Privacy Policy

1. Introduction

Welcome to Croovoo. Croovoo is operated by RnB Ventures LLC (“we,” “us,” or “our”). We build tools for dance creators to design, visualize, and share formations.

This Privacy Policy explains what information we collect when you use Croovoo (the “Service”), how we use and protect it, and what rights you have over it. By creating an account or using the Service, you agree to this Privacy Policy.

If you do not agree, please do not use the Service.

2. Who This Policy Applies To

This policy applies to all users of Croovoo, including visitors to our website and anyone who creates an account. You must be at least 13 years old to use Croovoo. If you are under 18, you should review this policy with a parent or guardian.

3. Information We Collect

3.1 Account and Profile Information

When you register, we collect:

• Your name and email address
• Your password (stored in hashed form — we never see your plaintext password)
• Profile information you choose to add (e.g., display name, profile photo)
• If you sign up or log in with Google, we receive your name, email address, and profile picture from Google as permitted by your Google account settings

3.2 Content You Create

When you use Croovoo to build and manage dance formations, we collect and store:

• Formation data you create (dancer positions, labels, layouts, sequences)
• Performance and routine structures you build within the Service
• Audio files you upload to use as accompaniment to your formations
• Any notes, titles, or descriptions you add to your projects

Your content is private by default. It is not visible to other users unless you explicitly share it.

3.3 Payment Information

If you subscribe to a paid plan, payments are processed by Stripe. We do not store your full credit card number, CVV, or other sensitive payment details — Stripe handles this directly. We receive and store:

• Your subscription status and plan tier
• A Stripe customer ID
• Transaction history (amounts, dates, plan changes)

3.4 Usage and Analytics Data

We use PostHog to understand how people use Croovoo so we can improve it. PostHog may collect:

• Pages and features you visit or interact with
• Clicks, navigation patterns, and session duration
• Device type, operating system, and browser
• IP address (used for approximate geolocation and fraud prevention)
• An anonymized or pseudonymous user identifier

We use this data in aggregate and to diagnose issues. We do not sell analytics data.

3.5 Technical and Log Data

Our hosting and infrastructure providers (our application is hosted on Vercel, with data stored on Supabase) automatically collect:

• Log data (server requests, error logs, timestamps)
• IP addresses
• Authentication events (logins, logouts, failed attempts)

3.6 Waitlist and Feedback

If you join our waitlist or send us feedback, we collect your email address, the content of your message, and limited technical signals (such as your IP address) that we use to deliver the requested follow-up and to prevent spam and abuse.

4. How We Use Your Information

We use the information we collect to:

• Provide the Service — create and manage your account, store your formations and audio, and deliver the features you use
• Process payments — manage subscriptions and billing through Stripe
• Improve the product — analyze usage patterns via PostHog to understand what’s working and what needs fixing
• Communicate with you — send service-related emails (account confirmations, billing receipts, security alerts). We do not send marketing emails without your consent.
• Ensure security — detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations — respond to lawful requests from authorities where required

We do not use your content (formations, audio, or project data) to train AI models or for any purpose beyond delivering the Service to you.

5. How We Share Your Information

We do not sell your personal data. We share information only in these limited circumstances:

Service providers (sub-processors):

• Supabase — our database and file storage provider. Your data is stored on Supabase’s infrastructure.
• Stripe — payment processing. Stripe is subject to its own privacy policy and PCI DSS compliance.
• PostHog — product analytics. PostHog may process usage data as described in Section 3.4.
• Google — if you use Google Sign-In, your authentication is handled by Google per Google’s Privacy Policy.
• Vercel — application hosting and infrastructure; processes requests and related log/technical data.
• Liveblocks — real-time collaboration; stores live formation/editor state and collaborator presence so you can work together.
• Resend — delivery of service-related (transactional) email such as account, billing, and security messages.
• Loops — product and marketing email, sent only where you have opted in.
• Sentry — error monitoring and diagnostics, which may include IP address and device data.
• Cloudflare — bot detection and abuse prevention.

We may add or change sub-processors as the Service evolves, using providers of similar standing for hosting, storage, email delivery, analytics, error monitoring, and security.

Legal requirements: We may disclose your information if required by law, court order, or to protect the rights, property, or safety of RnB Ventures LLC, our users, or others.

Business transfers: If RnB Ventures LLC is acquired, merges with another company, or transfers assets, your information may be transferred as part of that transaction. We will notify you before any such transfer takes effect and before your data becomes subject to a materially different privacy policy.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account:

• Your profile and account data will be deleted within 30 days
• Your formation and audio content will be deleted within 30 days
• Billing records may be retained for up to 7 years as required by applicable tax and accounting laws
• Anonymized, aggregated analytics data may be retained indefinitely as it cannot be used to identify you

7. Your Rights

7.1 All Users

Regardless of where you live, you can:

• Access — request a copy of the personal data we hold about you
• Correct — update inaccurate information in your account settings or by contacting us
• Delete — request deletion of your account and associated data
• Export — request a portable copy of your content

7.2 EU/EEA and UK Users (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, you have additional rights under the GDPR:

• Right to object — to processing based on legitimate interests
• Right to restrict processing — in certain circumstances
• Right to withdraw consent — where processing is based on consent
• Right to lodge a complaint — with your local data protection authority

Our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (security, analytics, fraud prevention), legal obligation, and consent (where applicable, such as marketing communications).

7.3 California Users (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, or sell
• Delete your personal information (subject to certain exceptions)
• Opt out of the sale or sharing of personal information — we do not sell or share your personal information
• Non-discrimination for exercising your rights

To exercise any of these rights, contact us at hello@croovoo.com. We will respond within 45 days (CCPA) or 30 days (GDPR).

8. Children’s Privacy

Croovoo is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If we discover that a child under 13 has created an account, we will delete the account and associated data promptly.

If you believe a child under 13 has provided us with personal information, please contact us at hello@croovoo.com.

Users between 13 and 18 should use Croovoo with the knowledge and consent of a parent or guardian.

Croovoo is built for dance teams, and choreographers may enter the names or labels of dancers — including dancers under 18 — into rosters and formations. If you add a minor’s information, you represent that you are authorized to do so and are responsible for obtaining any consent required from the dancer’s parent or guardian.

9. Data Security

We take reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest (via Supabase)
• Hashed password storage
• Access controls limiting who within RnB Ventures LLC can access user data

No security system is perfect. In the event of a data breach that affects your rights or freedoms, we will notify affected users and relevant authorities as required by applicable law.

10. International Data Transfers

RnB Ventures LLC is based in the United States. If you access Croovoo from outside the US, your data may be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For users in the EU/EEA/UK, where required, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) to ensure your data is protected when transferred internationally.

11. Third-Party Links and Services

Croovoo may contain links to third-party websites or integrate with third-party services (such as Google). This Privacy Policy does not cover those third parties. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice within the Service at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions, data requests, or to exercise your rights, contact us at:

RnB Ventures LLC (Croovoo)
Email: hello@croovoo.com

For EU/EEA users, you also have the right to contact your local data protection authority.