Privacy Policy

Last updated: 2026-10-04 · Version 0.1 (draft)

⚠️ This is an AI-generated draft, not legal advice. The text was drafted by an AI based on what the app actually does. It must be reviewed by a responsible person or external counsel before being published as a final policy. EventPulse takes no responsibility for the legal correctness of this text in its current form.

1. Who we are

EventPulse is a personal event agent delivered as an iOS and Android app, developed by [TODO: full company name and corporate ID]. The app helps users in the Stockholm region find concerts, exhibitions and other events based on their own taste.

Privacy contact: privacy@eventpulse.nu [TODO: confirm or update the e-mail].

2. What data we collect

2.1 Account data (when you create an account)

E-mail address (if you sign in via magic link).
Apple ID (if you sign in with Apple — we only receive a unique user id, not your e-mail, if you choose to hide it).
Auto-generated anonymous user id (if you use the app without signing in).

2.2 User-generated data

Events you save, tap on or mark as uninteresting.
Venues and artists you follow.
Push subscriptions (if you want notifications for specific venues).
Conversations you have with the app's built-in event agent.

2.3 Device and usage data

Device id hashed as a 64-character hex string (anonymous; cannot be traced back to you without our internal salt key).
Language preference.
Location (only if you have explicitly granted location access to the app — used to show events near you).

2.4 Anonymous statistics (only if you opt in)

The app has a separate opt-in toggle under Profile → Privacy. Statistics include events like tile_tap, event_view, event_save and similar. No personally identifiable information is included. Statistics are retained for up to 30 days.

3. Why we collect data and on what legal basis

Purpose	Data	Legal basis (GDPR Art. 6)
Provide the service (show events, save, follow venues)	Account data, user-generated data	Contract — you have created an account and we need the data for the service to function.
Push notifications	Push token, your follow choices	Consent — you enable push per venue.
Anonymous statistics	Event types per 2.4	Consent — separate opt-in toggle.
Security and debugging	Technical logs (no PII)	Legitimate interest — running a stable service.

4. How long we keep the data

Account data: as long as the account is active. Deleted within 30 days after account deletion.
User-generated data (saved events, follows, chats): tied to the account; deleted on account deletion via database cascade rules.
Anonymous statistics: 30 days, then automatically purged.
Push tokens: until you disable push for a venue or delete your account.

5. Who we share data with

We do not share your personal data with third parties for marketing. We use the following processors:

Supabase — authentication, database and file storage. Server region: [TODO: confirm the project is in the EU, preferably eu-north-1 Stockholm].
Expo / Apple Push Notification Service (APNs) — delivery of push notifications.
OpenAI / Anthropic / chosen LLM provider — agent chat. Only the text you write is sent, not account data. [TODO: list the current provider].

6. International transfers

Some processors may handle data outside the EU/EEA (notably US-based LLM providers). We ensure transfers use an appropriate legal mechanism (EU Commission standard contractual clauses or equivalent). [TODO: document the current mechanism per provider].

7. Your rights (GDPR Art. 15–22)

Right of access (Art. 15): You can request a copy of your data. In the app: Profile → Download my data [TODO: button coming in Phase 4].
Right to rectification (Art. 16): Contact us if something is wrong.
Right to erasure (Art. 17): In the app: Profile → Delete account. All account-bound data is deleted immediately via database cascades.
Right to restriction (Art. 18): Turn off statistics and/or push under Profile → Privacy.
Right to data portability (Art. 20): Same export button as Art. 15.
Right to object (Art. 21): Contact us.

8. How to exercise your rights

Directly in the app under Profile for the most common rights. For other requests, write to privacy@eventpulse.nu. We respond within 30 days per GDPR.

9. Cookies and tracking on the website

The eventpulse.nu website uses no cookies, no tracking pixels and no third-party scripts. No analytics tools are embedded. The site is entirely same-origin.

10. Changes to this policy

We may update this policy. For material changes, we notify you in the app. The latest update is shown at the top of this page.

11. Supervisory authority

If you believe we handle your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY) — imy.se/en/ — or your local data protection authority.