Privacy Policy

Last updated: 9 July 2026

DNBSTEP OÜ (registry code 17039029, Estonia) operates the dnb-step community platform at dnb-step.com and is the controller of the personal data described here. Privacy questions and requests: hello@dnb-step.com.

The short version: we collect what is needed to run a dance community — your account, what you choose to put on your profile, your bookings and payments. We do not run advertising, we do not use analytics trackers, and we do not sell data to anyone.

What we collect

• Account — email address, username, and a hashed password, held in our self-hosted sign-in service (auth.dnb-step.com). If you sign in with Google, Google shares your name and email address with us.
• Profile — whatever you add to your dancer profile: display name, photo, cover image, city and country, experience level, dance styles, social media links, music taste. All of it is optional and public.
• Content — videos you link or upload, events, meetups, training locations, comments, and challenge entries. Also public.
• Messages — private messages you exchange with other users, stored so we can deliver and show them. Private between the participants.
• Lessons and courses — booking requests, agreed lesson times, course registrations, prices, and payment status. Card details go directly to our payment provider Stripe and never reach our servers; we store the amount, currency, payment status, and Stripe’s reference IDs.
• Notifications — in-app notifications, and if you switch on push notifications, the push subscription your browser generates (an endpoint URL and keys).
• Technical logs — IP address, browser type, and timestamps in server logs, kept briefly for security and debugging. We build no profiles from them.

Why, and on what legal basis

• Running the platform — accounts, profiles, content, messages, bookings, payments, and the emails they generate (booking confirmations, course info): performance of a contract (GDPR art. 6(1)(b)).
• Keeping payment records — Estonian accounting law requires us to keep transaction records for 7 years: legal obligation (art. 6(1)(c)).
• Security and abuse prevention — logs and technical safeguards: legitimate interest (art. 6(1)(f)).
• Push notifications — only with your consent (art. 6(1)(a)), which you can withdraw any time on the notifications page or in your browser settings.

We do not send marketing emails without asking you first.

Who else touches your data

The platform runs on our own servers on Google Cloud in the EU (Netherlands region), and sign-in (auth.dnb-step.com) and comments (comments.dnb-step.com) are self-hosted there too. Beyond that, data reaches a third party only where a feature needs it:

• Stripe (Stripe Payments Europe, Ltd.) processes card payments and trainer payouts. Stripe may transfer data to Stripe, Inc. in the US under EU standard contractual clauses — Stripe’s privacy policy.
• AS LHV Pank processes bank-link payments where you choose that option for a course.
• Google — we send emails through Google Workspace, and confirmed lessons and course sessions create Google Calendar invites (your email address and the agreed time) with Google Meet links where the lesson is online.
• Zoom — some online course sessions run on Zoom; joining one shares your display name (and camera/mic, if you turn them on) with Zoom.
• Browser push services — push notifications are delivered through your browser vendor’s push service (Google, Mozilla, or Apple, depending on your browser).

Embedded videos: videos on dnb-step are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com) and from Vimeo in Do-Not-Track mode, so they set no tracking cookies before you press play. Video thumbnails load from YouTube’s servers. Once you press play, you are connecting to YouTube or Vimeo and their privacy policies apply.

We do not sell personal data, and there are no ad networks or third-party analytics on the site.

What is public

Dancer profiles, videos, events, meetups, training locations, comments, and challenge entries are public pages — anyone can see them and search engines can index them. Your email address, private messages, bookings, and payment details are not public. Post only what you are comfortable sharing with the internet.

How long we keep things

• Account, profile, and content — until you delete them or your account.
• Payment and accounting records — 7 years (Estonian Accounting Act).
• Server logs — a short rolling window.
• Backups — deleted data can persist in backups for a limited period before rotating out.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, take it with you (portability), and withdraw any consent. Email hello@dnb-step.com — including to delete your account — and we will respond within a month. If you are not happy with how we handle it, you can complain to the Estonian Data Protection Inspectorate (aki.ee) or the supervisory authority in your own country.

Cookies

We use only cookies the site needs to work — no advertising or analytics cookies, no tracking. That is why there is no cookie banner: EU rules require consent only for cookies that are not essential, and we set none of those.

During payment you are on Stripe’s own checkout pages, where Stripe sets its own cookies for fraud prevention. The site also keeps a few purely functional items in your browser’s local storage — cached background images, event bookmarks, and choreography drafts — which stay on your device and are not tracking. You can clear cookies and site data in your browser settings at any time; doing so signs you out.

Children

dnb-step is not directed at children under 13. If you believe a child has created an account, contact us and we will remove it.

Changes

If we change this policy in a meaningful way, we will announce it on the site. The date at the top shows when it was last revised. See also the Terms of Service.