Privacy Policy
Last updated: August 2026
1. Data Controller
WhatsThePlan ("WTP", "we", "us") is the data controller for personal data processed through whatstheplan.club. Contact: privacy@whatstheplan.club
2. Data We Collect
Account data: Name, email, city, age, Instagram handle, WhatsApp number (provided at registration).
Usage data: Pages visited, actions taken, IP address, device type, browser (collected automatically).
Supporter data: Follower counts, promo codes and tracked-link results, proof screenshots, rewards received, imported contacts (with your consent — see section 5).
Invitation and link data: When an organizer invites you to a night we store the invitation, what it stated (the night, the actions asked, the rewards), when it was sent and your response. Declining is stored only as your answer and is never counted against you. Clicks on your tracked link are logged with a hashed browser signature (never your IP) and a 30-day attribution cookie.
Operational logs: When a critical action fails (applying, approvals, link assignment, proof, guestlist, table requests) we log the failure with your user id and the event id so we can fix it; no contact details are stored in these logs.
Payment data: Processed by Stripe. We do not store card numbers.
3. Legal Basis (GDPR Art. 6)
Contract: Processing necessary to provide our services (account management, event promotion, organizer invoicing).
Consent: Contact import, marketing communications, cookies beyond essential.
Legitimate interest: Analytics, fraud prevention, service improvement.
4. How We Use Data
- Operate and improve the platform
- Match supporters to events and let organizers invite supporters who fit their night
- Invoice organizers on the terms agreed with them, via Stripe
- Send transactional emails (applications, invitations, approvals, event updates)
- Generate leaderboards and rankings
- Analytics and monitoring (Sentry for error tracking)
5. What Organizers See — and What Stays With WTP
Your contact data — email, phone / WhatsApp number and Instagram handle — is held by WTP and is not shared with organizers. WTP contacts you; the organizer does not.
Organizers see your supporter record as aggregates only: a short display name, city, genres, follower band, and your record on the platform (nights supported, tickets attributed, verified posts, show rate). Organizers who approve you for their night see the same record plus your activity on that night (posts, proofs, guest requests, tracked-link results).
Imported contacts are added only with your consent and their prior consent to you; they are held by WTP, used to reach the people you named for the night you named, and never shared with organizers or used for anything else.
6. Data Sharing
We share data with: Supabase (hosting/database), Stripe (payments), Resend (email), Netlify (hosting), Sentry (error monitoring), and organizers (aggregates only, as described in section 5). All providers are GDPR-compliant. We do not sell your data.
7. Your Rights
Under GDPR, you have the right to: access, rectify, erase, restrict processing, data portability, and object. To exercise any right, email privacy@whatstheplan.club. We respond within 30 days.
8. Data Retention
Account data is retained while your account is active. After deletion, data is purged within 30 days. Financial records are retained for 7 years as required by Portuguese tax law.
9. Cookies
See our Cookie Policy for details on cookies and tracking.
10. Contact
For privacy inquiries: privacy@whatstheplan.club