Privacy Policy

Effective 25 October 2026 · Last updated 25 October 2026

This policy explains what personal data the Bombay Drum School mobile app (shown as "Bombay Drum School" or "BDS" on the App Store and Google Play, the "App") collects, why, who receives it, how long it is kept, and what rights you have. It also covers this website. It does not cover the school's main website, classes or payments, which have their own terms.

1. Who we are

The App is run by Bombay Drum School ("we", "us"), Shop No. 24, Gayatri Satsung, Thakur Village, Kandivali East, Mumbai 400101, Maharashtra, India. For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for the personal data described here.

Privacy questions, requests and complaints: bombaydrumschool@gmail.com, phone +91 90043 94628. This contact also acts as our grievance officer (section 12).

2. Who can use the App

The App is for students and staff of Bombay Drum School and its partner studios. You cannot create an account yourself. School staff create accounts for enrolled students. Accounts for students under 18 are created only after a parent or lawful guardian has given consent (section 9).

3. Personal data we collect

3.1 Data the school gives us when it creates your account

• Your full name and a short name (first name and surname initial).
• Your Indian mobile number.
• Your role (student, admin or superadmin), the studios you can use or manage, and whether your account is active.

3.2 Data created when you use the App

• Bookings: slots you hold, book or cancel, whether a slot is solo or shared, your practice hours and daily and weekly totals, and any no-show marks staff record.
• Booking screen activity: which studio and date you have open on the Book screen. We use this to tell you when a slot opens up there.
• Sign-in data: when you sign in and which sign-in codes were requested for your number. Codes are stored only as a keyed hash, never in readable form. To stop abuse, we briefly count code requests per mobile number and per IP address.
• Activity log: a record of sign-ins, bookings, cancellations, no-show marks, and account and studio changes made by staff. Each entry records who did it (name and role), what changed (which can include a name or mobile number), and when.
• Profile changes: if you change your display name in the App.

3.3 Device data

• Push notification token: if you allow notifications, an Expo push token for your device, which lets us send alerts such as a cancelled booking or a freed slot.
• Session reminders are scheduled on your device by the App, using your bookings. They do not need any extra data sent to us.
• Settings saved on your device: your theme, last-used studio, whether you've seen the notification prompt, sign-in code timers, and IDs that stop a request being applied twice. These stay on your device and are removed when you uninstall the App.
• Technical data: device manufacturer and model, operating system and version, screen size, app version, language, time zone and IP address, sent with requests to our servers and service providers. Expo also receives an installation ID, runtime details and, if the App crashed, the last error message, so it can deliver App updates and push notifications.

3.4 Analytics, crash reports and session recordings

We use PostHog to see how the App is used and to find and fix bugs. PostHog assigns a random installation and session ID, including before you sign in. After you sign in, it also receives your account ID, name and role. It receives:

• the screens you open and the details in their addresses (for example, the studio or date being shown), and when the App is opened, closed or updated;
• crash and error reports, including technical details of the error;
• session recordings: a replay of the screens you see, built from screenshots, with where you tap and the App's technical logs. Text you type, including your mobile number and sign-in code, is hidden, and phone numbers and some lists of names are hidden too. Other content, including images and, on some devices, names shown on screen, may be visible. On iPhone and iPad, recordings also include the address, method, status, duration and size of the App's network requests;
• approximate location (city or country), which PostHog estimates from your IP address.

The contents of network requests and responses are not recorded. We don't use this data for advertising or to build profiles for marketing.

3.5 If you contact us

If you email, call, WhatsApp or SMS us, we receive your contact details, your message and anything you attach. We use them to answer you and keep them for as long as needed to deal with your request. Email goes through Google (Gmail) and WhatsApp messages through Meta.

3.6 What we don't collect

The App doesn't access your precise location, contacts, photo library, camera or microphone. It doesn't ask for an email address, password or payment details. We don't use advertising IDs, show ads, sell personal data, or share it for advertising.

4. Why we use your data

We process your personal data on the basis of your consent, which you give by signing in after being shown this policy, or, for a child, the consent of a parent or guardian. Where the DPDP Act allows, we also process it for "legitimate uses", such as complying with law. You can withdraw consent at any time (section 8). If you do, we will stop processing your data and close your account, because the App cannot work without it. Withdrawing consent does not affect processing that happened before.

5. Who can see your data

5.1 Other people using the App

• Other students see your short name (for example "Aditi S.") on slots you have booked. They can see that a slot is being held, but not who is holding it.
• Staff (admins of the studios you use, and superadmins) can see your full name, mobile number, bookings, practice hours, no-show marks and activity log entries.

5.2 Service providers

These companies process data for us under their terms. They may only use it to provide their service to us.

Apple and Google also collect data under their own policies when you download or update the App from their stores.

5.3 Other disclosures

We may disclose personal data if the law requires it, to respond to a valid request from a court or government authority, or to protect the safety, rights or property of our students, staff or the public. If the school or the App is sold or reorganised, personal data may pass to the new operator, who must keep to this policy or tell you about changes first.

6. International transfers

Some of our providers store or process data outside India, including in the USA and Japan. We only use providers that commit to protecting it. We will follow any restrictions the Government of India places on transfers to particular countries.

7. How long we keep data

If the law requires us to keep something longer, we will keep it only for that purpose.

8. Your rights

We give you the following rights now, as school policy. Your rights under the DPDP Act apply in full as its provisions come into force. You can:

• access a summary of the personal data we hold about you, how we use it, and who we have shared it with;
• correct or update inaccurate or incomplete data. You can change your display name in the App. For anything else, ask the school;
• erase your data and close your account (section 8.3);
• withdraw consent at any time, as easily as you gave it;
• nominate someone to exercise these rights for you if you die or become incapacitated;
• complain to us (section 12) and, if you are not satisfied, to the Data Protection Board of India.

To use any of these rights, email bombaydrumschool@gmail.com from the contact details the school has on file, or ask at the front desk. We may need to confirm your identity first, for example by asking you to reply from your registered number. We will respond within 30 days, and in any case within the period the law sets.

8.3 Deleting your account

You can ask us to delete your account at any time, without visiting the school. See how to delete your account. When we delete it:

• your future bookings and holds are cancelled and the slots are released;
• your name and mobile number are removed from your account record, and your short name on past bookings is replaced with "Deleted user";
• your push token, booking screen activity and pending sign-in codes are deleted;
• the account is blocked from our servers at once, so it can no longer sign in or make requests. Devices still signed in are signed out the next time they contact us;
• shortly afterwards, a background task removes your mobile number from our sign-in provider (Firebase Authentication) and disables the account there. That disabled record, including your name, is kept;
• we ask PostHog to delete analytics and recordings linked to your account.

We keep past booking and attendance records, the record of how your account was created, and activity log entries, as described in section 7, because the school needs them for its records. These can still show your name, and some show your mobile number, as they were when the entry was made. Data in backups is overwritten within 30 days.

9. Children

Many of our students are under 18. Under the DPDP Act, a person under 18 is a child, and we process a child's data only with the verifiable consent of a parent or lawful guardian. The school collects this consent at enrolment or before creating the account, and checks the identity of the adult giving it. A parent or guardian can use any of the rights in section 8 for their child, including asking us to delete the account.

We don't use children's data for advertising or targeted advertising, or to profile children, and we don't process it in ways likely to harm a child's well-being. Analytics and recordings (section 3.4) are used only to fix bugs and improve the App. If we learn that we hold a child's data without proper consent, we will delete it or obtain consent promptly.

10. Security

We protect data with encryption in transit (HTTPS), access controls that let staff see only what their role allows, sign-in codes stored only as keyed hashes, rate limits on sign-in, and a tamper-resistant activity log. No system is completely secure. If a personal data breach happens, we will tell affected people and the relevant authorities within the deadlines the law sets. We may keep security logs separately from other data where the law requires it.

11. Changes to this policy

We may update this policy when the App or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you in the App or by SMS before it takes effect and, where needed, ask for your consent again.

12. Contact and grievances

Bombay Drum School, Shop No. 24, Gayatri Satsung, Thakur Village, Kandivali East, Mumbai 400101, India.
Email: bombaydrumschool@gmail.com · Phone: +91 90043 94628

Send complaints about how we handle your data to the address above with the subject "Privacy grievance". We will acknowledge them and try to resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India once you have used our grievance process.