Privacy policy

1. Who is responsible for your data

DanceKaro is the data fiduciary for the information described here. How to reach us — including our grievance officer — is on the contact page.

2. What we collect

If you only browse

No account, no name, no email. The server keeps ordinary request logs — an IP address, the page requested, the time — which is what any web server does and what security incidents are investigated with. A session cookie is set to protect forms against cross-site request forgery.

We also make a rough guess at which city you are in, from the IP address, so the site can show you what is on near you. The guess is made on our own server, is not stored against you, and is wrong often enough that there is a control in the header to correct it.

If you create an account

• Your name and email address.
• Your mobile number, and the fact that it was verified.
• A password, stored only as a one-way hash — we cannot read it and cannot tell you what it is.
• The city you selected, where you selected one.

If you send or receive a booking request

• The event date, the city and venue, the style, the number of people and anything you wrote in the request.
• The price shown at the time, the state the request is in, and the messages exchanged about it.
• Once a booking is confirmed, the two of you can see each other's contact details. That is the point of the request, and it is why the phone number is verified first.

If you list on the platform

• Everything you publish: your display name, biography, styles, prices, packages, availability and the photographs and video in your portfolio.
• Portfolio media may be marked public or shown only to a couple with a confirmed booking. What you mark public is public — assume it can be seen and saved by anybody.
• For a studio or a group, the studio's name, address and roster.

Reviews

A review carries the rating, the text and the reviewer's display name, and it is public. Only somebody whose booking actually happened can leave one.

3. Why we collect it

To run your account

Signing you in, resetting a password, and keeping your session secure.

To make an introduction possible

Passing your request to the choreographer you chose, and passing their reply back.

To verify that you are a real person

The one-time code sent to your mobile. A marketplace without it is one where every choreographer's inbox is spam.

To send you what your account needs

A booking accepted, a request about to expire, a class coming up, a password reset. These are transactional and cannot be switched off while you have an active booking.

To keep the platform safe and lawful

Investigating abuse and fraud, enforcing the terms, and meeting legal obligations.

To count how the platform is doing

Aggregate counts — profile views, requests sent, workshops listed — which a choreographer sees for their own profile. These are totals, not a record of who looked at what.

4. Who else sees it

A very short list, and no one on it is an advertiser:

The choreographer or studio you contacted

Your request, and — once a booking is confirmed — your contact details. Nothing before that point.

Our email provider

Resend, which delivers transactional email. It handles your email address and the contents of the message.

Our SMS provider

MSG91, which delivers the one-time verification code. It handles your mobile number.

Our hosting

The servers the application and its database run on. Data is stored in India where the provider offers it.

Anyone we are legally required to disclose to

A lawful order, a court, or where it is necessary to prevent serious harm.

We do not sell your data, rent it, or trade it. There is no advertising network on this site, no tracking pixel and no third-party analytics script — the site's own security policy blocks scripts from anywhere but this domain, so one could not run here even by accident. The only external thing the pages load is a web font.

5. Cookies

Two, both first-party and both necessary: a session cookie that remembers you are signed in, and a token that protects forms from being submitted by another site on your behalf. There is no advertising or analytics cookie, which is why there is no consent banner in your way.

6. How long it is kept

• Account details: while your account exists.
• Bookings and the messages about them: 24 months after the booking ends, so a dispute can be looked into and a review can be verified.
• An expired or declined request: kept for the same period, in the state it ended in.
• Published reviews: for as long as the profile they are about is published.
• Server logs: a short rolling window, then overwritten.
• Backups: encrypted, and aged out on their own schedule, so deleted data can persist in a backup for a short time after it is gone from the live site.

7. Your rights

You may ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong — most of it you can edit yourself from your account;
• delete your account and the personal data in it;
• stop sending you anything that is not strictly transactional;
• nominate somebody to exercise these rights if you are unable to.

Write to us and we will answer within 15 days. Some things survive a deletion request: a review already published is kept without your name where the law allows, and records we are required to retain are retained.

8. Children

The site is not for anyone under 18 and we do not knowingly collect their data. If a child has created an account, tell us and we will remove it.

9. Security

Traffic is encrypted in transit. Passwords are hashed and never stored in a readable form. Access to the production database is limited to the people who run the service, backups are encrypted, and uploaded images are processed in an isolated service that has no access to the database or to any credential.

No system is perfectly secure. If you believe you have found a weakness, please tell us privately before telling anybody else.

10. Changes

If this policy changes, the date at the top changes with it, and a material change is notified to your account's email address.