Privacy notice

Who is responsible

THE PRIVÉ is the controller of your personal data. Contact for privacy questions: info@jointheprive.com.

What we collect

Account data: your name, email address and password (stored only as a secure hash by our authentication provider).

Membership data: subscription status, renewal dates and payment history, received from Stripe. Card details are held by Stripe, not by us.

Your choices: saved events and the interests you select.

If you create a private calendar link: a one-way hash of the link (never the link itself) and when your calendar app last read it. Replacing or switching off the link deletes the old one.

Messages you send us, and newsletter subscriptions with the time and source of your consent and, if you leave, the time you unsubscribed.

If analytics is enabled: aggregate, cookie-free statistics about page visits and actions such as searching or saving an event. They do not identify you and never include what you type.

Why, and on what legal basis

To provide your account and membership (performance of a contract, Art. 6(1)(b) GDPR).

To send the newsletter (your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time with the unsubscribe link in every email).

To answer messages, prevent abuse and keep the service secure (our legitimate interests, Art. 6(1)(f) GDPR).

To keep invoices and payment records (legal obligation under tax law, Art. 6(1)(c) GDPR).

Who processes it for us

Supabase (database, authentication and file storage), with data hosted in the European Union (Frankfurt, Germany); Render Services, Inc., San Francisco, USA (website hosting); and Anthropic (AI-assisted research and news summaries, which receive no personal data). Stripe (payments), Resend (email) and our analytics provider are added when payments, email and analytics are switched on. Each acts on our instructions under a data processing agreement.

Some of these providers are based in, or use support staff in, the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

Images on event pages are served from our own storage, so viewing them does not send your data to the photographers or archives they come from. Links to news articles and official sites take you to third-party websites, whose own privacy policies apply.

Our event research and news summaries are AI-assisted. Only public information, such as organisers’ pages, headlines and publishers’ feed text, is sent to our AI provider (Anthropic). No personal data is sent.

We do not sell your personal data or use it for advertising.

How long we keep it

Account data for as long as your account is open; it is deleted within 30 days of closure.

Invoices and payment records for as long as Greek tax law requires.

Newsletter records for as long as you are subscribed, and the record of your consent and unsubscription for three years after, as proof.

Messages for up to two years after the conversation ends.

Security

Data is encrypted in transit, access to it is restricted by role and by database rules, and payment data never touches our servers.

Your rights

You can ask to access, correct, export or delete your data, to restrict or object to processing, and to withdraw consent at any time. Write to the privacy contact above; we answer within one month.

You may also complain to the Hellenic Data Protection Authority (dpa.gr) or to the data protection authority where you live.

Children

The service is not directed at children, and accounts require you to be at least 18.

Changes

If we change this notice in a way that affects you, we will tell members by email. The date at the top shows the latest version.