Privacy Policy

Last updated: September 17, 2026

This Privacy Policy explains how CompSync (the “Platform,” “we,” “us”), operated by Streamstage Productions Inc., collects, uses, discloses, and safeguards personal information when dance studios, competition directors, studio directors, parents, and other users use our competition registration, scheduling, tabulation, and event-media services. By using the Platform you agree to this Policy.

1. Who this Policy covers

CompSync is a business-to-business platform for dance competition organizers (“Competition Directors”) and the dance studios (“Studio Directors”) that register with them. Studios input information about their dancers — who are often minors — and parents may access performance media. This Policy applies to all of these users. Each competition organizer is an independent operator responsible for its own relationship with its studios and participants.

2. Information we collect

We collect the following categories of personal information:

Account & profile data: name, email address, phone number, time zone, role, and authentication credentials (passwords are hashed; we never store them in plain text).
Studio data: studio name, code, contact details, and status.
Dancer data (including minors): first name, last name, and date of birth, as entered by the registering studio.
Competition data: routine entries, reservations, scheduling, scores, and results.
Billing data: invoices, amounts, and payment status. Payments are recorded by the competition organizer against the invoice — today those are payments made directly to the organizer (cheque, e-transfer, cash, wire). Where an organizer chooses to enable card payments, those are processed by Stripe and we never see or store full card numbers.
Event media: photographs and video of performances captured at events, which may include images of minors.
Judge audio: where a competition uses recorded judge critiques, the judges’ spoken commentary on a routine, and the text transcript produced from it.
Support messages: the content of emails, in-app bug reports, and assistant conversations you send us.
Technical & usage data: IP address, device/browser information, activity logs, and error diagnostics.

3. How we use information

To provide, operate, and maintain the Platform and its features.
To register routines, manage reservations, schedule events, tabulate scores, and deliver event media to authorized recipients.
To process payments and issue invoices.
To send transactional and service emails (e.g., account, invoice, and media-availability notifications).
To run the automated checks and assistance features described in Section 4.
To answer support requests.
To secure the Platform, prevent abuse, debug errors, and maintain audit trails.
To comply with legal obligations.

We do not sell personal information, and we do not use it for third-party advertising.

4. Automated processing and AI services

Several Platform features send content to third-party artificial-intelligence services for automated analysis. This section lists every one of them, and what is sent. None of this processing is used for advertising, for building profiles of individuals, or to make a decision about a person that has legal or similarly significant effects.

a. Matching photographs to routines — Google

Event photographers upload thousands of photographs per event, and photographs are sometimes filed under the wrong routine. To catch this, a competition organizer can start an automated check. The check sends event photographs, together with a single still frame taken from that routine’s performance video, to Google’s Gemini API (generativelanguage.googleapis.com). Google’s service compares them and returns a list of photographs that appear to show a different performer, a different group size, or a different setting.

Because this is photography of dance performances, the images sent include performers in costume, and include minors. The check exists to keep a child’s photographs from being delivered to another family, but it works by transmitting those photographs to Google for analysis, and we want that stated plainly rather than buried.

The result we keep is the list of suspected mismatches — a file reference and a short stated reason — for a person to review. The service is not asked to identify anyone, name anyone, or judge a performance, and no result it returns changes a score, a placement, or any other outcome for a dancer. The check runs only when a competition organizer starts it; it does not run automatically and it is not applied to every photograph. A competition organizer may ask us to disable it for their events, and we will.

b. In-app help assistant (“Sage”) — DeepSeek and Google

When you use the in-app assistant, we send the question you type, your role, and a summary of your competition’s configuration (categories, age groups, fees, deadlines) to DeepSeek so it can answer. If DeepSeek is unavailable, the same request goes to Google’s Gemini API instead. Please do not type anything into the assistant that you would not want sent to these providers.

c. Judge critique reports — DeepSeek and Google

Where a competition records judge critiques, the audio is transcribed on infrastructure we operate ourselves, and the resulting transcript — the judge’s spoken commentary about that routine — is then sent to DeepSeek (or Google’s Gemini API as a fallback) to be summarized into the written feedback that studios and families receive. The summary may only paraphrase or quote what the judge actually said.

d. Support email handling — DeepSeek

Email sent to our support address is classified and a suggested reply is drafted with DeepSeek’s assistance before a person reviews it. This means the content of a support email you send us — including any names or account details you include in it — is sent to DeepSeek. No reply is sent to you without a person approving it.

e. Internal operations summary — DeepSeek

Once a day we send DeepSeek a summary of recent Platform activity — the names and roles of directors and studio directors, competition names, error counts, and the text of any bug reports submitted — so it can return a short priority list for our operations team.

f. What happens to the content at these providers

Google. We use the paid tier of the Gemini API. Under Google’s Gemini API terms, for paid services Google does not use the prompts or files we send — including images — or the responses it returns, to improve its products, and processes them as a data processor under its data processing addendum. Google logs what we send for a limited period for the sole purpose of detecting abuse of its service and meeting legal requirements. In plain terms: the photographs described in Section 4(a) are not used to train Google’s models. See also the Google Privacy Policy.

DeepSeek. We have no separate agreement with DeepSeek beyond its standard terms, and we therefore do not control how long it retains what we send or what it does with it. Its privacy policy states that it processes and stores personal data in the People’s Republic of China; see Section 12 on international transfers. This is why Section 4(b) asks you not to type anything into the in-app assistant that you would not want sent there.

5. Legal bases (GDPR / UK GDPR)

Where the GDPR applies, we process personal data under one or more of these bases: performance of a contract (providing the service you signed up for), legitimate interests (securing and improving the Platform), legal obligation (e.g., financial records), and consent (where required, such as certain media uses). You may withdraw consent at any time.

6. Sharing & service providers

We share data with sub-processors strictly to operate the Platform. Each is bound by contractual data-protection obligations:

Supabase — database, authentication, and file storage.
Backblaze B2 — storage of event photographs and video.
Vercel — application hosting and delivery, and cookieless aggregate usage measurement.
Amazon Web Services (Simple Email Service) — transactional email delivery.
Sentry — error and performance diagnostics.
Google — the Gemini API, for the automated photograph check and as a fallback for the features in Section 4 (see that section for exactly what is sent).
DeepSeek — the in-app assistant, judge-critique summaries, support-email handling, and our internal operations summary (see Section 4).
Stripe — card payment processing, where a competition organizer enables it.

We also share data with the specific competition organizer and studio you are associated with. We may disclose information when required by law or to protect rights and safety.

7. Children’s data

The Platform stores information about dancers who may be minors. This data is entered by the registering dance studio, not collected by us directly from children. Studios and competition organizers are responsible for obtaining any parental or guardian consent required by law before submitting a minor’s information or media. We limit minors’ data to what is necessary to run the competition (name, date of birth, performance media) and restrict access to authorized users.

Two things in this Policy apply directly to minors and we state them here so they are not missed. First, the event media we store is photography and video of dancers, and a competition organizer may send that media — including images of minors — to Google for the automated photograph check described in Section 4(a). Second, where judge critiques are recorded, a judge’s spoken commentary about a routine performed by a minor is transcribed and summarized using the services described in Section 4(c). If you do not want a dancer’s media processed this way, contact your competition organizer or write to us at the address below and we can disable the automated check for that competition.

If you believe a minor’s data has been provided without proper consent, contact us at techsupport@compsync.net and we will remove it.

8. Data retention

We retain personal data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal, accounting, or reporting obligations.

Event media — the photos and video captured at a competition — is retained for one year from the end of the event it was captured at, so that it stays available for download and re-delivery to authorized recipients through that period. After one year it is deleted from our active systems. Competition records themselves (results, placements, schedules) are kept beyond that period to support historical results.

When you delete your account, or ask us to delete data, we remove it from our active systems and it is purged from our backups within one year.

9. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. CompSync provides tools to export all of your data (machine-readable JSON or CSV) and to permanently delete your account and associated data. To exercise any right, use the in-app account tools where available or email techsupport@compsync.net. We respond within the timeframe required by applicable law.

10. California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights over the personal information we hold about you.

Right to know. You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, our purpose for collecting it, and the categories of third parties we disclose it to. Sections 2, 3, 4 and 6 of this Policy describe all of these.
Right to delete. You may request that we delete personal information we collected from you, subject to the exceptions the law allows (for example, records we must keep to complete a transaction, to comply with a legal obligation, or to maintain the integrity of competition results).
Right to correct. You may request that we correct inaccurate personal information.
Right to limit use of sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond providing the service.
Right to non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We do not serve advertising on the Platform, we set no advertising or cross-site tracking cookies, and we have not sold or shared personal information in the preceding twelve months. Sending data to the sub-processors in Section 6 so they can perform a service for us is not a sale.

To exercise any of these rights, email techsupport@compsync.net from the address on your account, or use the in-app export and account-deletion tools. We will verify your request against your account before acting on it, and we will respond within the period the law requires. An authorized agent may submit a request on your behalf with written proof of authorization.

Much of the information on the Platform about a dancer is submitted by the dance studio that registered them, not by us. If your request concerns a dancer’s registration data, tell us in your request and we will route it to the studio and competition organizer responsible for that record as well as acting on the copy we hold.

11. Security

We use industry-standard safeguards including encryption in transit, hashed passwords, access controls, tenant isolation, and audit logging. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify affected users and regulators of breaches as required by law.

12. International transfers

We are a Canadian company and our service providers process data in countries other than your own, including the United States. Two transfers are worth naming specifically. The automated features in Section 4 send content to Google, which processes it on infrastructure outside Canada, including in the United States. The features in Section 4 that use DeepSeek send content to a provider that states in its own privacy policy that it processes and stores personal data in the People’s Republic of China. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

13. Cookies

We use strictly necessary cookies for authentication and session management — a session identifier and a cache-invalidation marker, plus the authentication cookies set when you sign in. We set no advertising cookies and no cross-site tracking cookies, and our usage measurement does not use cookies.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

15. Contact us

Questions or requests regarding this Policy or your data: techsupport@compsync.net. Operating entity: Streamstage Productions Inc., 526 Lansdowne Avenue, Woodstock, ON, Canada. Data controller for inquiries under applicable data-protection law: techsupport@compsync.net.