Privacy Policy

Effective 7 September 2026.

This policy describes what we actually do with your data today, including the parts that are not yet good. Where a protection is missing we say so rather than implying it exists.

1. Who we are

Adyota Ventures LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, USA runs Dance Feedback. We are the data controller for the personal data described here — under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") the equivalent term is Data Fiduciary.

Contact for anything in this policy: adarsh@adyotaventures.com.

We have not appointed a Data Protection Officer; at our current scale we are not required to.

2. What this policy covers

The Dance Feedback website and application. It does not cover a separate arrangement where a studio or school signs up as an organisation and enrols its own dancers — there, the organisation is the controller and we act on its instructions under a separate Data Processing Agreement.

3. What we collect

We do not collect payment details. Payments are not live — see section 7 of the Terms. No card or bank data enters our systems.

We do not use analytics, advertising or tracking tools. There is no Google Analytics, no advertising pixel, no third-party tracker, and no cross-site tracking of any kind.

What is in your video

Video is the most sensitive thing we hold. It inherently shows physical characteristics, and in some cases may reveal information about health, disability or injury. We do not seek that information and do not analyse video for it. But please know it is there, and that a person's dancing can identify them as readily as their name.

4. Why we use it, and our lawful basis

Where GDPR applies, we rely on these Article 6 bases:

Where the DPDP Act applies, our basis is your consent, given with the itemised notice at sign-up, or a legitimate use recognised by that Act.

We do not use your data for advertising, profiling that produces legal or similarly significant effects, or automated decision-making about you — with one narrow exception: "Surprise me" automatically selects a Teacher based on your budget band and genre. It has no legal or similarly significant effect, you choose whether to use it, and you can invite a Teacher directly instead.

5. Who can see your video

• The Teacher you invited, or the Teacher assigned by "Surprise me". If you use a high-band dual match, two Teachers each receive it.
• A Teacher who declines may still have watched part of it before declining.
• Us, where necessary to operate or debug the Service.
• Our infrastructure providers, listed in section 8, which store and transmit it on our behalf.

Your video is not public, not listed, not searchable, and not shown to other Students.

How playback is protected. Video and voice notes are served through short-lived signed links that expire after two hours and are minted per view. The underlying file identifiers never appear in a URL your browser receives, and a link that leaks stops working. Video playback tokens are signed by our video provider; voice notes live in a private store and are signed on each request.

6. Improving the Service and move recognition

We intend to build features that recognise dance moves automatically: naming a move from footage, finding similar moments across videos, and helping Teachers tag faster. Doing that well needs real data. We split that data in two, and treat the halves very differently.

6.1 Structured review data — part of the Service

The tags and rubric criteria a Teacher selects, the scores they give, the timestamps they attach them to, and the dance style, focus and level recorded on a submission. This describes movement and technique, not you: it carries no name, no email, no image and no voice, and it is not linked back to you in any analysis or published output.

We use it to operate, analyse and improve the Service, including building and training move-recognition and review-quality models, and we may keep and use it after your account closes. This is part of what the Service is, so it is not separately optional. Our lawful basis is our legitimate interest in improving a service people are choosing to use (GDPR Art. 6(1)(f)); you can object under section 13.

Anything we publish from this — a move taxonomy, transition statistics — is aggregated across many submissions and identifies nobody.

6.2 Your video, audio and written comments — opt-in, off by default

These identify you. Your face and body are in the footage; your voice is in a voice note; a Teacher's written comment may describe you. We do not use any of it to train models unless you turn that on yourself.

• We ask you directly at sign-up, and nothing is pre-selected. You answer yes or no; there is no default and no pre-ticked box. It is a distinct question, never bundled into accepting the Terms, and the answer lives in your account settings afterwards.
• If you have not answered, the answer is no. We treat silence as refusal, never as permission.
• Refusing costs you nothing. Every feature works identically either way.
• You can switch it off at any time, in settings or by writing to adarsh@adyotaventures.com. That stops future use immediately. We will remove your material from training sets at the next model build and tell you when that is done. We will not claim to unlearn a model already trained.
• Switching it off deletes nothing — your videos and feedback stay exactly as they were, available to you and your Teacher. It governs training use only.
• We will not sell it, and will not share it with a third party for their own purposes.
• This is separate from Teacher tagging. A Teacher labelling moves as part of a normal review is delivering your feedback, not training a model. The opt-in governs whether that work may also feed a model.

Current status: nothing is running. No model is being trained today under either half. We are stating the purpose now so that when we do begin, your consent was specific and informed rather than retrofitted.

If pose or movement analysis later produces data capable of identifying you biometrically, that is a further step requiring its own explicit consent under GDPR Article 9. We will ask again.

6.3 Other people in your video

Your opt-in covers your own material. It cannot speak for a dance partner who never signed up. Where a submission contains another identifiable person, we treat the video as out of scope for training unless every identifiable person in it has an account and has opted in.

7. Notifications

We email you for four events only: a Teacher declined your submission (with the reason); your feedback is ready; your sign-up was approved; and, if you are the operator, that a sign-up is waiting.

There is no marketing email, no newsletter, no digest, and no promotional content of any kind. Transactional notifications are part of the Service; if you do not want them, close your account.

We do not email you when a sign-up is declined.

8. Who we share it with

We do not sell personal data. We share it only with providers who process it on our behalf, under contract:

We may also disclose data where legally required, to establish or defend legal claims, or to a successor if our business is transferred — in which case we will tell you first.

Teachers are not "third parties" in this sense; they receive your video because you invited them, and they are bound by the Teacher Agreement, which forbids reuse, redistribution and training use.

9. International transfers and storage

We are a United States company. Our providers store and process data in the United States, in Australia (the database and voice notes), and on global edge networks (video delivery). Your data will therefore be transferred to and processed in the United States whatever country you are in.

Where GDPR or UK GDPR applies, those transfers rely on the European Commission's Standard Contractual Clauses (or the UK Addendum) in each provider's data processing agreement, together with a transfer risk assessment. The United States has a partial adequacy decision under the EU-US Data Privacy Framework; we do not rely on it alone. Where India's DPDP Act applies, transfers are made to countries not restricted by the Central Government.

You can ask us at adarsh@adyotaventures.com for details of the safeguards for any particular transfer.

10. How long we keep it

Removing and erasing are different. Removing a submission takes it off your dashboard and leaves everything in place. Erasing destroys the content — the video is deleted from our video provider, voice notes are deleted from storage, and written comments are removed, for you and for your teacher. You can erase one submission from your dashboard or everything you have uploaded from your account settings, and we do it immediately rather than queueing a request.

What survives an erasure, and why. The submission row itself, without its content: status, which teacher, when, and the numeric rubric scores. A completed review is a record between two people, and erasing the row would rewrite a teacher's history rather than remove your data. Nothing in what survives identifies you.

How long we keep it: at least 30 days, at most 60 days. Every submission is erased within that window whether or not you ask, and the clock runs from upload and never restarts.

• The 30-day minimum is a promise. Nothing you upload is deleted before then, so you always have time to download your feedback after a review lands.
• The 60-day maximum is the outer limit. We may delete sooner than that within the window — the criterion is storage cost, and nothing else. We do not delete early at anyone's request or discretion beyond that.

Your dashboard shows the date each submission is kept until, and a Download link next to it. The downloaded file is yours: it works offline and does not expire.

We set an outer limit rather than keeping things indefinitely because the safest video is one we no longer hold. It applies to teachers too: once a submission expires, the teacher loses access at the same moment you do.

Closing an account is a further step, and we can do it on request. Your sign-in is deleted so you cannot log in, and your name, email and date of birth are removed along with your uploaded content. What remains is the shape of what happened — reviews without their content, scores without a name against them — because deleting those rows would erase other people's records too, not just yours. Reviews you gave as a teacher stay readable to the students who received them, attributed to "Deleted account".

One thing a closure does not reach: entries already in our access log (section 13), which record the email address that took each action. The log is append-only by design, so those entries cannot be rewritten — that is what makes it trustworthy as a record, and it is why we would rather tell you than let you find out. We keep it because we may need it to answer a security question or a legal one.

After a closure the email address is free again and you can sign up from scratch, with no link to the old account.

11. Under-18s

The Service is for adults. You must be 18 or older to hold an account. We ask for your date of birth when you sign up and refuse accounts below 18; we store the date so the check can be repeated, and we do not knowingly collect data about anyone younger.

We recognise this excludes junior competitors. It is deliberate: doing it properly requires verifiable guardian consent under section 9 of the DPDP Act and equivalent protection under GDPR Article 8, plus the account machinery to support it. We would rather exclude minors than handle their data badly. If we open a guardian-consent route, we will publish it before it goes live.

We do not track, behaviourally monitor or advertise to anyone — which is required in relation to children under the DPDP Act, and is simply how the Service works for everyone.

If you believe someone under 18 has an account, or that footage of a minor has been uploaded, tell us at adarsh@adyotaventures.com and we will act promptly.

12. Other people in your video

Partner dance means your video usually contains someone else. Under the Terms, the person uploading is responsible for having their agreement first. If you appear in a video someone else uploaded and want it removed, write to adarsh@adyotaventures.com — you do not need an account, and we will act on it subject to the limits in section 10. You have the same rights under section 13 as anyone else whose data we hold.

13. Your rights

Under GDPR, UK GDPR and the DPDP Act as applicable, you can ask us to:

• Access — get a copy of your data and information about how we use it
• Correct — fix data that is wrong or incomplete
• Erase — destroy your uploaded content yourself, from your account settings, or ask us; see section 10 for what survives and why
• Take your data with you — every completed review has a Download link on your dashboard that produces a single file containing the scores, the written comments and the voice notes. It works offline and does not expire, so you can keep your feedback and still erase it here
• Restrict — limit how we use it while a dispute is resolved
• Object — to processing based on legitimate interests
• Port — receive your data in a machine-readable form, or have it sent on
• Withdraw consent — for the training use in section 6, at any time, without affecting what was lawfully done beforehand
• Nominate (DPDP Act) — name someone to exercise your rights if you die or become incapacitated
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects — we do not make any

How to exercise them: email adarsh@adyotaventures.com. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify who you are.

Who has opened your video. We keep an append-only record of every time someone opens one of your submissions in the Service, and every time your feedback is downloaded — who, what and when. The recent activity on your own submissions is in your account settings, and we can give you the full record on request. The log cannot be edited or deleted, including by us.

What that record cannot tell you. It records access through the Service. Playback links are issued per view, expire after two hours, and are locked to the network address they were issued to — so a link that leaves the page will not play elsewhere — but we cannot record a viewing that never reaches us, and nothing can stop someone re-filming a screen. We would rather state that limit than let the log imply more than it can.

14. How we protect it

Everything travels over HTTPS. Data is encrypted at rest by our providers. Passwords are handled by Clerk and never reach us. All third-party credentials stay server-side and are never exposed to your browser. New accounts require manual approval before they can use the Service. Access is checked on every server request.

Video and voice notes are served only through short-lived signed links that expire after two hours (section 5), so nothing we store is reachable by a permanent public URL.

We are an early-stage product and are not going to overclaim. As of today we do not have: security monitoring and alerting; a penetration test or third-party certification; or a documented incident response plan. We do keep an append-only access log (section 13). Each is on our roadmap with a priority. Please weigh that when deciding what to upload.

15. If something goes wrong

If a breach affects your personal data, we will notify you and the relevant authority as required by law. Under the DPDP Act every breach is reportable to the Data Protection Board of India and to each affected person, with no severity threshold.

16. Changes

We will post any update here and change the date below. For material changes we will give at least 30 days' notice by email or in the Service. We will never apply a new purpose to data we already hold without a fresh lawful basis — and where that basis is consent, without asking you again.

17. Complaints

Talk to us first at adarsh@adyotaventures.com. You can also complain to:

• the Data Protection Board of India, under the DPDP Act;
• your local supervisory authority in the EEA, if GDPR applies to you;
• the Information Commissioner's Office, if you are in the UK.

Last updated: 7 September 2026. Version 2026-09-07.