Privacy policy

Plaqat in brief

Plaqat is a service for discovering cultural events in Paris, available on the web (plaqat.app) and through its iOS mobile app. Browsing the catalogue is free and requires no account ; creating an account lets you sync your favourites across devices. This page describes, in plain language, what we collect, why, where the data is stored, and how you can delete it.

Plaqat complies with the General Data Protection Regulation (GDPR). The data controller is the publisher of Plaqat, reachable at salut@plaqat.app. Below you will find the list of our technical sub-processors and how long we keep your data.

What we collect

For anonymous visitors

If you have not created an account, Plaqat stores no personal data about you on its servers. Your display preferences (theme and language) are saved only in your browser's local storage, on your device. Vercel, our host, may temporarily keep your IP address in its technical logs, for security and abuse prevention.

For signed-in users

If you create an account, we store:

• Your email address (for passwordless sign-in).
• A username, once you choose one — used for your public, shareable Carnets.
• Your favourites (events and venues), to find them across your devices.
• Your Carnets (shareable event lists) and your notification subscriptions (new dates for the artists and venues you follow, box-office openings).

We never ask for your legal name, postal address, phone number or financial data.

Mobile app (iOS)

The mobile app requests certain permissions, always optional and triggered by the operating system ; you can decline or revoke them at any time in your phone's settings, without losing access to the rest of the service:

• Location— used only to centre the map on your position and sort events by proximity. Your location is processed on your device ; it is neither stored nor sent to our servers.
• Calendar — used only when you choose to add an event to your calendar. Plaqat does not read your other appointments.
• Notifications — if you enable them, a technical identifier (a push token) is stored so we can alert you to new dates for the artists and venues you follow and to box-office openings. Delivery goes through Apple (APNs). We never send marketing notifications without your consent.

The app contains no advertising tracker and uses no advertising identifier (IDFA). Usage analytics (PostHog EU) are never shared with third parties for advertising purposes.

Why we collect this data

We collect only the data needed to create and manage your account, save your favourites, and provide the notifications and other features you request. We do not use this data for advertising or sell it to third parties.

Notifications (optional). Alerts — new dates from the artists and venues you follow, box-office openings — are optional: you turn them on yourself and can disable them at any time in your settings. We send them only on the basis of that choice, never for marketing without your agreement.

Legal basis. Processing tied to your account is necessary to provide the service you request when you create and use an account (Art. 6(1)(b) GDPR). Turning on notifications and, on the web, analytics and mapping cookies rely on your consent (Art. 6(1)(a)), which you can withdraw at any time. Securing the service, preventing abuse and fraud, and keeping technical logs rest on our legitimate interests (Art. 6(1)(f)). Finally, we may process data where the law requires it (Art. 6(1)(c)).

Where your data is stored

Your data lives in Europe. Our database (Supabase) is hosted in Zürich, Switzerland, in a region deemed adequate by the European Commission for GDPR. Sign-in emails are sent from Resend, hosted in Ireland. Our code and web hosting run on Vercel; Vercel's technical logs pass through its servers in the United States, under the EU-US Data Privacy Framework.

How to delete your data

At any time, from your profile in Plaqat (“Delete my account”), you can permanently delete your account. Deletion is immediate and covers:

• Your email address and username.
• Your synced event, venue and artist favourites.
• Your Carnets, your notification subscriptions, and everything attached to your account.

You can also contact us to exercise your other GDPR rights: access, rectification, portability, objection, restriction of processing.

Recommendations and profiling

To suggest relevant events to you (the “For you” rail, “If you like…” suggestions), Plaqat analyses your favourites and interactions to estimate your tastes. This processing stays internal, is never shared for advertising, and produces no automated decision with a legal or similarly significant effect within the meaning of Article 22 GDPR — it merely ranks suggestions. You can always browse the whole catalogue without this personalised ranking.

Security

We put in place appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), access controls, and contractual commitments with our sub-processors. Authentication is passwordless (a link or code sent by email), which reduces the risks tied to password leaks. No system is infallible ; it is also up to you to keep access to your device and your inbox secure.

Data retention

Data tied to your account (email, username, favourites, Carnets, subscriptions) is kept for as long as your account is active. When you delete your account, it is erased immediately and permanently from our database: deletion removes, in a single operation, all of your favourites, Carnets, subscriptions, notification tokens and usage signals, along with your authentication account. Residual copies may remain briefly in our hosts' encrypted backups before being automatically overwritten, according to their backup cycles.

Our hosts' technical logs (IP addresses, for security) are kept for a short period in line with their respective policies. Anonymised audience measurements (PostHog) are kept in aggregate form for tracking visits. If you have no account, we keep no personal data : your preferences stay only on your device.

Cookies and trackers

Plaqat uses your browser's local storage (localStorage) to keep your sign-in session and your display preferences (theme and language).

Beyond these strictly necessary uses, Plaqat offers two optional services subject to your consent:

• Mapping (Mapbox) — the interactive map of events and venues. Tile requests pass through Mapbox servers (United States, standard contractual clauses).
• Usage analytics (PostHog EU) — audience measurement to improve the app. The data is hosted in Europe.

You can accept or decline these services via the banner shown on your first visit, and change your choices at any time from the “Cookies” link in the footer.

Vercel Speed Insights collects performance metrics (Core Web Vitals) without personal identification — this processing is necessary for the proper operation of the service.

Portability of your data

In accordance with Article 20 GDPR, you can export all of your data (profile, favourites, Carnets, preferences) as JSON. The download happens directly from your account settings, via the “Export my data” button.

Technical sub-processors

These are the third-party services through which part of your data may pass as part of Plaqat's operation:

This list is updated if we add a new service. If a change affects your data, we flag it clearly.

Children's data

Plaqat is not designed to be used by people under 15 (the age of digital consent in France). By creating an account, you confirm that you are at least 15. We do not knowingly collect data about minors. If you believe a minor has created an account, contact us and we will delete it.

Changes to this policy

If we change this policy materially, we will notify you by email at your next sign-in. The last-updated date is shown at the top of this page.

Contact us

For any question about your personal data, or to exercise a GDPR right, write to salut@plaqat.app. We will reply within one month at most, in accordance with the GDPR.

If you believe your rights are not being respected, you may also lodge a complaint with the CNIL, the French data-protection authority: cnil.fr.