Subprocessors and cookies

Subprocessors

For the attendee list, the event organizer is the controller and PR & ARTS COMMUNICATIONS SRL is the processor. The providers below work for us and touch the data only to run the service.

• Contabo GmbH (Germany)

  What it does

  Hosts the server: the application, the database, the backups and the mail server.

  Where

  Germany (EU)

  What data it touches

  All data on the platform.

• Cloudflare, Inc. (USA)

  What it does

  Delivers the pages (CDN and proxy), stops attacks and runs the domain’s DNS.

  Where

  Global network. From Romania, requests usually enter through Frankfurt.

  What data it touches

  IP address and requests to the site, with their responses, while in transit.

Cloudflare is a US company. Its data processing addendum is part of its terms of service, and transfers to the US rely on the EU–US Data Privacy Framework.

Services the organizer chooses

These are not our providers. They only start if the organizer connects them, with their own account, and then data also passes through them:

• the ticketing platform attendees are imported from: Eventbrite, Oveit, iaBilet or Biletin;
• the organizer’s own mail server (SMTP), if their invitations go out through it;
• the addresses the organizer sends webhooks to or reads from with an API key;
• a YouTube (via youtube-nocookie.com) or Vimeo video on the event page: it loads from the visitor’s browser.

Where else data passes

• Emails go from our server straight to the recipient’s mail server (for example Gmail or Outlook), with no intermediary service.
• Push notifications pass through your browser’s push service (Google, Apple or Mozilla), with encrypted content.

What we don’t use

We don’t use external analytics, external error monitoring, bulk email services, external file storage, ads or trackers. Browser errors reach our own server, not a third party.

Cookies

We only set cookies that are strictly necessary or that remember a choice you made. None is used for ads or tracking, so we don’t ask for consent for them.

• Name: organizer_session

  What it’s for: Keeps you signed in to the organizer dashboard. Page scripts can’t read it (HttpOnly).

  How long it stays: Until you sign out, at most 30 days

• Name: participant_session_<event>

  What it’s for: Keeps you signed in to an event’s app. Page scripts can’t read it (HttpOnly).

  How long it stays: Until you sign out, at most 30 days

• Name: admin_session

  What it’s for: Platform team only, in the admin panel (HttpOnly).

  How long it stays: 12 hours

• Name: locale

  What it’s for: Your language (Romanian or English).

  How long it stays: 1 year

• Name: theme

  What it’s for: Your theme (light or dark).

  How long it stays: 1 year

What the app keeps on your device

To work without signal at the venue, the app keeps in your browser (local storage, IndexedDB and the service worker cache) the agenda, your QR code, the latest data you saw and actions taken offline, until they are sent. It also remembers small choices there: that you closed the cookie notice or an announcement, or your badge printing settings. This data never leaves your device, and you can clear it in your browser settings.