Who we are
Festipal (“we”, “us”) is a festival memory-box app operated by [Operator name — to be completed], [Business address — to be completed]. For anything about your data, email privacy@festipal.app. We are the data controller for the personal data described here.
Operator name, address and ICO registration ([ICO registration number — to be completed]) are placeholders to be completed before public launch.
What we collect
We only collect what we need to run your boxes:
- Account — your email, a password (stored securely hashed, never in the clear), and optionally a display name, profile photo and a contact phone number you choose to add.
- Your boxes & content — festival names, dates and locations; photos and video clips you upload; bands you log; to-dos; travel and key-info notes; lineup “want to see” votes; and any expenses you record.
- Crew — who you invite and their role; invited email addresses until they join.
- Payments — handled by Stripe. We receive a record that you subscribed and your plan; we never see or store your full card details.
- Technical — device and push-notification identifiers, IP address, and basic logs needed for security and to keep the service working.
Why we use it (and our legal basis)
- To provide the service — creating boxes, inviting crew, developing photos, sending the emails and notifications you expect (basis: performance of our contract with you).
- To keep it safe and working — security, fraud prevention, fixing faults (basis: our legitimate interests).
- Optional notifications and marketing — only where you’ve agreed (basis: consent, which you can withdraw any time).
- Legal and accounting — keeping payment records (basis: legal obligation).
Who can see your content
The whole point of a box is that it’s shared with yourcrew, and no one else. People you invite to a box can see that box’s content (and, on the crew roster, each other’s name, photo and any contact number they’ve added). Boxes are private by default; a box is only viewable more widely if its holder switches it to “anyone with the link”. Undeveloped photos are never shown to anyone before the box develops.We don’t sell your data, and we don’t use your photos to train AI.
The services we share data with
We use trusted providers to run Festipal. Each only processes what it needs for its job:
- Supabase — Database, sign-in and file storage (your account, boxes, photos) (EU (Ireland) region). privacy
- Vercel — Website hosting and delivery (Global edge / USA). privacy
- Stripe — Payment processing (subscriptions). Card details go to Stripe, not us (USA / global). privacy
- Resend — Sending transactional email (sign-in links, invites, alerts) (USA). privacy
- Anthropic — AI features — researching a festival from its website, and writing your Wrapped/Roundup. The festival link and your in-app content for that feature are sent to Anthropic to generate the result (USA). privacy
- OneSignal — Push notifications to your devices (USA). privacy
- Cloudinary — Processing photos and video (e.g. the one-second film) (USA / EU). privacy
- OpenStreetMap (Nominatim) — Turning a place name into map coordinates for the meet-me map (EU). privacy
- Google Maps — Map previews and directions on the travel page (loaded when you view a place) (Global). privacy
Some of these are based outside the UK/EEA. Where data is transferred internationally we rely on appropriate safeguards (such as the UK International Data Transfer Agreement or equivalent contractual protections).
AI features
When a box holder asks us to fill a box in from a festival’s website, we send that link and the festival name to Anthropic (with web search) to research it. When we generate your end-of-festival Wrapped or Roundup, the relevant box content is sent to Anthropic to write it. We instruct our AI provider not to train on this content.
How long we keep it
We keep your account and boxes for as long as your account is open — a memory box is meant to last, year on year. You can delete content, or your whole account, at any time; ask us and we’ll erase it (we may keep minimal payment records where the law requires).
Your rights
Under UK data-protection law you can:
- ask for a copy of your data, or have it corrected;
- ask us to delete it, or to restrict or stop certain processing;
- ask for a portable copy, and withdraw any consent you’ve given;
- complain to the Information Commissioner’s Office (ico.org.uk) — though we’d hope you’d come to us first.
To exercise any of these, email privacy@festipal.app.
Children
Festipalis for adults — you must be 18 or over to create an account and hold a box. We don’t knowingly collect data from under-18s.
Security
Data is encrypted in transit, passwords are hashed, and access to your boxes is enforced at the database level so only your crew can reach your content. No system is perfect, but we take this seriously.
Cookies & changes
We use only the cookies needed to keep you signed in — see our Cookie Policy. If we change this policy we’ll update the date above and, for anything significant, let you know.