Legal Entity: SocialDancer is operated by David Freiholtz, a private person (not a company) based in Sweden.

Data Controller: David Freiholtz is the data controller responsible for your personal data processed through this website.

Jurisdiction: This service operates under Swedish and EU law, including full GDPR compliance.

Business Structure: Personal project operated by an individual, not a registered company

This Privacy Policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Swedish data protection laws. We process personal data based on the following legal bases:

• Consent: For optional features like AI search and newsletter subscriptions
• Contract: To provide the services you've signed up for
• Legitimate Interest: For security, fraud prevention, and service improvement

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.

Personal Data Categories:

• Account Information: Email address, username, encrypted password, optional profile information
• Usage Data: IP address, browser type, pages visited, time and date of visits, time spent on pages
• Preference Data: Dance style preferences, favorite events, bookmarked content
• Communication Data: Messages you send us, feedback, support requests
• Third-Party Data: If you sign in with Google, we receive your name and email from your Google account

Cookies: We use essential cookies for authentication and session management. We use functional cookies to remember your preferences. All cookies are first-party only.

Purposes of Processing:

• Service Provision: To create and manage your account, provide access to dance event information, enable event bookmarking and preferences
• Communication: To send service-related emails (password resets, security alerts, major updates)
• Improvement: To analyze usage patterns, identify bugs, develop new features based on user needs
• Misuse Prevention: To detect and prevent spam, abuse, and harmful queries in our AI search system
• Legal Compliance: To comply with legal obligations, resolve disputes, enforce our agreements
• Security: To detect and prevent fraud, unauthorized access, and other harmful activity

Retention: We retain your account data while your account is active. Usage logs are deleted after 90 days. You can request deletion at any time.

Data Processors (Sub-processors):

• Google LLC (Gemini AI): Processes all search queries (our only search method). Data processing location: Global. Legal basis: Legitimate interest in providing search functionality. Data shared: Search queries only, no personal account information. We also retain search queries for misuse prevention and service improvement.
• Fly.io Inc: Infrastructure hosting provider. Data processing location: Stockholm, Sweden (EU). All data is encrypted in transit and at rest. DPA (Data Processing Agreement) in place.
• Supabase Inc: Database hosting provider. Data processing location: Stockholm, Sweden (EU). Stores all account data, event information, and user preferences. All data is encrypted in transit and at rest. GDPR compliant with EU data residency.

Other Disclosures: We may disclose your information if required by law, court order, or governmental authority. We will notify you of such disclosures unless legally prohibited.

Business Transfers: In the unlikely event of a merger or acquisition, user data would be transferred to the successor entity, and you would be notified before any transfer occurs.

Your GDPR Rights:

• Right of Access (Article 15): Request a copy of your personal data we process
• Right to Rectification (Article 16): Request correction of inaccurate personal data
• Right to Erasure (Article 17): Request deletion of your personal data ('right to be forgotten')
• Right to Restriction (Article 18): Request restriction of processing your personal data
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used format
• Right to Object (Article 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for processing at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

Data Protection Contact:

Data Controller: David Freiholtz
Email: [email protected]
Response Time: Within 30 days as per GDPR Article 12(3)

Supervisory Authority:

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):
Website: www.imy.se
Address: Box 8114, 104 20 Stockholm, Sweden
Phone: +46 8 657 61 00