Privacy Policy

The controller responsible for data processing is AcroWorld, Caspar Baumeister, Gneisenaustraße 6a, 10961 Berlin, Germany, email info@acroworld.de ("we", "us").

• Account means a unique account created for you to access the Service.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service Provider means any natural or legal person who processes data on our behalf.
• Usage Data refers to data collected automatically when using the Service.
• Teacher means a user with a teacher, studio or organizer profile who publishes events and may sell tickets through the Service.

Our platform allows acrobatics teachers and organizers to publish events and offer tickets. We do not tolerate illegal, harmful, fraudulent or otherwise inappropriate activities. Not allowed are in particular: offering illegal products or services, uploading illegal, harmful, fraudulent, defamatory or copyrighted content, fraud, manipulation or deception. You can report content in the app.

Account data

When you create an account we process your email address, your name and, if you choose, a profile photo, short bio, acro role and level. You can sign in with email and password, with Sign in with Apple or with Google. With Apple or Google we receive your name and email address from that provider. Legal basis: performance of the contract for using the Service (Art. 6(1)(b) GDPR).

Teacher profiles and events

Teacher profiles (name, description, photos, location, social links) and published events are public and can be found by search engines. Teachers decide what they publish.

Bookings

When you book a ticket we process your name, email address, the selected event, date and ticket, the price, the payment method and your answers to the organizer's questions. The organizers of the event receive your name, email address and answers so they can run the event. If you book as a guest we create a passwordless account for your email address and send you a sign in link so you can access your tickets. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Organizers can ask questions when you book (for example about your experience, diet or injuries). Free text answers may contain health data, which is a special category of personal data (Art. 9 GDPR). We only use your answers to pass them to the organizer of the event so they can handle your booking. Before we share answers you give your explicit consent in the booking form (Art. 9(2)(a) and Art. 6(1)(a) GDPR). Answering optional questions is voluntary. You can withdraw your consent at any time for the future by writing to us; the organizer may then no longer be able to take your answers into account. Answers are kept together with the booking (see Retention).

Following events and profiles

We store which events and which teachers, studios and organizers you follow so we can show them in your plan and notify you about new dates, changes, cancellations and messages from the organizer. Follower lists are only visible to you and the organizers of the event or the owner of the profile.

Profile claims

If you claim a profile that AcroWorld created, we store your claim message together with your name and email so our team can check it. The claim is deleted with your account.

Location

If you use "near me" on the website, your browser asks for permission and the location is used only on your device to filter and sort events. It is not stored by us. In the app, location is used as described in the app permission dialog to show events near you; it is not used for advertising.

Teachers can choose to show where they are right now on the community world map. This is off by default. When it is on, we store only a coarse area (about 5 km, city level) and the time of the last update, never the exact position. It can be turned off at any time in the profile settings; the area is then deleted.

View statistics for organizers

When an event or profile page is opened we increase an anonymous daily counter for that page together with a rough traffic source (for example Instagram, Google, direct). No cookie, no user or device identifier is stored with it, so the counts cannot be linked to you (Art. 6(1)(f) GDPR, our and the organizers' interest in simple reach statistics). Only if you accepted analytics cookies we keep a small note in your browser's local storage so the same page is counted once per day; without consent nothing is stored on your device.

Usage and technical data

When you visit the Service our hosting provider processes technical data such as IP address, browser type, requested pages and time of the request to deliver the website and keep it secure (Art. 6(1)(f) GDPR).

Google Firebase

The Service runs on Google Firebase, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC (USA): Firebase Authentication (sign in), Cloud Firestore (database), Cloud Functions (server logic, region europe-west1, Belgium), Cloud Storage (images), Firebase Hosting (delivery of this website) and Firebase Cloud Messaging (push notifications in the app). We have concluded a data processing agreement with Google. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. More information: firebase.google.com/support/privacy.

Stripe

Card and other online payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Teachers who sell tickets have their own Stripe account (Stripe Connect); the payment goes to the teacher and we receive a platform fee. We do not store your card details. Stripe processes your payment data under its own privacy policy: stripe.com/privacy. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Email delivery

Transactional emails (booking confirmations, sign in links, invitations, notifications) are sent through the email servers of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, from info@acroworld.de.

Maps

Maps on the website load map tiles from OpenStreetMap (OpenStreetMap Foundation, UK). When a map is shown your browser connects to their tile servers, which receive your IP address.

Crash and error reports (app and website)

When the app or the website crashes or hits an error, it sends an error report to Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA): error message, stack trace, app version, device model or browser, operating system, the page or screen and the time. Reports contain no name, email or account ID, and the website sets no cookie and stores nothing on your device for this. Sentry does not store your IP address. We use them only to find and fix errors (Art. 6(1)(f) GDPR, our interest in a working app). Sentry processes the reports on our behalf under its data processing addendum, which includes the EU standard contractual clauses for the transfer to the USA. Reports are deleted after 90 days at the latest.

We use local storage in your browser for things that are needed to provide the Service: keeping you signed in (Firebase Authentication), your theme choice and your cookie choice. These do not need your consent (§ 25(2) TDDDG).

With your consent we use Google Analytics for Firebase (Google Analytics 4) to understand how the Service is used, for example which pages are viewed, searches, bookings started and completed. Analytics is only loaded after you click "Accept" in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google may process this data in the USA (EU-US Data Privacy Framework). You can withdraw your consent at any time in the Cookie settings.

The app asks for this consent the first time you open it. Without your consent no usage statistics are collected (collection is switched off in the app until you agree). You can change your choice at any time in the app under Profile, Settings, Usage statistics. With consent, Google Analytics for Firebase processes an app instance ID, your account ID (if you are signed in), the screens you open and actions such as searches, follows and bookings, the device model, operating system, app version and an approximate location derived from the IP address. We do not use this data for advertising and do not share it for advertising purposes.

The app can send push notifications (for example new bookings, booking confirmations, cancelled dates, invitations, reminders, new dates, changes or messages for events you follow, new events of people you follow). Some of these are also sent by email: new bookings, cancelled dates, changes, cancellations, organizer messages, invitations and decisions on profile claims. In your notification settings you can switch push and email off separately for each type, and you can disable push notifications in your device settings. To deliver push notifications we store a device token for each device you use (Firebase Cloud Messaging); it is deleted when you sign out or delete your account. Emails that are part of a booking (confirmation, cancellation, sign in link) are always sent, because they are needed to provide the service (Art. 6(1)(b) GDPR). Other notifications are based on our legitimate interest in keeping you informed about events you chose to follow (Art. 6(1)(f) GDPR).

We keep your personal data as long as your account exists. You can delete your account in your profile at any time (step by step: acroworld.net/delete-account). We then delete your profile, follows and profile claims. Bookings are kept in anonymized form (without your name and email) where they are needed for the organizers' and our accounting and legal obligations.

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18) and data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw a consent at any time with effect for the future (Art. 7(3)),
• lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

To exercise your rights write to info@acroworld.de.

We use encrypted connections (HTTPS) and access rules that limit who can read which data. No method of transmission or storage is completely secure, but we work hard to protect your data.

The Service does not address anyone under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child provided us with personal data, please contact us and we will delete it.

The Service may contain links to websites not operated by us, for example event websites of organizers. We have no control over their content or privacy practices.

We may update this Privacy Policy from time to time. The current version is always available on this page.