loading events…
Skip to content
events
Sign in DE

Privacy Policy

Last updated: October 2026

1. Data Controller

Rafael Alex
Ullsteinstraße 16
90763 Fürth
Germany

Email: events@rafaelalex.de

2. Collection and Processing of Personal Data

I collect and process personal data only to the extent necessary to provide my services.

2.1 During Registration

  • Name
  • Email address
  • Password (encrypted)

Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment).

2.2 When Using as a Guest

  • Name (voluntary)
  • Email address (required when added by organizer; used for invitation emails and reminders; guests without an account may also receive up to two follow-up emails about a free account)
  • RSVP status
  • Star rating (1–5) submitted after the event (voluntary; shared with the organizer in a summary email)
  • Dietary notes and allergies (voluntary, if requested by the organizer)
  • Companion details you add as a guest (name, optionally age for children)

Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment, event participation).

2.3 Social Login

When signing in via Google, Facebook, or Apple, I receive: name, email address, and profile picture URL (Apple does not provide a profile picture). I discard access tokens after authentication.

Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment). Provider privacy policies: Google, Meta/Facebook, Apple.

2.4 Push Notifications (optional)

If you enable push notifications, I store a technical subscription endpoint from your browser (not personal data, merely a random URL provided by your browser's push service) along with cryptographic keys for encrypting messages. In the native mobile app, push notifications are delivered via Firebase Cloud Messaging (FCM) (Google LLC). A device-specific token is transmitted to Firebase for this purpose. On iOS, messages are relayed through the Apple Push Notification Service (APNs) (Apple Inc.). Firebase processes data in accordance with Google's privacy policy. Apple processes data in accordance with Apple's privacy policy. I use this data exclusively to deliver push notifications. You can revoke it at any time in your notification settings. Legal basis: Art. 6 (1) lit. a GDPR (consent).

2.5 Mobile App (iOS and Android)

My service is available as a native iOS app (App Store) and Android app (Google Play). The following additional data processing applies: Contacts access: If you grant permission, the app can access your device contacts to simplify inviting guests. Contact data is used only for this purpose and is not stored on my servers. Camera and photo library access: If you grant permission, you can upload photos directly from the camera or photo library into an event. Photos are transferred to my servers only when you actively upload them. No tracking: The app uses neither App Tracking Transparency (iOS) nor Advertising ID (Android); there is no cross-platform tracking. Platform services: Google Play Services (Android, baseline functionality for push notifications) and Apple services (iOS, App Attest and push) process technical telemetry according to the respective providers' privacy policies. Legal basis: Art. 6 (1) lit. a GDPR (consent), Art. 6 (1) lit. b GDPR (contract performance).

2.6 Children's Events

For events that allow children as attendees or companions, including mixed events for adults and children, the child's name, optionally their age, and, depending on the organizer's settings, a parent's phone number and a pickup time may be collected. This data is used solely for organizing the respective event and is deleted when the event is removed. Data is entered by parents or the organizer, not by children themselves. Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment).

2.7 Secret Santa

If an organizer enables the Secret Santa module, the service randomly assigns who gifts whom. I store only the gifter-to-giftee assignment per event and any optional exclusion pairs (e.g. couples who should not draw each other). In Secret Santa mode, wishlist entries are automatically restricted so that only the assigned gifter can see the giftee's wishes, not the other guests. The assignment is communicated to guests via a personal link. The associated access token is stored solely as a SHA-256 hash; the plaintext exists only in the link that is sent. Re-running the draw invalidates all previous assignments and tokens. When the event or a guest is deleted, the related Secret Santa data is removed. Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment, participation in the event).

3. Cookies

I use only technically necessary cookies:

  • Session cookie: Authentication and CSRF protection (duration: 120 minutes)
  • XSRF-TOKEN: Cross-site request forgery protection (duration: session)
  • Guest token: Recognition of guests without an account (duration: 90 days)
  • Remember me: Optional persistent login when actively selected by the user (duration: 5 years)

Since only technically necessary cookies are used, no consent is required (§ 25 (2) TDDDG).

4. Payment Processing

For paid features, I use Stripe (Stripe, Inc.) as my payment processor. Stripe is certified under the EU-US Data Privacy Framework. When you make a purchase, Stripe collects and processes your payment data (credit card details, billing address) directly. I store only a Stripe customer ID and transaction references. Stripe processes data in accordance with their privacy policy. Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment). Event organizers who sell tickets connect their own Stripe Express account via Stripe Connect. In this process, Stripe collects the organizer's personal and banking details (name, IBAN/bank account, tax identification) directly as part of the Connect onboarding. I store only a Stripe Connect account ID, not the organizer's financial data. I do not delete this Stripe account when an account is deleted, because payouts and refunds may still run through it; the organizer can close it directly at Stripe, where Stripe's own retention and deletion rules apply. Guest payments for tickets are processed directly through the organizer's connected Stripe account; I receive only a platform fee. In the native mobile app, in-app purchases (event credits, Lifetime access) are processed through the respective app store (Apple App Store or Google Play). I use RevenueCat (RevenueCat, Inc., USA) to manage in-app purchases. RevenueCat is certified under the EU-US Data Privacy Framework. RevenueCat receives an anonymized app user ID and purchase receipts. Payment data is processed exclusively by the app store. Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment). More information: revenuecat.com/privacy. Organizers may alternatively provide a PayPal.Me username for ticket payments; guests are then directed to pay the organizer via PayPal. I store the username and an anonymizable link snapshot for each created ticket. Organizers may also store any external HTTPS payment or pool link with an optional label in the event settings. I store these details as part of the event settings. When guests open an external link, they leave the Service; the respective third party processes data generated by the visit and any payment under its own privacy policy. I neither process nor track these external payments. The organizer is responsible for the linked destination.

5. Email Delivery (Resend)

For sending emails (invitations, reminders, notifications, password reset), I use Resend (Resend, Inc., USA). Your email address, name, and message content are transmitted to Resend. Resend is certified under the EU-US Data Privacy Framework. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place. Legal basis: Art. 6 (1) lit. b GDPR (contract fulfillment) or Art. 6 (1) lit. f GDPR (legitimate interest in delivering notifications). More information: resend.com/legal/privacy-policy

Reply-To address on event mails: For invitations, reminders and notifications about an event, I set the organizer's personal email address as the Reply-To address. If a guest replies directly to such an email, the reply goes to the organizer rather than to me. This means the organizer's email address is visible to guests in their mail client. Organizers who would prefer not to share their personal address can sign up with a separate email address (for example an alias) instead.

6. Data Sharing and Processing

I share personal data with third parties only when necessary to provide my services. The following processors are used: email delivery (Resend), payment processing (Stripe), in-app purchase management (RevenueCat), push notifications (Firebase Cloud Messaging, Apple Push Notification Service), error monitoring (Sentry). Data processing agreements pursuant to Art. 28 GDPR are in place with all processors. For US-based service providers (Stripe, Resend, Sentry, Google/Firebase, RevenueCat), an adequate level of data protection is ensured through certification under the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs).

7. Data Deletion and Retention Periods

Registered users can delete their account and all associated data at any time in the account settings. Upon account deletion, personal data is immediately anonymized or deleted. The user's own events are removed permanently right away, including uploaded images. Photos the user uploaded to other people's events are deleted. Comments and reactions in other people's events remain without a name so conversations stay readable. Carpool rides, accommodation offers and requests the user posted in other people's events are deleted, as are the user's ride and stay requests, notifications, push subscriptions and API tokens. When an account is deleted, the operator also receives an internal notification: the email contains the name and email address of the deleted account and follows the retention of the operator's mailbox, the in-app notification contains only the name and is removed automatically 90 days after it has been read.

Retention periods at a glance:

  • Event data: when a host deletes an event, it is retained for 90 days and then permanently removed. On account deletion, the user's own events are removed immediately.
  • Guest data: anonymized upon account deletion. Removed are name, email and all voluntary extra details, meaning dietary notes and allergies, companion details, and for children's events the child's name, the parent's phone number and the pickup time
  • Payment data, including app store purchase receipts: 10 years (statutory retention obligation under German tax law), no longer linked to the account after account deletion
  • Server log files: 14 days
  • Error logs (Sentry): 90 days

8. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): You may request information about the data I process.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data, unless statutory retention obligations apply.
  • Right to restriction (Art. 18 GDPR): You may request restriction of processing.
  • Right to data portability (Art. 20 GDPR): You may request your data in a machine-readable format. This is available in your account settings under “Data Export”.
  • Right to object (Art. 21 GDPR): You may object to processing based on Art. 6 (1) lit. f (legitimate interest) at any time.
  • Right to withdraw consent (Art. 7 (3) GDPR): You may withdraw any given consent (e.g., push notifications, contacts access) at any time. The lawfulness of processing prior to withdrawal remains unaffected.
  • Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. Competent authority: Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

To exercise your rights, contact me at events@rafaelalex.de.

9. Automated Decision-Making

I do not use automated decision-making including profiling within the meaning of Art. 22 GDPR.

10. Web Analytics (Rybbit Analytics)

This application uses Rybbit Analytics, a privacy-friendly web analytics service, hosted on servers in Germany (instance operated by maki-it.de). Rybbit is completely cookieless and GDPR-compliant. No personal data is collected and no cookies are set. The analysis is fully anonymized without tracking individual users.

According to § 25 TDDDG (Telecommunications Digital Services Data Protection Act), no consent is required for this type of analysis.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in analyzing user behavior to optimize the application). More information: rybbit.io

11. Server Log Files

The hosting provider automatically collects information in server log files that your browser transmits with each page request: IP address, requested URL, date and time of access, HTTP status code, data volume transferred, referrer URL, browser type, and operating system. This data is used exclusively to ensure smooth operation and detect abuse. It is not merged with other data sources. Log files are automatically deleted after 14 days. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in operational security).

12. Error Monitoring (Sentry)

This application uses Sentry (Functional Software, Inc., USA) to detect and analyze technical errors. Sentry is certified under the EU-US Data Privacy Framework. When an application error occurs, technical data such as error messages, stack traces, and the requested URL are transmitted. Personal data (IP addresses, passwords, tokens, email addresses, names) is automatically stripped before transmission. Data is processed on EU servers (Frankfurt). Error logs are deleted after 90 days. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in operational stability and error resolution). More information: sentry.io/privacy

13. Location search and distance display (OpenStreetMap)

For location search and distance display, this application uses the Nominatim API provided by the OpenStreetMap Foundation (OSMF, United Kingdom: EU adequacy decision in place). This transmits the address entered for events, rides, and accommodations, and optionally the place named in a search request, never names. The request to Nominatim runs through my application server, so it is my server's IP address, not yours, that is transmitted to OSMF servers. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in providing location search and distance display). More information: osmfoundation.org/wiki/Privacy_Policy

14. Map tiles (OpenStreetMap)

When you open "Show on map" for a ride or accommodation, your browser loads map tiles directly from tile.openstreetmap.org (OpenStreetMap Foundation, United Kingdom: EU adequacy decision in place). This transmits your IP address and browser user agent to OSMF servers. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in providing a map view). More information: osmfoundation.org/wiki/Privacy_Policy

15. Hosting

This website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) on servers in the EU. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place. Data transmission is encrypted via HTTPS. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in reliable service delivery).