Privacy Policy

The controllers of your personal data are Minna Jylhä, Markus Hirvonen, and Olli Paananen, who together operate the YODS online dance studio. Membership payments are invoiced by Majestic Rugged and Wild Oy (business ID 3474761-2). For any privacy question, email privacy@dancewithyods.com.

• Account: name, email and password (stored hashed).
• Your dancing: what you tell us in your profile, your Dancer’s Path, journal and practice plans, your ratings and comments, and what you watch.
• Your videos: the videos you add to your library and your coach’s analyses of them.
• Subscription: your Stripe customer ID and subscription status.
• Technical: your IP address when you sign in or register, to prevent abuse.

• Contract (GDPR art. 6(1)(b)): running your account, delivering lessons, billing, showing your progress.
• Legitimate interest (art. 6(1)(f)): preventing abuse (rate limiting, verification), keeping the service secure.
• Legitimate interest (art. 6(1)(f)): sending you occasional emails about YODS: news, updates, and information relevant to your membership. Every such email has an unsubscribe link and you can opt out at any time.
• Legitimate interest (art. 6(1)(f)): improving our AI coaches. We make a copy of the videos in your library with faces blurred and sound removed, keep it separate from your account, and use it to help our coaches understand dance movement better. The copies are kept private and never published.
• Consent (art. 6(1)(a)): publishing your feedback on the site (when you tick the public option).
• Legal obligation (art. 6(1)(c)): keeping invoice records required by accounting law.

Processors used:

• Hosting and storage: the providers that run the service and store your content (EU, or US under Standard Contractual Clauses / the EU–US Data Privacy Framework).
• Email: a provider that sends your account emails and newsletters (EU).
• Google Analytics: usage statistics, only with your consent.
• Stripe: payments.
• Google Gemini: runs your AI coach. What you say and show to your coach, the videos you send for analysis and the text you write are processed by it (US, SCCs).
• OpenAI: the coach’s search of our own lessons. It receives only the search phrase (US, SCCs).

Some of our providers, including Stripe, Google and OpenAI plus certain infrastructure providers, process data in the United States under Standard Contractual Clauses and / or the EU–US Data Privacy Framework.

• Account data: while your account is active, and up to 30 days after you delete it. Deleting your account leaves one anonymous statistics row behind: the month you joined, how long you stayed, whether you ever paid, where you signed up from, and the reasons you picked on the way out if you picked any. Nothing in it identifies you, and it is never linked back to you. If you write us a few words as you leave, they reach the team as a message and are not kept with your account or with that row.
• What your coach saves about your dancing (your level, recurring focus areas, goals you mention, the summary of your journal): the same. To access or erase specific notes without closing your account, email privacy@dancewithyods.com.
• Coach session diagnostics (when a session connected, how long replies took, whether it dropped): 60 days, so we can find and fix faults. No recording, no transcript.
• Blurred copies: kept for as long as they help us improve the coaches. They aren’t connected to your account, so they stay when you delete a video or your account. If you’d rather we didn’t make copies of your future videos, just email privacy@dancewithyods.com.
• Invoice records: 6 years, per Finnish accounting law.
• Rate-limit records: up to 24 hours.

Under GDPR you have the right to:

• access a copy of your data
• correct inaccurate data
• delete your account and personal data
• receive your data in a portable format
• object to processing based on legitimate interest
• lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To use any of these rights, email privacy@dancewithyods.com.

Strictly necessary: session cookie + CSRF token. Required for the service.

Analytics (consent required): Google Analytics 4 loads only if you click “Accept” on the cookie banner. GA sets _ga / _ga_* cookies. Clear site data to re-prompt.

The “Last updated” date at the top reflects the current version.