Privacy Policy

1. Data controller

Antonio Tubito, a self-employed professional operating WhatsThePlan ("WTP"), is the service provider and data controller for the processing described in this policy. Address: Rua do Poço dos Negros 150, Apt. 122, 1200-334 Lisbon, Portugal. Contact: hello@whatstheplan.club.

2. Data and sources

Account and profile data: Information you provide when registering, completing a profile or using a feature, such as name, email, city, age or birth-date information, Instagram handle and phone number. The fields requested depend on the feature; they are not all collected at initial signup.

Participation data: Applications, invitations, responses, event assignments, submitted work and proofs, follower counts, tracked-link and promo-code results, reported sales or attendance, rewards and access requests. These may come from you, an authorized Curator, event operations or a supported ticketing import/integration. A recorded result is not necessarily independently verified.

Contact and table data: Names and contact details added by a user, permission declarations, table requests and contact details voluntarily shared within a connection. The person adding someone else’s details must inform that person and obtain permission for the intended use.

Technical and operational data: Service requests, timestamps, account and event identifiers, error messages and diagnostic context may be processed to operate, secure and troubleshoot the service. Hosting and authentication providers may also process network and device information, including IP addresses. A claim about one WTP log does not cover every provider log.

Email activity: Recipient address, subject, purpose, related account or event, sending attempts and provider delivery outcomes. Where enabled by the email provider, WTP can also receive opening or clicking signals with timestamps. These signals depend on email software and do not prove that a person read a message.

Payment data: Where Stripe is used, it processes payment details. WTP records relevant transaction references, amounts and statuses; its payment integration does not store full card numbers.

Document and preference records: Document versions, acceptance or acknowledgement times, entry points, optional preference changes and event-access notice evidence are recorded separately.

3. Purposes and legal bases

Contract and requested pre-contractual steps: Processing objectively necessary to provide the service or handle the participation, access or other request you make. Including a processing activity in these Terms does not by itself make it necessary for a contract.

Consent: Optional attribution cookies, optional profile or audience sharing and marketing communications where consent is required. These choices are separate from accepting the Terms or acknowledging this policy. The account holder’s consent does not replace permission from a person whose details they add.

Legitimate interests: Service security, fraud and abuse prevention, necessary operational diagnostics and keeping evidence to handle disputes, where those interests are not overridden by your rights. This is not a blanket basis for optional tracking or unrelated marketing.

Legal obligations: Records or disclosures required by applicable law, where such an obligation applies. The specific basis must correspond to the actual processing; a privacy acknowledgement does not create a new legal basis.

4. Participation, attribution and reports

WTP uses participation information to review requests, coordinate assigned teams and access, communicate event updates and report the activity and outcomes recorded for the relevant event. Individual review and aggregate reporting follow the permissions of each workspace.

Declining an invitation records a response; it is not acceptance of a place or consent to optional data uses. With optional cookie permission, WTP may record tracked-link clicks and retain a supporter/event attribution cookie for up to 30 days. These click records use a hash of the user-agent value rather than a raw IP field; hashing does not make the records anonymous.

With optional cookie permission, an invitation cookie can retain inviter/event identifiers for up to 90 days. If a later signup is attributed to that invitation, WTP records the relationship and may notify the inviter that you joined, using your first name. A separate event invitation or application is still needed where the participation flow requires it.

5. Audiences and event-entry sharing

Organizer reports provide the aggregate team and event results permitted for that workspace. Private supporter profiles, proofs, internal assessments and imported contact lists are not opened to organizers by accepting these documents. WTP and an authorized managing Curator retain the access needed for their assigned functions.

For a requested guestlist or backstage accreditation, WTP may hand off the guest name, event, access category and request status to the relevant organizer, venue or authorized accreditation staff only as needed to process entry. The event notice is shown before confirmation. This limited handoff is separate from access to a supporter profile.

Optional discovery profiles and audience aggregates follow their separate sharing choices. Table participants may choose to share contact details within their connection. Public posts, profile material you make public and information you send outside WTP can be visible independently of the private workspace permissions. Withdrawing a sharing choice stops the relevant future WTP sharing; it cannot recall an earlier download or screenshot.

6. Service providers and external services

WTP uses Supabase for database, authentication and storage, Netlify for hosting and server operations, Resend for email and Stripe where payments are processed. Meta receives the content submitted through the Instagram publishing integration described below. Where enabled, Firecrawl and Anthropic process source URLs and event-page content for event discovery and information extraction.

An external ticketing service receives the information you submit to it under its own privacy notice. The limited organizer, venue or accreditation handoff is described in section 5. Recipients may have their own responsibilities for the processing they perform.

Provider locations and international-transfer arrangements depend on the services and account configurations in use. Contact hello@whatstheplan.club for information about the recipients, relevant transfers and applicable safeguards. This policy does not claim that all processing takes place in the European Economic Area.

7. Your rights and choices

Depending on the circumstances and applicable law, you may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. You can withdraw an optional consent without affecting the lawfulness of processing based on it before withdrawal. Refusing optional choices does not itself refuse the Terms.

Use Privacy requests in Account Settings or email hello@whatstheplan.club. WTP may need to verify your identity before acting on a request and will explain any applicable limitation. You may lodge a complaint with the Portuguese authority, CNPD, or another competent supervisory authority.

CNPD: https://www.cnpd.pt/

8. Retention and deletion

You can request account closure and deletion of associated personal data in Account Settings or by emailing hello@whatstheplan.club. You can stop participating while the request is handled, and you do not have to accept new participation terms to make a deletion request. Submitting the request does not itself complete deletion; WTP reviews the associated account records, files and relevant service providers.

Personal data that is no longer needed for a lawful purpose must be erased. Limited records may need to be retained for a specific legal obligation or to establish, exercise or defend a legal claim. WTP explains any retained categories, reason and applicable period or criteria. This is not permission to keep the whole account indefinitely or continue unrelated marketing.

Retention otherwise depends on the category and actual purpose of the record, such as an active service request, an event or payment being completed, or a documented unresolved dispute. A cookie’s expiry does not automatically delete related server-side attribution records. Contact WTP for the retention criteria applicable to a particular record.

Account Settings — leave WTP: /account/settings#leave-wtp

9. Cookies

Optional cookie choices are separate from acceptance of these documents. See the Cookie Policy for purposes, durations and how to change your choice.

Cookie Policy: /legal/cookies

10. WTP Instagram publishing

An authorized WTP administrator may connect the WTP professional Instagram account through Meta. Depending on the login flow, this includes reading the administrator’s managed Facebook Pages to identify the linked professional account. WTP stores the connected account ID, username, connection dates and an encrypted access token to discover supported public organizer content and publish content selected by WTP using the approved permissions.

For event promotion we store selected source links, public organizer usernames, captions, media files, reuse permissions, scheduled publications and publication results. Originals are held in private storage until shared through an approved publication. Supabase and Netlify process this information to operate the service; Meta receives the selected media and caption when WTP publishes. The integration does not read private messages or request advertising or comment-management access.

Connecting an account or listing an event does not grant permission to reuse an organizer’s content. Reuse is recorded separately for the selected content, channels and audio. A WTP administrator can disconnect Instagram in the publishing workspace; this removes the stored account token and pauses pending automatic posts. It does not remove posts already published on Instagram.

To request deletion of Instagram connection data or stored organizer content, email hello@whatstheplan.club with the account or event and source links concerned. We verify the request, stop affected pending uses and review deletion and any necessary removal of published posts. Content and operational records are kept only for their event-promotion purpose; permission and publication evidence may be retained where needed to document prior authorized use or resolve a dispute. Deletion requests are handled under section 7.

11. Contact

For privacy inquiries: hello@whatstheplan.club

12. Supporter applications, access requests and acceptance records

WTP and the authorized managing Curator use application and profile information to review a supporter request and coordinate event participation. For a requested guestlist or backstage accreditation, the limited operational handoff consists of the guest name, event, access category and request status, only where needed by that event’s organizer, venue or authorized accreditation staff to process entry. This does not grant access to supporter profiles, private proofs, internal assessments or imported contacts, or permission for unrelated marketing. Processing strictly necessary to handle the participation or access request relies on contractual necessity, including steps requested before participation; acknowledging this notice is not consent to optional uses. An external ticketing service processes information you submit there under its own notice. WTP records the account, document version, time and entry point of terms acceptance and privacy acknowledgement separately, and retains event-access notice evidence with the request. These records are used to administer participation and document the information provided; retention and privacy requests follow sections 7 and 8. Marketing, non-essential cookies and optional profile sharing remain separate choices. Contact hello@whatstheplan.club with questions or to exercise your rights.