Privacy Policy

Last updated: 1 August 2026

1. Introduction

This Privacy Policy explains how BachataHub.com ("we", "us", "the platform") collects, uses, stores, shares, and protects your personal information.

This policy applies to all visitors and users of the platform, whether registered or not, and across all devices (desktop, mobile, tablet).

By using BachataHub, you agree to this Privacy Policy. If you do not agree, please refrain from using the platform.

2. What Data We Collect

2.1 Information you provide

When you create an account or fill out your dancer profile, we may collect:

  • • Email address (required)
  • • Full name (required)
  • • Password (stored as a secure hash — we never see your actual password)
  • • Dance preferences — role (leader/follower/both), level, style
  • • Profile details — age, height, bio, region, availability
  • • Profile photo
  • • Social links — Instagram, dance videos

2.2 Information from Google OAuth

If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not access your contacts, calendar, or any other Google data.

2.3 Information collected automatically

  • • Authentication data: session tokens, JWT tokens managed by Supabase Auth
  • • IP address: logged by our hosting provider (Vercel) for security
  • • Browser & device info: browser type, OS, screen resolution — as collected by hosting services
  • • Pages visited: statistical usage data

3. How We Use Your Data

  • Platform operation: managing accounts, displaying profiles, enabling messaging, showing club and event information.
  • Matching dancers: helping you find dance partners by region, level, and role.
  • Club listings & event recommendations: showing relevant clubs, classes, parties, and festivals near you.
  • Service improvement: analyzing usage patterns to improve the user experience.
  • Security: protecting against misuse, fraud, and unauthorized access.
  • Communication: sending account and service updates. Marketing email is sent only if you opt in, and every such message carries a one-click unsubscribe.
  • Measurement and analytics: understanding traffic, which cities and lineups are in demand, and where the site fails people. Aggregate and cookieless measurement runs on legitimate interest; anything that identifies your device runs only on your consent.
  • Advertising: if you allow the marketing category, measuring campaigns and reaching dancers who are likely to want the platform. We never sell your data and never share it for cross-context behavioural advertising in the CCPA sense.
  • Verifying community submissions: when you submit a lineup, party or club, we process the link and any contact you give us in order to check the listing is real and current, so dancers are not sent to an empty room.
  • Legal compliance: retaining what the law requires and responding to lawful requests.

4. Cookies, Analytics & Advertising

Cookies and similar technologies on BachataHub fall into three tiers. The first runs always; the other two run only if you allow them.

Tier 1 — Strictly necessary (always on)

These are required for the site to function and cannot be switched off. Under the ePrivacy Directive they are exempt from the consent requirement.

  • • Supabase authentication cookies — keep you signed in. They hold an encrypted JWT and refresh automatically.
  • • NEXT_LOCALE — remembers whether you read the site in English or Hebrew.
  • • bh_consent — stores the cookie choice you made on this page, so we do not ask again for twelve months. Removing it makes the banner reappear.

We also run Vercel Web Analytics and Vercel Speed Insights for everyone. These measure page views and loading performance without setting a cookie, without storing a device identifier, and without fingerprinting. Because they place nothing on your device and cannot single you out, they sit outside the consent requirement and run on the basis of our legitimate interest in knowing whether the site works.

Tier 2 — Analytics (only with your consent)

If you allow the Analytics category, we may load Google Analytics 4 to understand which lineups, cities and terms people look for, which pages fail them, and where visitors come from. IP anonymisation is enabled, and Google Consent Mode v2 starts in a fully denied state so no analytics identifier is written before you choose.

Tier 3 — Marketing (only with your consent)

If you allow the Marketing category, we may load advertising and measurement tools such as the Meta Pixel. These let us measure whether a campaign brought dancers to the platform and show BachataHub to people with similar interests on other services. This involves sharing an event signal, and in some cases a hashed identifier, with the advertising platform.

Your control

  • • Both optional categories default to off. If you close the banner without choosing, nothing beyond Tier 1 loads.
  • • Refusing is one click and sits beside the accept button, never buried.
  • • You can change or withdraw your choice at any time from the link at the bottom of any page, or by clearing the bh_consent cookie. Withdrawal does not affect processing that already happened lawfully.
  • • Your browser settings can block cookies entirely. Blocking the strictly necessary ones will stop you signing in.
  • • We honour Global Privacy Control and "Do Not Track" signals where your browser sends them.

We do not sell your personal information and we do not share it for cross-context behavioural advertising within the meaning of the CCPA/CPRA.

5. Data Sharing

We do not sell your personal data. We do not share personal information for third-party marketing purposes.

Your profile information (name, dance role, level, bio) is visible to other registered users on the platform, based on your privacy settings.

We share data only with clubs and instructors you directly interact with (e.g., when you register for a class or contact a club through the platform).

We rely on the following processors:

  • • Supabase — database, authentication, storage. Servers in eu-central-1 (Frankfurt, Germany).
  • • Vercel — hosting and global CDN, plus Web Analytics and Speed Insights. Requests may transit servers outside the EEA.
  • • Resend — transactional email delivery.
  • • Google Fonts — font delivery.
  • • Google Analytics — only if you allow the analytics category.
  • • Meta — only if you allow the marketing category.

Where a processor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified.

If BachataHub is sold, merged, or transferred, personal data may pass to the acquirer, who must continue to protect it under terms at least as protective as this policy. You will be told before your data becomes subject to a materially different policy.

We may also disclose information when required by law, court order, or to protect the safety of our users.

6. GDPR Compliance (EU Users)

Our primary database is hosted on Supabase in the eu-central-1 region (Frankfurt, Germany), within the European Union.

If you are located in the EU/EEA, you have the following rights under GDPR:

  • • Right of access — request a copy of your personal data
  • • Right to rectification — correct inaccurate data
  • • Right to erasure — request deletion of your data
  • • Right to data portability — receive your data in a machine-readable format (JSON/CSV)
  • • Right to object — object to processing of your data
  • • Right to restrict processing — limit how we use your data
  • • Right to withdraw consent — at any time, as easily as it was given, without affecting processing already carried out
  • • Right to lodge a complaint — with your national supervisory authority

Our legal bases are:

  • • Contract (Art. 6(1)(b)) — running your account, showing profiles, delivering messages.
  • • Consent (Art. 6(1)(a)) — optional profile fields, marketing email, and every non-essential cookie or tracker.
  • • Legitimate interest (Art. 6(1)(f)) — security, abuse and fraud prevention, cookieless aggregate measurement, and verifying that community-submitted lineups are accurate. We balance this against your rights and you may object at any time.
  • • Legal obligation (Art. 6(1)(c)) — retention and disclosure required by law.

We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of Art. 22.

California residents: you may request access, deletion, correction, and details of the categories of information collected and disclosed, and you may exercise these rights without being discriminated against. We do not sell personal information and do not share it for cross-context behavioural advertising. Use the contact details below, or your browser's Global Privacy Control signal, which we honour.

7. Data Deletion

You can request deletion of your account and all associated personal data at any time by contacting us. Upon deletion:

  • • Your profile, messages, and uploaded content will be removed within 30 days.
  • • Backup copies may be retained for up to 90 days for technical reasons.
  • • Data required by law will be retained for the legally mandated period.

8. Children's Privacy

BachataHub is not intended for children under 16. We do not knowingly collect personal information from anyone under 16. Users aged 16-18 must have parental or guardian consent. If we learn we have collected data from a child under 16 without consent, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top reflects the most recent revision. For material changes, we will post a prominent notice on the platform. Continued use of BachataHub after changes constitutes acceptance of the updated policy.

10. Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

We take every inquiry seriously and will respond as soon as possible, no later than 30 days from receipt.

Terms of Service|Accessibility