Privacy Policy for Bachatero

1. Information We Collect

We only collect the minimum amount of data required to run Bachatero safely and effectively.

• Account Information: When you create an account using an email and password, we collect your name, your email address, and a securely hashed version of your password.
• Google Sign-In: If you sign up using Google, we receive basic profile information permitted by Google, typically limited to your name, email address, and an authentication token. The Google sign-in button on our log in and sign up pages is loaded from Google, so Google receives your IP address when you visit those pages, even if you don't use it.
• User-Contributed Content: If you add a social dance event or venue to our map, we store the event details you provide (e.g., location, time, style of dance) along with your user account ID to manage platform security and prevent spam.
• Contact Form: If you send us a message through our contact form, we collect your name, email address, and the message you write. You don't need an account to use it. Your message is sent to our support inbox by email so we can reply to you.
• IP Addresses and Security Records: To protect the site from abuse, we temporarily record your IP address when you log in, sign up, verify your email, reset your password, use the contact form, or load venue photos, and we may also record the email address used in log in, sign up, and password reset attempts. This lets us limit repeated attempts. If a limit is exceeded, or a password reset link is reused, we keep a security record of the IP address, email address, or account ID involved.
• Analytics: We don't currently use any third-party analytics, advertising, or tracking scripts, and our Content Security Policy only allows scripts from our own domain, Google Sign-In, and Google Maps. Our hosting provider, Cloudflare, keeps standard request logs (which can include your IP address, the page requested, your browser type, and the time of the request). We use these logs to monitor errors and performance and to understand general usage, such as which cities are popular. If we add an analytics tool in the future, we will update this policy first and will favor privacy-focused tools that don't use tracking cookies.

2. How We Use Your Information

We do not sell, rent, or trade your personal data. We use your information strictly to:

• Authenticate your identity so you can log into your account.
• Allow you to contribute, edit, and track your favorite dance socials.
• Maintain the security, integrity, and safety of our community map (e.g., rate limiting, moderating spam or fake events).
• Send you critical account emails, such as email verification and password resets.
• Read and reply to messages you send us through the contact form.

3. Cookies

• Session Cookie: We use a single essential cookie to keep you logged in. It holds a random session ID, can't be read by scripts on the page, and expires after 7 days. We don't use advertising or tracking cookies.

4. Service Providers

We rely on a small number of providers to run Bachatero. They only receive the data they need to provide their service to us.

• Cloudflare: Hosts the website and stores our database, so all of the data described in this policy is stored on Cloudflare's infrastructure. Cloudflare also keeps the request logs described under Analytics.
• Resend: Delivers our emails. It processes your email address and the contents of the email when we send you a verification or password reset email, and your name, email address, and message when you use the contact form.
• Google: Provides Google Sign-In and the Google Maps Platform services described below. Your use of Google Maps features is also subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.
• Map Services: Our map tiles are loaded from OpenStreetMap, and location search and venue details come from Google Maps Platform. Your browser contacts these providers directly, so OpenStreetMap receives your IP address and the area of the map you are viewing, and Google receives your IP address, any search text you type into the map search, and which venue you are looking at. We do not share your account information (such as your name or email address) with them. Venue photos are fetched through our own servers, so loading them does not contact Google directly.

5. International Data Transfers

Our service providers may process your data in countries outside the European Economic Area (EEA) and the United Kingdom, including the United States. When they do, the transfer is protected by safeguards such as the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission, which are included in each provider's data processing terms.

6. Data Retention and Deletion

We keep your account information only as long as your account remains active. Other data is kept for a limited time:

• Sessions: Expire after 7 days, or when you log out.
• Rate Limiting Records: Deleted automatically once their time window has passed, usually within a day.
• Security Records: Kept for 90 days, then deleted automatically.
• Contact Messages: Kept in our support inbox for as long as needed to respond to you and handle any follow-up.
• Request Logs: Kept by Cloudflare for up to 7 days, then deleted automatically.
• Account Deletion: You can permanently delete your account at any time from the Settings section of your account page. This immediately deletes your account information, sessions, password reset links, favorites, and attendance marks. It can't be undone.
• What Stays After Deletion: Venues, socials, and reviews you added stay listed so the community can keep using them, but they are no longer linked to any account you can access. Rate limiting and security records, contact messages, and request logs are kept only for the periods listed above. To ask us to delete any of this data too, contact us at hello@bachatero.org.

7. Legal Basis for Processing

If you are in the EEA or the UK, data protection law requires us to explain the legal basis for each way we use your personal data:

• Performance of a Contract: Creating and running your account, logging you in, letting you add and edit dance socials, and sending account emails such as email verification and password resets.
• Legitimate Interests: Protecting the site from abuse (rate limiting and security records), monitoring errors and performance through request logs, linking contributed content to an account to prevent spam, showing the map and venue search, and replying to messages you send through the contact form. We only rely on this basis where our interests aren't outweighed by your rights and freedoms.
• Legal Obligations: Keeping or disclosing data where the law requires us to.

8. Your Rights

Depending on where you live, and in particular if you are in the EEA or the UK, you have the right to:

• Access: Ask for a copy of the personal data we hold about you.
• Correction: Ask us to correct data that is inaccurate or incomplete. You can also update your name in your account settings.
• Deletion: Delete your account yourself from your account page, or ask us to delete your personal data.
• Restriction: Ask us to limit how we use your data while a concern is being resolved.
• Portability: Receive the data you gave us in a structured, machine-readable format.
• Objection: Object to any use of your data that relies on our legitimate interests.
• How to Exercise Your Rights: Email us at hello@bachatero.org. We will respond within one month, and we may ask you to confirm your identity first.
• Complaints: You have the right to complain to the data protection authority in the country where you live or work. We'd appreciate the chance to address your concern first, so please contact us before doing so.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our app or legal requirements. We will update the "Last Updated" date at the top of this page whenever modifications are made.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, please reach out to us at:

• Email: hello@bachatero.org