Privacy Policy

2.1 When Visiting the Website (automatic)

Each time you access our platform, the following data is automatically collected:

• IP address (anonymized)
• Browser type and version
• Operating system
• Pages visited
• Date and time
• Language setting

2.2 During Registration

• Email address (required)
• Password (hashed)
• Name (optional)
• Profile picture (optional)
• Social media links (optional)

2.3 When Using an Organizer Profile

• Event details (title, description, date, etc.)
• Venue details (name, address, etc.)
• Images
• Public legal-entity information for provider identification: company or personal name, legal form, address, authorized representative, contact email and, where applicable, registration and VAT numbers
• Non-public contact information for cooperation with the Platform: name, role, email address and telephone number of the responsible contact person
• Location coordinates

2.4 For Subscription/Payment Transactions

• Stripe customer ID (internal, no access to full card data)
• Subscription status and term
• Invoice information (amount, date, status)

Organizers who use Stripe Connect additionally submit identity and bank data directly to Stripe (in accordance with the Stripe privacy policy).

2.5 When Using the Partynado App (iOS and Android)

The app uses the same account and the same servers as the website. In addition:

• Location (only if you choose "In der Nähe" (nearby) or "Nächste Stadt finden" (find nearest city) and allow access): the app determines your approximate location to show parties near you. The search is sent to our server without any link to your account. Only if you save a search with a location do we store the rounded centre point together with that search.
• Photos (only if you choose a profile picture): we receive only the one selected image, downscaled, as your profile picture. The app does not read any other photos.
• Calendar (only if you choose "In Kalender eintragen" (add to calendar)): the app creates the entry through the system calendar dialog. It does not read calendar entries and does not send any calendar data to us.
• Sign-in: the app stores a sign-in token in the protected storage of the device (iOS Keychain or Android Keystore). On our server we store the session with the platform (iOS or Android) and timestamps, so that you stay signed in and sessions can be ended.
• On the device: your tickets (for entry without an internet connection), recent search terms, the selected market and display settings. This data stays on the device; tickets are removed when you sign out, everything else at the latest when you delete the app.
• When you tap an organizer's ticket link, we count this click anonymously (without account and without IP address) for the organizer's statistics. The app contains no advertising or analytics SDKs and does not track you across other companies' apps or websites.
• Ticket purchases and external pages open in the system's in-app browser. The information on the website in this privacy policy (including cookies) or the privacy policy of the respective provider applies there.
• The app only asks for a permission when you first use the feature that needs it. You can revoke permissions at any time in the device settings; all other features remain available.

2.6 For Ticket Purchases, Reservations, Contact and Reports (Website and App)

• Ticket purchase: name, e-mail address and optionally phone number of the buyer, and the order (party, tickets, amount, status). Payment is processed by Stripe (see section 5).
• Ticket personalization (if required by the organizer): first and last name, date of birth, address, phone number and e-mail address of the ticket holder. The organizer of the party receives this information for entry control.
• Entry: time and result of the ticket scan.
• Table reservations: number of guests and optionally a message and phone number. The organizer or venue receives this information to handle the reservation.
• Contact form: subject, message, optionally your name, and the e-mail address of your account, to answer your request.
• Content reports and "Party fehlt?" (missing party): the content concerned, the reason, your description and your account for follow-up questions.
• Saved parties, followed organizers and venues, saved searches with e-mail alerts and the notifications in your account.

2.7 Event Discovery in ChatGPT

The Partynado plugin searches public events without a Partynado account. ChatGPT sends search parameters such as city, dates, music, budget, language and, if supplied, latitude and longitude to our server. We receive the tool parameters rather than the full chat transcript. The requesting service also sends network metadata, including its IP address and request headers.

We retain tool names, search parameters, timestamps, response times, result counts and errors in our application logs to operate the service, measure usage and investigate failures. Selected error excerpts are sent to our existing Discord operations channel and may include search parameters. The existing redaction removes credentials and email addresses but does not remove every search or location value. We do not sell this data.

The plugin and its event cards do not integrate Google Analytics or Google Tag Manager. Opening an event or attribution link visits a separate website; that website's privacy and cookie information applies. The event cards can retain results in ChatGPT widget state to restore the carousel when a conversation is reopened.

You can stop sending new searches by disconnecting the plugin in ChatGPT. To request access, correction or deletion of records held by us, use the privacy contact below and give the approximate time and search context so we can try to locate anonymous requests. ChatGPT conversation history and account controls are managed separately by OpenAI.

Note: The revised Swiss Data Protection Act (revDSG) does not have a conclusive catalog of legal bases like the GDPR. Processing is permissible if it is proportionate and the principles under Art. 6 revDSG are observed.

Cookies are small text files stored on your device that enable recognition. We keep individual entries in your browser's session storage instead; this storage is not transmitted to us and is cleared when you close the tab.

Necessary Cookies and Entries

Analytics Cookies (only with consent)

Hetzner Online GmbH (Hosting & Speicher)

We use Hetzner Online GmbH (Gunzenhausen, Germany) for web hosting (VPS) and object storage. All servers and storage services are located in the EU (Nuremberg data centre). No data transfer to third countries takes place. Privacy information: hetzner.com/legal/privacy-policy

ChatGPT, delivery security and operational alerts

OpenAI operates ChatGPT and receives our tool responses, including public event details and the search parameters needed by the event cards. Hetzner hosts our application, logs and images. Cloudflare handles request delivery and security, including network and security-event metadata. Discord receives selected operational error excerpts as described in section 2.7. These providers may process data outside Switzerland or the EEA; their privacy policies describe their own processing and controls.

Provider privacy information: OpenAI, Cloudflare, Discord

Google Tag Manager / Google Analytics

We use Google Tag Manager (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, USA) to manage analytics tags. GTM itself does not set a tracking cookie; the tags loaded via GTM are only activated after your explicit consent (Consent Mode v2).

• IP anonymization enabled
• No data shared with Google for advertising purposes
• Activation only after explicit consent (Google Consent Mode v2)

Opt-Out: tools.google.com/dlpage/gaoptout

Google Places API / Google Maps

We use the Google Places API and Google Maps Static API (Google LLC, USA) to search for and display venues. Search queries and IP addresses are transmitted to Google. Legal basis: legitimate interest in providing the location feature. Data transfer based on SCCs.

Resend (Email Delivery)

We use Resend, Inc. (USA) to send transactional emails (verification, notifications). Data transfer based on SCCs.

Stripe (Zahlungsabwicklung)

We use Stripe, Inc. (USA) and Stripe Payments Europe, Ltd. (Ireland) to process payments for paid subscriptions and ticket sales. During payment, payment data is transmitted directly to Stripe; we do not store complete card data. Organizers selling tickets via the Platform are onboarded via Stripe Connect. Data transfer based on SCCs. Privacy policy: stripe.com/privacy

Spotify API

We use the Spotify Web API (Spotify AB, Sweden) for artist information. Only public artist data is retrieved; no user data is transmitted.

Push-Benachrichtigungen

If you enable push notifications, we store the push endpoint generated by your browser (an anonymous browser URL) in our database on Hetzner servers in Germany. Processing is based on your explicit consent. You can disable push notifications at any time in your browser or in your account settings.

Notices about our app (Apple App Store)

On iPhones, Safari may show an app banner provided by Apple that points to our app. For this, our pages only contain a note in the source code (a meta tag). We do not load any content from Apple for it and receive no data through the banner. Safari decides whether the banner appears and retrieves the app details directly from Apple.

The App Store badges on our website are hosted on our own servers; displaying them transmits no data to Apple. Only when you tap a badge or a link to the App Store are you taken to the App Store of Apple Distribution International Ltd. (Ireland). Apple's privacy policy applies there.

Our links to the App Store and the app banner contain a campaign code. It only indicates through which placement you reached the App Store (e.g. the footer or the app banner) and contains no information about you. Apple provides us only with aggregated statistics that do not relate to any individual.

If you open one of our pages from within our iPhone app (for example when buying a ticket, or via the confirmation link after signing up in the app), the address contains the parameter client=app. Our website then stores the entry native-app-session with the value "1" in your browser's session storage so that we do not show you notices about the app while you are already using it. The entry contains no identifier, is not transmitted to us and is deleted when you close the tab. You can refuse this storage by blocking website data in your browser settings or by deleting the entry; the website remains fully usable. Legal basis: § 25(2) No. 2 TDDDG and Art. 45c(b) FMG.

• Right of Access: You can request information about what personal data we have stored about you.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your data, provided no legal retention obligations apply.
• Restriction of Processing: You can request restriction of processing.
• Data Portability: You can request that we provide your data in a structured, commonly used and machine-readable format.
• Right to Object: You can object to processing of your data when based on legitimate interest.
• Withdrawal of Consent: Granted consents can be revoked at any time with effect for the future.
• Right to Complain: You have the right to complain to the competent data protection supervisory authority.

To exercise your rights, please contact: [email protected]

• SSL/TLS encryption of data transmission
• Passwords are stored hashed (bcrypt)
• Role-based data access
• Regular software updates

The platform is not intended for persons under 16 years of age. We do not knowingly collect data from minors under 16.

We reserve the right to adapt this privacy policy as needed. For material changes, we will inform registered users by email. Material changes take effect no earlier than 14 days after notification.

For complaints, you can contact the competent data protection supervisory authority: