Privacy Policy

1. Who we are

Adyota Ventures LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, USA, runs BuffUp under our Derusty brand. We are the data controller for the personal data described here. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") the equivalent term is Data Fiduciary.

We are a US company and BuffUp is open to people in many countries, so more than one privacy law can apply to you: US state privacy and data-breach laws, the EU and UK GDPR, or India's DPDP Act, depending on where you live. This policy is written to meet all of them.

Contact for anything in this policy: buffup@derusty.com. We have not appointed a Data Protection Officer; at our current scale we are not required to.

2. What this policy covers

The BuffUp website and application. It does not cover an arrangement where a studio or school signs up as an organisation and enrols its own dancers; there the organisation is the controller and we act on its instructions under a separate Data Processing Agreement.

3. What we collect

We never see or store your card number. Card details go from your browser to Stripe. We keep a record of the transaction, including the country your card was issued in, which tells us where we are selling. A Teacher's bank details stay with Stripe.

None of that exists yet. Payments are switched off (see section 9 of the Terms and the Payment Terms).

Transaction records outlive your account. Where money has moved we keep the record of it because tax law requires us to. Erasure rights do not override that (GDPR Art. 17(3)(b)), and the record is kept without your name, your email or anything you uploaded.

Your city and country are not shown to anyone. We use them to decide where to open next and to tell you whether payments work where you are. Asking to be emailed when that changes is a separate, optional tick-box.

We count visits to our public pages with Cloudflare Web Analytics. It uses no cookies and keeps no IP address. Pages you see after signing in are not counted. We do not use advertising or tracking tools, and there is no cross-site tracking of any kind.

Your video is the most sensitive thing we hold. It shows physical characteristics and may reveal information about health, disability or injury. We do not seek that information or analyse video for it.

4. Why we use it, and our lawful basis

Where GDPR applies, we rely on these Article 6 bases:

Where the DPDP Act applies, our basis is your consent, given with the itemised notice at sign-up, or a legitimate use recognised by that Act.

We do not use your data for advertising, or for automated decisions with legal or similarly significant effects. "Surprise me" picks a Teacher automatically from your budget band and genre; it has no such effect, and you can invite a Teacher directly instead.

5. Who can see your video

• The Teacher you invited, or the Teacher assigned by "Surprise me".
• A Teacher who declines may have watched part of it first.
• No Teacher, if you uploaded it for your own notes. Then only you, and the people below, can see it.
• Us, where necessary to operate or debug the Service.
• Our providers in section 8, which store and deliver it for us.

Your video is not public, not listed, not searchable, and not shown to other Students. It plays only through short-lived links issued to the viewer.

6. Improving the Service and move recognition

We intend to build features that recognise dance moves automatically. We split the data that needs into two halves and treat them differently.

6.1 Structured review data: part of the Service

The tags and rubric criteria a Teacher selects, the scores, the timestamps, and the dance style, focus and level of a submission. It carries no name, no email, no image and no voice, and is not linked back to you in any analysis or published output. We use it to operate, analyse and improve the Service, including training move-recognition and review-quality models, and may keep it after your account closes. It is part of the Service, so it is not separately optional; you can object under section 13. Anything we publish from it is aggregated and identifies nobody.

6.2 Your video, audio and written comments: opt-in, off by default

We do not use any of it to train models unless you turn that on yourself.

• We ask at sign-up, as its own question, with nothing pre-selected. If you have not answered, the answer is no.
• Refusing costs you nothing. Every feature works the same either way.
• You can switch it off at any time in settings or by writing to buffup@derusty.com. That stops future use at once, and we remove your material from training sets at the next model build. It deletes nothing else.
• We will not sell it or share it with anyone for their own purposes.

No model is being trained today. If movement analysis ever produces data that could identify you biometrically, we will ask for separate explicit consent under GDPR Article 9 first.

6.3 Other people in your video

Your opt-in covers your own material only. A video containing another identifiable person stays out of training unless every such person has an account and has opted in.

7. Notifications

If you join the waitlist, we email you to confirm your address and, later, to invite you. Every one of those emails has a link to leave the list. Otherwise we only send emails about your account and your reviews: for example that your sign-up was approved, a Teacher declined or no Teacher was found, your feedback is ready, a deadline is coming up or has passed, or an invitation has ended. If you teach, we may also remind you what is left to finish on your profile before students can find you. You can turn those reminders off from the link in each one or in your account. There is no marketing email, newsletter or promotional content.

If you write to us with Tell us, your message comes to our mailbox with your name, email, role, the page you were on and your browser, so we can reply and look into what you describe. It is kept there and nowhere else in BuffUp. Transactional notifications are part of the Service; if you do not want them, close your account.

8. Who we share it with

We do not sell personal data, and do not share it for targeted advertising. We share it only with providers who process it on our behalf, under contract:

Stripe is also a controller in its own right for fraud prevention and its own legal obligations, so its privacy notice applies alongside this one.

We may also disclose data where legally required, to establish or defend legal claims, or to a successor if our business is transferred, in which case we will tell you first.

Teachers receive your video because you invited them, and the Teacher Agreement forbids them reusing, redistributing or training on it.

9. International transfers

We are a United States company, and your data is processed in the United States and on global delivery networks, whatever country you are in. Where GDPR or UK GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses (or the UK Addendum) in each provider's data processing agreement. Where the DPDP Act applies, transfers are made only to countries not restricted by the Central Government. Ask us for the safeguards behind any particular transfer.

10. How long we keep it

Every submission is erased within that window whether or not you ask. The clock runs from upload and never restarts. Nothing is deleted before 30 days, so you always have time to download your feedback. Within the window we may delete sooner only to manage storage cost. Your dashboard shows the date each submission is kept until, and the Teacher loses access at the same moment you do.

Removing and erasing are different. Removing takes a submission off your dashboard and leaves everything in place. Erasing destroys the content (video, voice notes, written comments) for you and your Teacher, straight away. You can erase one submission from your dashboard or everything from your account settings. What survives is the record without its content: status, which Teacher, when, and the numeric scores. Nothing in it identifies you.

Closing an account deletes your sign-in, removes your name, email and date of birth, and erases your uploaded content. Reviews remain without their content, and reviews you gave as a Teacher stay readable to the Students who received them as "Deleted account". Existing entries in our access log (section 13), which record the email address behind each action, cannot be rewritten and remain. After a closure the email address is free again.

11. Under-18s

The Service is for adults. You must be 18 or older to hold an account. We ask for your date of birth at sign-up, refuse accounts below 18, and do not knowingly collect data about anyone younger. We do not track, behaviourally monitor or advertise to anyone. If you believe someone under 18 has an account, or that footage of a minor has been uploaded, tell us at buffup@derusty.com.

12. Other people in your video

Under the Terms, the person uploading must have the agreement of everyone in the video. If you appear in a video someone else uploaded and want it removed, write to buffup@derusty.com. You do not need an account, and you have the same rights under section 13 as anyone else.

13. Your rights

Whichever country you are in, you can ask us to do any of the following. Some of these rights come from a particular law (GDPR, UK GDPR, the DPDP Act, or US state laws such as California's); we give them to everyone.

• Access: get a copy of your data and how we use it
• Correct: fix data that is wrong or incomplete
• Erase: erase your content yourself in your account settings, or ask us (section 10 says what survives)
• Take your data with you: every completed review has a Download link giving one file with the scores, comments and voice notes, which works offline and does not expire
• Restrict: limit how we use it while a dispute is resolved
• Object: to processing based on legitimate interests
• Port: receive your data in a machine-readable form
• Withdraw consent: for the training use in section 6.2, at any time
• Nominate (DPDP Act): name someone to exercise your rights if you die or become incapacitated
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. We do not make any.

Email buffup@derusty.com. We respond within 30 days, without charge unless a request is manifestly unfounded or excessive, and may need to verify who you are.

Who has opened your video. We keep a record, which nobody can edit or delete, of every time someone opens one of your submissions or downloads your feedback: who, what and when. Recent activity is in your account settings, and the full record is available on request. It covers access through the Service only; nothing can stop someone filming a screen.

14. How we protect it

Data travels over HTTPS and is encrypted at rest by our providers. Passwords never reach us. New accounts need manual approval, access is checked on every request, and video and voice notes are never reachable through a permanent public link. No system is perfectly secure, so please weigh that when deciding what to upload.

15. If something goes wrong

If a breach affects your personal data, we will notify you and the relevant authorities as the law where you live requires. In the US that means the state data-breach notification laws; under GDPR, the supervisory authority; and under the DPDP Act, every breach is reportable to the Data Protection Board of India and to each affected person.

16. Changes

We will post any update here and change the date below. For material changes we will give at least 30 days' notice by email or in the Service. We will never apply a new purpose to data we already hold without a fresh lawful basis, and where that basis is consent we will ask you again first.

17. Complaints

Talk to us first at buffup@derusty.com. You can also complain to:

• in the US, the Federal Trade Commission or your state attorney general;
• the Data Protection Board of India, under the DPDP Act;
• your local supervisory authority in the EEA, if GDPR applies to you;
• the Information Commissioner's Office, if you are in the UK.

Last updated: 1 November 2026. Version 2026-11-01.