Privacy notice
This notice explains, in plain English, what personal data Nightcap collects through this website, why, who else handles it, how long we keep it and what your rights are. It is written to meet Article 13 of the GDPR.
Who is responsible for your data
The data controller is John Roche, an individual based in Ireland, trading as Nightcap (a provisional name).
Email: john.roche@darkblocks.dev
We do not have a Data Protection Officer. Write to the address above for anything in this notice.
What we collect, and why
The waitlist form
You give us your email address. You may also give a first name, your country and the kind of traveller you are. We use these only to tell you when the pilot opens and to send occasional updates about Nightcap. We also store the version of this consent text you agreed to, which page you signed up on, and the date and time.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, as easily as you gave it, by emailing us. Withdrawing does not affect anything done before.
The host sign-up form
If you run a pub, farm, café, attraction or similar and want to be listed, you give us your business name, your name, email, county and type of business. Optional details are a phone number, town, number of spaces, pricing and a free-text description. If you use the drafting feature, the draft listing you edit is stored too. We use this to contact you, check the details with you and, if you agree, publish a listing. We also keep a status for your sign-up (for example new, contacted, approved).
Legal basis: taking steps at your request before a possible agreement to list you (Article 6(1)(b)), and our legitimate interest in running and keeping accurate our own listings (Article 6(1)(f)). You can object at any time.
Security and abuse limits
To stop spam we count form submissions per visitor. For this we keep a salted hash of your IP address, not the address itself, together with a time stamp. We do not use it for anything else. Legal basis: legitimate interest in keeping the forms working (Article 6(1)(f)).
Server logs and map tiles
Our host, Cloudflare, sees your IP address and basic request details when you load any page, as any web host does. On the map page your browser fetches map tiles directly from OpenFreeMap, which therefore also sees your IP address. We do not send them anything else.
Our database provider, Supabase, also sees your IP address: its API gateway logs include the IP address of every request to our database, which happens when you submit a form and when the map page loads places. Those logs are kept by Supabase under its own retention rules, and we cannot delete them.
Who else handles your data
We do not sell your data. We use these providers to run the site (they act as our processors, except where noted):
- Cloudflare: website hosting and delivery. Cloudflare data processing addendum.
- Supabase: the database that stores form submissions, hosted in the EU (Frankfurt, eu-central-1). Supabase DPA.
- Zoho: email, used to reply to you and to contact people on the waitlist, once that mailing is set up. Zoho GDPR information.
- OpenFreeMap: map tiles loaded by your browser on the map page. This is a direct connection from you to them. OpenFreeMap privacy policy.
Transfers outside the EEA
Our database is in the EU. Cloudflare, Zoho and Supabase are international companies, so some processing or support access may happen outside the European Economic Area. Where that happens, we rely on the transfer safeguards in their data processing terms linked above, such as the EU-US Data Privacy Framework or standard contractual clauses. Please read those pages for each provider's current position. If you have a question we cannot answer from them, ask us.
How long we keep it
- Waitlist: until 24 months after the pilot ends, or until you unsubscribe or ask us to delete it, whichever is first.
- Host sign-ups: while your listing or sign-up is active, plus 12 months.
- Anti-spam hashes: deleted automatically by an hourly job, so 48 hours at most.
Your rights
You can ask us to: show you the data we hold about you; correct it; delete it; restrict how we use it; give you a portable copy; or stop using it where we rely on legitimate interest. You can withdraw consent at any time. Email us and we will reply within one month.
No decisions about you are made by automated means. Nothing on this site profiles you.
If you are unhappy with how we handle your data, you have the right to complain to the Data Protection Commission, Ireland's data protection authority: dataprotection.ie. We would appreciate the chance to put things right first.
Giving us your data is voluntary. If you do not, you cannot join the waitlist or be listed, but you can still use the rest of the site.
Changes
If we change this notice in a way that matters, we will update this page and, where we hold your email on the basis of consent, tell you.