Legal Entity: SocialDancer is operated by David Freiholtz, a private person (not a company) based in Sweden.

Data Controller: David Freiholtz is the data controller responsible for your personal data processed through this website.

Jurisdiction: This service operates under Swedish and EU law, including full GDPR compliance.

Business Structure: Personal project operated by an individual, not a registered company

This Privacy Policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Swedish data protection laws. We process personal data based on the following legal bases:

• Consent: For optional features like AI search and newsletter subscriptions
• Contract: To provide the services you've signed up for
• Legitimate Interest: For security, fraud prevention, and service improvement

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.

Personal Data Categories:

• Account Information: Email address, username, encrypted password, optional profile information
• Usage Data: IP address, browser type, pages visited, time and date of visits, time spent on pages
• Preference Data: Dance style preferences, favorite events, bookmarked content
• Communication Data: Messages you send us, feedback, support requests
• Third-Party Data: If you sign in with Google, we receive your name and email from your Google account

Cookies: We use essential cookies for authentication and session management. We use functional cookies to remember your preferences. All cookies are first-party only.

Purposes of Processing:

• Service Provision: To create and manage your account, provide access to dance event information, enable event bookmarking and preferences
• Communication: To send service-related emails (password resets, security alerts, major updates)
• Improvement: To analyze usage patterns, identify bugs, develop new features based on user needs
• Misuse Prevention: To detect and prevent spam, abuse, and harmful queries in our AI search system
• Legal Compliance: To comply with legal obligations, resolve disputes, enforce our agreements
• Security: To detect and prevent fraud, unauthorized access, and other harmful activity

Retention: We retain your account data while your account is active. Usage logs are deleted after 90 days. You can request deletion at any time.

Data Processors (Sub-processors):

• Google LLC (Gemini AI): Processes all search queries (our only search method). Data processing location: Global. Legal basis: Legitimate interest in providing search functionality. Data shared: Search queries only, no personal account information. We also retain search queries for misuse prevention and service improvement.
• Fly.io Inc: Infrastructure hosting provider. Data processing location: Stockholm, Sweden (EU). All data is encrypted in transit and at rest. DPA (Data Processing Agreement) in place.
• Supabase Inc: Database hosting provider. Data processing location: Stockholm, Sweden (EU). Stores all account data, event information, and user preferences. All data is encrypted in transit and at rest. GDPR compliant with EU data residency.

Other Disclosures: We may disclose your information if required by law, court order, or governmental authority. We will notify you of such disclosures unless legally prohibited.

Business Transfers: In the unlikely event of a merger or acquisition, user data would be transferred to the successor entity, and you would be notified before any transfer occurs.

Your GDPR Rights:

• Right of Access (Article 15): Request a copy of your personal data we process
• Right to Rectification (Article 16): Request correction of inaccurate personal data
• Right to Erasure (Article 17): Request deletion of your personal data ('right to be forgotten')
• Right to Restriction (Article 18): Request restriction of processing your personal data
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used format
• Right to Object (Article 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for processing at any time

To exercise any of these rights, reach out via our contact page. We will respond within 30 days as required by GDPR.

Data Protection Contact:

Data Controller: David Freiholtz
Contact: via the contact page
Response Time: Within 30 days as per GDPR Article 12(3)

Supervisory Authority:

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):
Website: www.imy.se
Address: Box 8114, 104 20 Stockholm, Sweden
Phone: +46 8 657 61 00