Legal 路 Privacy Policy
Privacy Policy
The short version: We collect the minimum data we need to run your account and our business. We don't sell your data. We use trusted providers (Supabase, Vercel, Vimeo, Takbull, Resend) to deliver the service, and, only with your consent, the Meta (Facebook) Pixel for advertising. You have rights, including access, correction, deletion, and (for EU residents) data portability.
1. Who we are
This policy describes how Bachata Online ("we", "us") collects and uses personal data. For the purposes of the EU/UK General Data Protection Regulation, the California Consumer Privacy Act, and Israel's Protection of Privacy Law, the data controller of personal data you provide through the Service is:
- Latin Groove, a licensed business (Osek Murshe) in Israel, business ID 558410056
- Address: Kalisher 21, Petach Tikva, Israel
- Contact: contact.bachataonline@gmail.com
2. What data we collect
2.1 Information you give us
- Account data: first name, last name, email address, password (stored hashed by Supabase Auth).
- Profile data: language preference, communication preferences, optional phone number.
- Q&A & learning content: questions you post on lessons, quiz answers, lesson notes.
- Support correspondence: the content of any email or message you send us.
2.2 Payment data
When you purchase, you enter your card details directly on Takbull's secure payment page. We never receive, see, or store your full card number, CVV, or expiry. From Takbull we receive a payment confirmation, a transaction reference, the last 4 digits of the card, the card brand (e.g. Visa), and for recurring subscriptions a token that lets us request future charges through Takbull without ever handling the card. Takbull is the data controller for your payment-card data; see Takbull's privacy notice.
2.3 Usage data we collect automatically
- Learning activity: which lessons you start, how far you watched, which quizzes you took and your scores, which courses you completed.
- Account events: logins, password changes, plan changes, payment events.
- Technical data: IP address (for security and rough geolocation), browser, operating system, device type, time-zone, referrer URL.
- Video playback data is collected by Vimeo on our behalf so we can show your progress; we do not receive your raw IP from Vimeo.
2.4 Cookies
See our Cookie Policy for the cookies and similar technologies we use.
2.5 Information from third parties
We do not buy personal data from data brokers. Where you sign in with a third-party identity provider (if/when offered), we receive only what you authorize that provider to share.
3. Why we use your data (legal bases)
We use your personal data only where we have a lawful basis under the GDPR (and equivalent local laws):
- Performance of a contract, to provide the Service you signed up for: create your account, stream lessons, take payments, show your progress, send receipts, provide support.
- Legitimate interests, to protect the Service from fraud and abuse, to investigate security incidents, to improve our courses (using aggregated/de-identified data wherever possible), and to send service announcements you would reasonably expect.
- Legal obligation, to keep invoices and tax records for the periods required by Israeli law and other applicable tax laws; to respond to lawful requests by public authorities.
- Consent, for non-essential marketing emails and for analytics/marketing cookies. You can withdraw consent at any time without affecting prior processing.
Providing your data is voluntary, but some of it (such as your name, email and password) is necessary to create your account and deliver the Service; without it, we cannot provide the Service to you. We send marketing messages only if you have opted in, every marketing email includes an easy one-click unsubscribe, and you can opt out at any time without affecting your access to the Service.
4. Who we share it with
We share personal data only with the service providers that help us operate the Service, and only what they need:
- Supabase, Inc.: database and authentication. Stores your account, profile, subscription, progress, and Q&A data. Servers in the EU (Frankfurt).
- Vercel Inc.: application hosting and CDN. Processes web requests including your IP address.
- Vimeo, Inc.: video streaming. Delivers lesson videos and collects playback telemetry.
- Takbull Ltd.: payment processing and invoice generation.
- Resend Inc.: transactional email delivery (receipts, account notifications).
- Meta Platforms, Inc.: advertising measurement via the Meta (Facebook) Pixel. Loaded only with your consent ("Accept all" in our cookie banner). When active, it shares page-view and conversion events with Meta to measure and improve our ads. You can decline or withdraw this at any time.
- Our professional advisers: accountants and lawyers, under confidentiality obligations.
- Authorities: where required by law (court orders, valid government requests).
- A successor in a corporate transaction, for example a merger or acquisition, in which case we will require the successor to honor this policy.
We do not sell or rent your personal data. We do not share data for cross-context behavioral advertising except the Meta Pixel events described above, which run only if you opt in via our cookie banner.
5. International transfers
We are based in Israel. Some of our processors are located in the EU, the United States, or other countries. Where personal data of EU/EEA or UK residents is transferred outside the EEA to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) and additional safeguards. Israel benefits from an EU adequacy decision for data transfers.
6. How long we keep it
- Account data: while your account is active, and for up to 12 months after closure (so you can reactivate). Then deleted or anonymized.
- Payment and invoice records: at least 7 years, as required by Israeli tax law.
- Learning activity: while your account is active. Aggregated/de-identified analytics may be retained longer.
- Q&A content: kept as part of the lesson knowledge base after account closure (we will anonymize the asker's name on request).
- Support correspondence: up to 3 years.
- Logs & security data: up to 12 months.
7. How we protect it
We use industry-standard technical and organizational measures, including:
- TLS encryption for all data in transit;
- encryption at rest by our hosting and database providers;
- Row-Level Security in the database so members can only access their own data;
- hashed passwords (never stored in plain text);
- no card details on our servers (handled exclusively by Takbull);
- least-privilege access to production systems;
- regular review of third-party processors.
No method of transmission or storage is 100% secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.
8. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Correct data that is inaccurate or incomplete;
- Delete your data (the "right to be forgotten"), subject to legal retention obligations;
- Restrict or object to certain processing;
- Data portability: receive a machine-readable copy of data you provided;
- Withdraw consent at any time for processing based on consent;
- Opt out of marketing emails by clicking unsubscribe or updating your preferences in your dashboard;
- For California residents: the rights to know, delete, correct, and to limit the use of sensitive personal information (we do not sell or "share" data for cross-context advertising);
- For Israeli residents: rights of review, correction, and deletion under the Protection of Privacy Law (5741-1981).
To exercise any right, email contact.bachataonline@gmail.com from the address on your account. We respond within 30 days. We do not discriminate against you for exercising your rights.
9. Cookies & tracking
We use strictly necessary cookies (for login and security) and cookieless, privacy-friendly Vercel Analytics. Only with your consent do we load the Meta (Facebook) Pixel for advertising and Microsoft Clarity for product analytics and session replay. Full details, and how to change your choice, are in our Cookie Policy.
10. Children
The Service is intended for users aged 18 or older. We do not knowingly collect personal data from anyone under 18 (or under 16 in the EU/EEA where applicable). If you believe a child has provided us with personal data, please contact us so we can delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. If changes are material, we will notify you by email or via the Service.
12. Contact & complaints
To exercise your rights or to ask a question:
馃摟 contact.bachataonline@gmail.com
If you are in the EU/EEA and believe we have not handled your data properly, you also have the right to lodge a complaint with your national data-protection authority. If you are in Israel, you may complain to the Privacy Protection Authority.