Privacy Policy

Anna Baila is a social app for festival dancers and a platform for online Bachata classes. This policy explains what personal data we process when you use annabaila.grantmoxom.com, why, on what legal basis, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and German data-protection law.

The data controller responsible for this site is the operator named in our Impressum. You can reach us using the contact details there.

• Account & email — your email address, and (if you sign in with Google) your name and profile image. We use these to create and secure your account.
• Profile — your handle, display name, bio, optional Instagram link and avatar image. This is the public identity you choose to share.
• Social graph — the connection requests you send and accept, and the share/QR tokens used to connect with other dancers.
• Festival videos — the clips and thumbnails you upload, plus their caption, festival tag and visibility setting. See the important note about people filmed in these clips below.
• Class & watch data — your course enrolments, instructor records and the lessons you have access to.
• Reports — if you report a video, we store the reason, your user id and the report status so we can act on it.
• Server logs — operational logs generated when you use the service (e.g. requests and errors), kept for security and debugging.

Festival clips are filmed in public at festivals and may capture other dancers and bystanders who are not Anna Baila users and have not signed up to anything. We take this seriously.

Every uploader must attest that everyone identifiable in their clip has consented to being filmed and shared. To protect people who are filmed, festival clips auto-delete after about 7 days, and anyone — including people who are not Anna Baila users — can ask for a clip they appear in to be removed and we will action it promptly. The quickest way is the public, login-free "Report this video" link shown on every clip, which opens a takedown form — no account required. You can also use the contact details in our Impressum to request a takedown.

• Performance of a contract (Art. 6(1)(b)) — to provide your account, profile, connections and classes.
• Consent (Art. 6(1)(a)) — for the festival clips you choose to upload.
• Legitimate interests (Art. 6(1)(f)) — to keep you signed in, keep the service secure, and handle abuse reports and takedowns. For people filmed in clips, we balance this interest against your rights through short retention and an easy removal route.

• Festival videos — automatically deleted after about 7 days. You can delete your own clip sooner at any time.
• Account, profile, connections and class data — kept for the life of your account, then deleted when you delete your account.
• Sign-in tokens — short-lived; they expire automatically.
• Reports — kept while needed to handle the report; removed when the related video is deleted.
• Server logs — kept only as long as needed for security and debugging.

Your account data, profile, social graph and video files are stored on infrastructure we host within the EU. We keep personal data in the EU wherever possible; where a service provider processes data outside the EU, we rely on appropriate safeguards such as Standard Contractual Clauses.

We do not sell your personal data. We use a small number of service providers who process data on our behalf:

• DreamHost — domain and DNS services.
• Cloudflare — network, content delivery and tunnel/security services.
• Stripe — payment processing, once paid classes go live. We never store your full card details; these are handled by Stripe.

We sign data-processing agreements with these providers. Some may process data outside the EU under appropriate transfer safeguards.

We use only strictly necessary cookies: a session cookie to keep you signed in and security cookies (CSRF / sign-in callback) used during authentication. These are required for the site to work, so no consent banner is needed for them.

We do not use analytics, advertising or other non-essential cookies. If that ever changes, we will update this policy and ask for your consent first.

Under the GDPR you have the right to:

• Access — ask what personal data we hold about you.
• Rectification — correct inaccurate data; you can edit most of your profile data directly in the app.
• Erasure — delete your account and personal data. You can do this yourself from your account settings.
• Objection — object to processing based on our legitimate interests. If you appear in a clip, you can ask for it to be removed at any time.

You also have the right to lodge a complaint with a data-protection supervisory authority in your country.

For any privacy question, a takedown request, or to exercise your rights, contact us using the details in our Impressum.

We may update this policy as the service evolves. The "last updated" date at the top reflects the most recent change.