Privacy Policy

1. Personal data we collect

Account and sign-in data: your email address, account identifier, authentication provider, session information and the basic profile details provided during registration. If you sign in with Google or Facebook through Supabase, we receive the identity information made available by that provider under the permissions you grant, such as your name, email address and profile picture. Your Google or Facebook password is not shared with Toallya.

Profile information: the name, photos, biography, birth year or age, city, country, languages, dance styles, levels, dance roles, interests, availability and other optional details you choose to provide. Information you include in your profile or publications may be visible to other people according to the feature and available visibility settings. Avoid adding sensitive information or another person's personal data without permission.

Community activity: messages and their participants, timestamps and read status; published events and related images or links; favourites, agenda entries and participation; accommodation listings, reservation dates, guest details, requests and responses; and carpool listings, routes, seats, travel dates, requests and associated exchanges. We also process reports, blocks and information submitted to support or for verification when you use those features.

Location: the city and country you enter, and, only when you choose device-based nearby search and grant browser permission, your device location. The current nearby-search feature rounds the position to an approximate point and uses it in browser memory to find nearby results. Your browser may initially obtain a more precise position, including during a GPS retry. The approximate search point is not added to your public profile. You can instead search by city, clear the nearby filter and revoke location permission in your browser settings.

Technical information: IP address, browser and device information, request timestamps, authentication events, error records and delivery status needed to operate the service, troubleshoot problems and prevent abuse. The service and its providers may process these records. Cookies or browser storage support sign-in sessions, language choices and other functional preferences; clearing them may sign you out or reset preferences.

2. Google sign-in data

Toallya accesses only the Google identity data needed for sign-in and account creation: a Google account identifier and basic name, profile and email information, depending on the permissions you grant. We use this information to authenticate you, maintain your account and initialise your Toallya profile. Authentication and related account information are handled through Supabase; a name or photo used in your Toallya profile follows the visibility of that profile.

Toallya does not use Google user data for advertising and does not sell personal data. Google sign-in does not give Toallya access to your Gmail messages, Google Drive files, contacts or Google Calendar. Toallya's agenda is its own feature. You can revoke Toallya's access in your Google Account's third-party connections settings. Revoking access does not by itself delete information already held in your Toallya account; use the deletion procedure below for that.

3. Why we use data and the applicable legal bases

We use account, profile and activity data to provide the features you request: sign-in, finding dance partners and events, managing your agenda and favourites, communicating with members, and handling accommodation and carpool requests. Where applicable, this processing is necessary to perform our agreement with you or take steps you request before entering into it. Required account information is needed to create an account; optional profile fields and device location are not required to browse the public parts of the service.

We use relevant technical records and reports to protect accounts, moderate abuse, investigate errors and keep the service reliable. Where applicable, we rely on legitimate interests in operating and protecting Toallya and its community, balanced against your rights. We may process or retain information to comply with legal obligations or establish, exercise or defend legal claims.

Where consent is required, including for optional device location, we ask before processing. You may refuse or withdraw consent using the relevant feature or browser/provider settings, or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal. Granting a Google or Facebook permission does not mean you consent to unrelated uses of your information.

We send service emails, including authentication and activity notifications, to support your account and requested interactions. Resend is used for service notifications. Current new-message notification emails invite you to open Toallya rather than including the private message text; booking-related emails may contain details relevant to the request. Contact us about notification preferences where no in-app control is available.

4. Sharing and service providers

Other members receive information needed for the interactions you initiate, such as your visible profile, messages and accommodation or carpool requests. Event and listing details that you publish may be publicly accessible. Recipients can retain information you share with them independently of Toallya, so consider what you include in messages and listings.

Supabase provides authentication, databases and file storage. Google and Meta/Facebook provide their respective sign-in services. Resend processes recipient email addresses, notification content and delivery information to deliver service emails. Our hosting and infrastructure providers process website requests and the technical information needed to serve and secure the site. Providers' own privacy notices also explain their independent processing, where applicable.

If you choose to analyse an event flyer, its image is sent to OpenAI to extract event details. Analysis is optional and requires your explicit action. Toallya does not send your account identifier to OpenAI or store the analysis output as a separate record. The original flyer is stored with the event only when you publish. Analysis usage counters are retained for up to 30 days to limit abuse and costs. You can create an event manually without using this feature.

Authorised administrators may access information needed to provide support, handle reports and protect the service. We may disclose relevant information where required by law or necessary to address fraud, safety concerns or legal claims, subject to applicable law. We do not sell personal data or use Google sign-in data for advertising.

5. How long data is kept

Account and profile data are generally kept while your account remains active and the information is needed to provide the service. Messages, event activity, favourites, agenda entries, listings and requests are retained as needed to make those features available and handle related exchanges or disputes. The browser-based approximate search position is temporary and is not a permanent account location history.

Retention depends on the type of information, the purpose for which it is used, account or content deletion, security needs and applicable legal requirements. Some records may need to be retained after a deletion request for a legal obligation or a specific dispute. Backup copies and provider logs may persist until their applicable retention or replacement cycle ends. We do not promise immediate erasure from every backup or from copies independently kept by other members. You can ask us about retention for your information.

6. Security

Toallya uses HTTPS and provider-supported authentication and access controls to help protect data. Access is intended to be limited according to the needs of the service. No online service or method of storage is completely secure. Protect your sign-in credentials, sign out on shared devices and contact us if you suspect unauthorised access. Private messaging should not be understood as a promise of end-to-end encryption.

7. Your rights and choices

Depending on the law that applies to you, you may have rights to access and obtain a copy of your personal data, correct inaccurate information, request erasure, restrict processing, receive portable data, object to processing based on legitimate interests, and withdraw consent. These rights can be subject to legal conditions and exceptions. You can update available profile fields directly in Toallya and contact us for other requests, including if you cannot sign in.

We may need proportionate information to verify that a request concerns your account. Do not send passwords or unnecessary identity documents. We will address requests within the time limits required by applicable law and explain any applicable restriction. You may also complain to your competent data protection authority, including the authority in the EEA country where you live or work, or where you believe an infringement occurred.

8. Account and data deletion

To request deletion, email the contact below with the subject 'Toallya account deletion', preferably from the email address associated with your account. Identify the account and say whether you want the whole account or specific information deleted. If you no longer have access to that email address, explain this so we can arrange an appropriate verification step. You do not need to sign in to submit a request.

Account deletion is currently handled by the Toallya administration. After verification, we will handle deletion of the account and associated personal data, subject to the limited retention needs explained above, and explain any information that must remain. Signing out, deleting browser storage, withdrawing a booking request or disconnecting Google/Facebook alone does not delete your Toallya account. Deleting a Toallya account does not delete your Google or Facebook account.

9. Children and minors

Toallya's profile registration is designed for adults aged 18 and over. Its community features involve contact between members, events, accommodation and travel and are not intended for children. Do not submit a child's personal information. If you believe a minor has created an account or that a child's data has been submitted, contact us so we can investigate and take appropriate action, which may include removal of the information or account. The profile age selection is not a guarantee that every member's age has been independently verified.

10. International processing

Toallya's providers operate internationally, so information may be processed in countries other than your own, including outside the European Economic Area. Protection rules may differ between countries. Where applicable data protection law requires safeguards for a transfer, those safeguards may include an adequacy decision or contractual safeguards such as standard contractual clauses, depending on the provider and transfer. Contact us for information about the destinations and safeguards relevant to your data; this notice is not a claim that all data is stored in one country.

11. Changes to this policy

We may update this policy as Toallya, its providers or applicable requirements change. The date at the top identifies the latest revision. Material changes will be brought to users' attention through an appropriate channel when required, and additional consent will be sought where necessary. The current policy remains available at this public URL without signing in.

12. Contact

The operator responsible for Toallya's processing of personal data (the data controller) is Napo, operating Toallya at toallya.com.

For privacy questions, rights requests or account and data deletion, email Napo@toallya.com. Please use the subject “Toallya privacy request” or “Toallya account deletion” and include only the information needed to identify your account and explain your request.