Privacy Policy
Last updated: 7 March 2026
1. Data controller
The data controller for your personal data is:
Association Wattshout
Registered address: [to be completed]
RNA: [to be completed] — SIRET: [to be completed]
Contact: privacy@wtsh.dev
2. Data we collect
On the website (wtsh.dev)
With your consent, the website uses PostHog (EU Cloud) for usage analytics. No personal data is collected without prior consent.
On the Wattshout mobile app
When you use the app, we may collect the following data:
- Email address (registration, waitlist)
- First name (optional, personalisation)
- Favourites and schedule preferences
- Language preference (FR, EN, ES)
- Hashed IP address (SHA-256, non-reversible — for security and rate limiting purposes)
3. Legal bases for processing
Each processing activity is based on a legal ground compliant with the GDPR:
- Consent — waitlist registration, push notifications
- Performance of a contract — creating and managing your user account
- Legitimate interest — anonymised analytics (service improvement)
4. Sub-processors
We use the following sub-processors to operate the service:
- Supabase — database, authentication, edge functions (EU region hosting)
- PostHog — analytics (EU Cloud)
- Sentry — error tracking (EU)
- APNs / FCM — push notifications (Apple Push Notification service / Firebase Cloud Messaging)
5. Data transfers outside the EU
Supabase, PostHog and Sentry are hosted within the European Union.
Push notifications are delivered via Apple (APNs) and Google (FCM) services, which involve data transfers to the United States. These transfers are governed by Standard Contractual Clauses (SCCs) compliant with the GDPR.
6. Data retention periods
- Active account — your data is retained for the duration of your account
- Deleted account — your data is retained for 30 days (soft-delete), then permanently deleted
- Waitlist — your data is retained until app launch, then for a maximum of 6 months thereafter
- Technical logs — retained for 90 days
7. Security
We implement the following security measures to protect your data:
- Encryption in transit (TLS 1.3)
- Secure authentication via Supabase Auth
- No plaintext password storage
- Hashed IP addresses (SHA-256, non-reversible)
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access
- Right to rectification
- Right to erasure
- Right to data portability
- Right to object
- Right to restriction of processing
To exercise these rights, contact us at privacy@wtsh.dev. We will respond within 30 days.
You may also lodge a complaint with the CNIL (French Data Protection Authority) or your local supervisory authority.
9. Cookies and trackers
Website
With your consent, the website uses PostHog for usage analytics. PostHog is hosted within the European Union. You can accept or decline tracking via the consent banner. Your choice is stored in your browser's local storage.
Mobile app
The app uses PostHog for usage analytics. Under CNIL guidelines, PostHog qualifies as a tracker. Consent is obtained before the tracker is initialised. You can refuse or withdraw your consent at any time from the app settings.
10. Minors
The Wattshout app is not intended for persons under 16 years of age. We do not intentionally collect data from minors.
If we discover that data from a minor has been collected, it will be deleted immediately.
11. Third-party links
The website and app may contain links to third-party services (festival websites, ticketing platforms, etc.). Wattshout is not responsible for the privacy practices of these services. We encourage you to review their respective privacy policies.
12. Changes to this policy
This privacy policy may be updated from time to time. In the event of a significant change, we will notify you via an in-app notification or by email.
The date of the last update is displayed at the top of this page.
13. Applicable law
This policy is governed by French law and the GDPR (EU Regulation 2016/679).
In the event of a dispute, the competent court is Paris, France.
14. Contact
For any questions regarding the protection of your personal data: