nobody, teachers only, or everyone who is signed in — and whether they see your exact position or an approximate one. An approximate position is rounded to roughly 500 metres before it is stored on our server, so your exact position is never kept. Your position is only sent while the app is open on your screen, never in the background. Each position replaces the last, and it disappears about two minutes after the app stops sending. We keep no history of it.
• Apart from a lesson window, or while you have live sharing turned on, we do not collect your location. You can withdraw location permission at any time in your device settings; the automatic arrival check and live sharing will then no longer work for you.

Lawful basis: performance of our contract, and our legitimate interest in resolving disputes fairly.

Messages

Students and teachers can message each other about a booking. We store those messages so both parties can read them, and so we can investigate a complaint. They remain available for a period after the lesson and are deleted with the booking.

Teachers can also message other teachers directly, for example to meet up for a skate. Those messages are stored so both teachers can read them, and are deleted when either account is deleted.

Reports and blocks

If you report someone we store the report: who made it, who it is about, the reason, anything you add and, if you report from a chat, a copy of the last ten messages of that chat from both sides. Only Shaolyn staff see it, and the person reported is not told who reported them. Reports are kept after they are dealt with, and after either account is deleted, as the record of what we were told and what we did. If you block someone we store that you did; they are not told, and the block is deleted if either account is.

Lawful basis: our legitimate interest in keeping people safe on Shaolyn and dealing fairly with complaints.

Applying to teach

If you apply to teach we additionally collect your legal name, date of birth, skating experience, teaching biography, the area you cover, your meetup spots, your availability and your hourly rate.

Identity is verified by Stripe Identity. Your ID document and selfie are submitted to Stripe and are never stored on our servers. Stripe returns only the outcome: whether it passed, the verified name, whether you are over 18, and the document's country. If Stripe returns no date of birth, an administrator reads it from the document in Stripe and confirms your age, and we record who did and when. We ask Stripe to delete the document and selfie from each attempt a set period after it ends, earlier attempts included. An attempt you don't finish is closed, and what it collected wiped, when you start another or after 24 hours, and every attempt is wiped at once if you delete your account. Administrators reviewing your application see the outcome and your application details, not your documents.

Lawful basis: performance of our contract; legal obligation and substantial public interest in verifying the identity of adults teaching a physical activity.

The shop

For an order we store your email address, what you ordered, the shipping address you give and the order status. Payment is again handled by Stripe.

Gift cards

When you buy a gift card we store your name and email address, the recipient's name and, if you give it, their email address and your message to them, the amount, when it should be sent, and the card's status. We use the recipient's details only to deliver the card. The code itself is kept encrypted and is never shown to our staff. When a card is redeemed we record which account redeemed it and keep a ledger of the credit that account spends. Payment is handled by Stripe; we also keep the address a purchase came from for a day, to limit card fraud.

Lawful basis: performance of our contract with the buyer, and our legitimate interest in delivering the gift and preventing fraud.

Schools

If you enquire about sessions at a school we store the school's name, type and address, your name, role, email address and phone number, and what you asked for. If the school books a block we also keep the dates, the price, the invoice and its payment status, and a purchase order number if the school gives one. These are business contact details. An enquiry is deleted two years after the last block that came of it ended or was last changed (or, if none did, two years after the enquiry was last dealt with), and never while a block is still running or its invoice unpaid, or while an introduction it answers is still open. Each block's own copy of the contact's name, email address and phone number, and its notes for the teacher, go on the same two years. The school's name and address, the billing email address, the purchase order number, the prices and the invoice are kept for accounting as described below. The IP address an enquiry was sent from is kept for 30 days, to deal with spam, and then deleted. Payment of a school's invoice is handled by Stripe.

We hold no information about pupils. The teacher records how many pupils attended each session and may add a short note for the school's report; neither names any child.

If you teach under-18s or in schools we additionally hold the facts of your criminal records check, and when you agreed to our checking it: the scheme (DBS, PVG or AccessNI), the certificate or membership number, its issue date, the surname printed on it, your date of birth and, for DBS, whether it is on the Update Service, which lets us check its status online. When we verify it we record how (we saw the original or, for a check we applied for, the clear result came to us), its level and the workforce it is for, whether it shows any information (and if it does, our decision and the reasons for it, never the details), the date of each Update Service status check, and the date it covers you until. We never hold a copy of the certificate. A school you are sent to is told in writing your legal name, that your identity is verified and that you are over 18, the scheme and level, the last four digits of the number, its issue date, when we verified it and last checked its status, and the date of your safeguarding training if you gave it; if the certificate shows information, the school is offered a look at it, arranged with you. During a school session your location is handled exactly as for a lesson, above.

A check that stops counting (replaced by a newer one, run out, not verified, or removed by you) is cut down six months later to the last four digits of its number and our decision; one you remove is cut down at once. One we still haven't reviewed a year after you entered or last changed it is deleted, and we tell you. Everything about your checks is deleted when you delete your account.

If you ask us to apply for your check, we give your name and email address to the checks provider we use (an umbrella body registered with DBS or AccessNI, or Disclosure Scotland for PVG) so it can invite you to fill in the application, which it and the checking body then handle under their own privacy notices. One of our team checks your identity documents for the application, in person or through a certified digital identity service; we record how and when, never copies of the documents. When the result comes back we record what it said: clear, or that the certificate shows information (never the information itself). A check we applied for whose result was clear is verified from that result, without the original. We keep the provider's reference, our notes on the application and, unless your check was verified from it, what the result said until six months after it closes. An application nothing has happened on for six months closes by itself, and we tell you; this never happens while the checking body has it or while we have yet to review the certificate you entered, and closing it this way deletes our notes and the result at once.

Lawful basis: performance of our contract with the school and with you, and our legitimate interest in keeping children safe. A criminal records check is criminal offence data, so for the check itself we also rely on the substantial public interest in safeguarding children (Data Protection Act 2018, Schedule 1, paragraph 18), under our appropriate policy document, which we will send you on request. We ask for your agreement before checking your certificate because the DBS Update Service requires it, and before applying for one for you; removing the check stops us checking it, but we keep the record of our decision as described above.

Introductions to schools

A teacher whose check covers a school can ask us to introduce them to it. They tell us the school and how they know it, and may give us the name, role and work email address of someone there; we never accept a pupil's or a parent's details. One of our team reads every request before anything is sent. If we write to the school, the email says which teacher asked and where we got the address (from the teacher, or from the school's published contact details), and our website offers three answers: ask for sessions, say no thanks, or ask us never to contact the school again. We remember a school that asks not to be contacted by its name and postcode and a scrambled (hashed) form of the address, which is enough to recognise it without keeping the address itself.

With the request we keep the name the teacher went by when they asked, which is the one the school is told. The contact's name and address on a request, how the teacher knows the school, and the notes the teacher and our team added are deleted six months after the request closes, or at once if the teacher deletes their account, which takes the teacher's name off it too. A request nobody at Shaolyn has acted on within 30 days closes without anything being sent, the teacher is told, and those details are deleted at once. What is left of a request (the school, what was asked and how it ended) is deleted two years after it closes or the school answers, but not while a block that came of it is still running or its invoice unpaid. An enquiry the school sends us in answer is kept like any other enquiry, above.

Lawful basis: our legitimate interest, and the teacher's, in offering skateboarding sessions to schools. You can object at any time: choose "Don't contact our school again" on the page our email links to, or email schools@shaolynskateboards.com.

Notifications and technical data

If you allow notifications we store a push token for your device so we can tell you about booking requests, confirmations and reminders. Our servers keep ordinary web logs, which include IP addresses, for security and troubleshooting.

The website itself

Browsing shaolynskateboards.com requires no account and we do not try to identify you while you read it.

• No cookies, no analytics, no advertising trackers. The site sets no cookies of its own, and there is no Google Analytics, no pixel, no ad network and no third-party tracking of any kind. That is why you are not asked to dismiss a cookie banner — there is nothing to consent to.
• Your basket lives in your browser. The items you add and the shipping zone you pick are kept in your browser's local storage so the basket survives a reload. That stays on your device and is never sent to us until you check out; clearing your browser data removes it. It is cleared automatically once an order goes through.
• A graphics library is loaded from a public CDN. The rotating deck on the shop page uses three.js, fetched from jsDelivr. Your browser's request to them necessarily reveals your IP address and which page you are on. We send them nothing about you, and they set no cookies for us.
• Checkout happens on Stripe's site. Pressing Checkout hands you to Stripe Checkout on Stripe's own domain. The email address and shipping address you type there are given to Stripe, which returns them to us as an order record. Your card details are never on our site or our servers.
• Server logs. Our web server keeps ordinary access logs, including IP addresses, for security and troubleshooting.

Lawful basis: our legitimate interest in running a working, secure website and fulfilling orders.

Who we share it with

We do not sell your personal data and we do not use it for advertising. We share it only with the providers who make the service work:

• Stripe — payments, teacher payouts, identity verification and school invoices.
• Our checks provider — an umbrella body registered with DBS or AccessNI, or Disclosure Scotland, only if you ask us to apply for a background check for you.
• Google — only if you choose to sign in with Google.
• Apple — only if you choose to sign in with Apple.
• Expo — delivery of push notifications to your device.
• OpenStreetMap / Nominatim — turning a place name you type into coordinates.
• ipwho.is — the coarse city-level lookup described above.
• jsDelivr — the public CDN serving the shop page's 3D library.
• DigitalOcean — hosting of our servers and database.
• Law enforcement or regulators, where we are legally required to.

Some of these providers operate outside the UK. Where data is transferred abroad we rely on the safeguards those providers offer, such as the UK addendum to the EU Standard Contractual Clauses.

Teachers and students necessarily see some of each other's information for a booking: display name, profile photo, the messages you send, and — during the lesson window — whether the other party has arrived.

How long we keep it

Account data is kept while your account exists. Booking, payment and order records are kept for as long as we need them for accounting and tax, which in the UK is normally six years. Location trails are deleted 180 days after the lesson or school session ends, and messages with the booking they belong to. Identity documents are held by Stripe, not us, and are redacted on the schedule described above. A gift card's recipient details and message are deleted a year after it is redeemed, or two years after it was bought if it never is; the purchase record itself is kept with the other payment records. School enquiries, introductions, background checks and applications for them are kept for the periods given under Schools and Introductions to schools, above.

When you delete your account we delete your profile, photo, push tokens, blocks, any reset codes and links, and the devices you signed in on, and ask Stripe to delete your customer record and saved cards. For a teacher we also delete the name from your ID, your home area, bio, video, spots, availability, the document's country and any criminal records check, cancel any check we were applying for, and withdraw any introduction to a school you asked for, deleting the contact details and your name on it. Records we must keep for accounting stay, attached to an account that no longer says who you were.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, where we have no overriding reason to keep it;
• restrict or object to how we use it;
• send a copy to another provider.

Email info@shaolynskateboards.com and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Accounts are for adults. If a lesson is for a child, the booking must be made and attended by their parent or guardian, who says so when booking, and it can only be with a teacher who holds a criminal records check we have verified for the part of the UK the lesson is in. We do not knowingly collect data from children directly; tell us if you believe we have and we will delete it. Sessions we run in schools are booked by the school, which keeps the register and any consent; we record only how many pupils attended.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.

Company details

Shaolin Skateboards Limited, registered in England and Wales, company number 11708722. Registered office: 192 Bexley Lane, Sidcup, DA14 4JH, United Kingdom.