1. Who is responsible?
Festoq (Belgium) is the data controller. Contact: info.festoq@gmail.com.
We answer any request about your data within 30 days.
Festoq is a Belgian festival community. This policy explains what personal data we collect, why, how long we keep it and what your rights are under the GDPR.
2. What data do we collect?
Account data: email address, name or username, password (encrypted by our authentication provider).
Profile data: date of birth (to show your age and verify the minimum age), city, country, bio, profile photo, favourite genre and artist, liked festivals, concerts and artists.
Usage data: likes and passes, matches, chat messages, notifications and notification settings.
Technical data: your device push token (app only), error reports and security logs.
3. Why do we process it?
Performance of a contract (art. 6.1.b GDPR): your account, profile, matches and chat.
Legitimate interest (art. 6.1.f GDPR): safety, abuse prevention, moderation of reports and blocking accounts.
Consent (art. 6.1.a GDPR): push notifications and optional profile info such as your photo or bio. You can withdraw consent at any time.
Legal obligation (art. 6.1.c GDPR): where the law requires retention.
4. Who can see your data?
Other users only see your public profile: name, age, city, country, bio, photo, vibes, favourite genre and artist and the events you're going to. Your date of birth, email address and preferences stay private.
Chat messages are visible only to you and the person you're talking to.
Festoq administrators can review accounts and reports for moderation and safety.
5. Processors and transfers
Hosting, database, authentication and storage: Supabase (EU region) and Cloudflare.
Push notifications: Google Firebase Cloud Messaging (United States), only if you enable them. Transfers rely on the European Commission's Standard Contractual Clauses. Your message content is never sent: push notifications only contain the sender name and a neutral text.
AI assistance for importing festival and news data: no user personal data is processed there.
We never sell your data and do not use it for advertising profiling.
6. Retention
Account data: as long as your account exists.
Messages and matches: as long as your account exists or until you delete them.
Reports and blocks: up to 12 months after handling, for safety purposes.
After account deletion your data is erased immediately and permanently (see section 8).
7. Security
Data access is protected with row level security, so you can only read your own data.
Passwords are hashed and checked against known breaches. Sign-up is protected by a captcha against bots.
Profile photos are stored in a private bucket with temporary signed links.
8. Your rights
You have the right to access, rectify, erase, restrict, object and to data portability.
You can view and correct data in your profile, and delete everything via Profile → Delete account: profile, photo, messages, matches, likes, reports and push tokens are removed.
For a copy (export) of your data, email info.festoq@gmail.com.
You can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels.
9. Minors
Festoq is only available from age 16. We check your date of birth at sign-up and delete younger accounts when identified.
10. Changes
We may update this policy; important changes will be announced in the app or by email.