Privacy Policy.

1. Who we are

Wonderland Immersive Design, doing business as Side A (“Side A”, “we”, “us”) runs the Side A website and service at sidea.club. For the personal data this policy describes, Side A decides why and how it is used (in EU and UK terms, Side A is the “controller”). You can reach us about anything here at hello@side-a.co.

Hosts and venues who organise nights receive some of your details to run their night (see “What hosts and venues see”), and they are responsible for their own use of them. Stripe processes payments under its own privacy policy.

2. What we collect

What you give us.

• Account: your email address, and the display name, photo, bio, city and links you choose to add.
• What you post: records you pin to your profile, answers to prompts, song stories, notes to a host, reflections, reviews and photos.
• Bookings: the nights you ask for, book, attend or save, and when you accepted each night's rules (age, food and drink, house rules). We keep that record in case something goes wrong.
• Hosting: your host application (name, city, neighbourhood, your setup, a photo of your room, why you want to host), your nights, when you accepted the Host Agreement, and your street address, which is stored apart from the listing and shared only as described below.
• Waitlist and city requests: your name, email, city or neighbourhood, and any note.
• Other people's details: when you invite someone, their name and email. Only invite people who'd expect to hear from you.

What we collect automatically.

• Technical data every website receives: your IP address, browser and device type, and the pages you request. Our hosting provider and database keep these in logs for security and fixing problems.
• Usage counts: which pages are viewed and which steps are used (for example, how many people start and finish a host application), through PostHog. It keeps nothing on your device, so it doesn't follow you between visits.
• Recordings of visits: through PostHog, we record how a visit moves (clicks, scrolling and the pages you go through) to see where the site is confusing. A recording never includes what you type, email addresses or street addresses, and we don't record the admin, account, sign-in, and a host's edit and announce pages. You can turn recording off in the notice at the foot of the page or here.
• Rough location: your city and country, estimated from your IP address by our hosting provider, to suggest nights near you. We don't store it, and we never use your device's GPS.

What others give us. Stripe tells us whether a payment went through, and the IDs we need to refund it. We never see or store your full card number. Hosts may write a review after a night you attended.

3. How we use it, and why we're allowed to

• To run the service you asked for (performing our contract with you): signing you in, showing you nights, sending your request to the host, taking your booking, sending the address once you're approved, reminders, refunds, and reviewing host applications.
• To keep members safe and the service secure (our legitimate interests, and yours): keeping a record of accepted rules and agreements, preventing fraud and abuse, and dealing with complaints and incidents.
• To understand and improve Side A(our legitimate interests): counting page views and steps, in aggregate, and watching recordings of visits to find what's confusing. You can say no to recordings at any time.
• To meet legal duties (legal obligation): tax and accounting records, and answering lawful requests.
• With your consent, where we ask for it: for example, showing your song story publicly when you choose to. You can withdraw consent at any time.

The emails we send are about your account, your nights and your bookings. If we ever send news or offers, we will ask first, and every such email will have a way to stop them.

4. What hosts, venues and other members see

• When you ask for a seat, the night's host or venue sees your display name (or first name), your note and your song story, so they can say yes. They may use these only to run that night (Host Agreement).
• At a night in someone's home, the host approves each guest first. You get the full address only after the host approves you and your seat is confirmed; everyone else sees only the neighbourhood.
• If you host at home, your street address is kept in a separate, locked record that only you can read. We send it only to guests you approve, and only for that night.
• Your profile (display name, photo, bio, city and links) is public: anyone can see it, signed in or not. The records you pin are visible to members, and your first name may appear on a night's page. Song stories and prompt answers are shown publicly only if you mark them public.
• When you pay, the organiser receives Stripe's payment record, as any shop would: the amount, the name and email given at checkout, and the card type and last four digits.

5. Who helps us run it

These companies process personal data for us, only on our instructions and to provide their service:

• Supabase: our database, sign-in and file storage, hosted in the United States.
• Vercel: hosts the website and runs our servers; keeps request logs; estimates rough location from IP address.
• Stripe: payments, payouts, refunds and fraud checks. Stripe is also an independent controller of payment data under its own privacy policy.
• Resend: sends our emails.
• PostHog: counts page views and steps and records visits (never typing, emails or addresses), hosted in the United States, set to keep nothing on your device.

Album details come from Discogs, MusicBrainz and Apple's iTunes search. Album artwork is loaded from those services and through the image service wsrv.nl. Like any website loading an image, they receive your IP address and browser details when your browser fetches a cover, but nothing about your account.

We may also share personal data when the law requires it, to protect someone's safety, to deal with a dispute or claim, or with a buyer or successor if Side A is sold or reorganised (who would then keep to this policy).

6. What we don't do

• We don't sell your personal data, and we don't share it for advertising.
• We don't use advertising trackers or cross-site tracking.
• We don't record what you type, and we use recordings of visits only to fix and improve the site.
• We don't make decisions about you by automated means that have legal or similarly significant effects; people review host applications.

7. Cookies and storage on your device

We keep only what the service needs to work:

• sign-in cookies from Supabase, to keep you signed in;
• your light or dark theme choice;
• small notes such as the date you last saw the daily prompt, and a song story you're still writing, so it isn't lost if the page reloads;
• your answer to the recording notice, so we don't ask again.

These are strictly necessary or remember a choice you made, so we don't ask for consent to them. PostHog keeps nothing on your device. Stripe's checkout page sets its own cookies for payments and fraud prevention, under Stripe's policy.

8. How long we keep it

• Your account and what you post: while your account is open. When you ask us to delete your account, we delete or anonymise it within 30 days.
• Bookings, payments and accepted rules and agreements: as long as we need them for tax and accounting law, and to deal with disputes and claims, typically up to 7 years after the night.
• A host's street address: with the night it belongs to. Hosts can ask us to delete it after the night.
• Waitlist and city requests: until we open in your city, you ask us to remove them, or we no longer need them.
• Recordings of visits: 30 days, then PostHog deletes them.
• Server and security logs: for the short periods our providers keep them.

9. Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you and give you a copy, in a format you can take elsewhere;
• correct it (you can change most of your profile yourself);
• delete it, or your whole account;
• stop or limit using it, or object to our using it on the basis of our legitimate interests; and
• withdraw a consent you gave.

Email hello@side-a.co from the address on your account. We'll answer within one month (45 days where California law applies), and we may need to check it's you. We won't treat you differently for using your rights. Some records we must keep by law (see “How long we keep it”).

If you are in the EU or UK, you can also complain to your data protection authority, for example the UK's Information Commissioner's Office or Spain's Agencia Española de Protección de Datos. If you are in California, you have the rights above under the CCPA; we don't sell or share personal information as that law defines it, and we don't use sensitive personal information to infer things about you.

10. International transfers

Side A's data is stored in the United States. If you are outside the US, your data is transferred there. Where EU or UK law applies, we rely on safeguards such as the European Commission's Standard Contractual Clauses (with the UK addendum), or a provider's certification under the EU-US Data Privacy Framework and its UK extension. Ask us for details.

11. Security

We protect your data with encryption in transit, access controls in our database that let each person read only what they should, and by keeping hosts' addresses apart from everything else. No system is perfectly secure. If a breach puts your rights at risk, we'll tell you and the authorities as the law requires.

12. Children

Side A is for adults only. You must be 18 or older, or 21 for nights where alcohol may be present in the United States. We don't knowingly collect data from anyone under 18; if you think a minor has an account, tell us and we'll remove it.

13. Changes to this policy

We'll update this policy when what we collect or who we share it with changes. We'll change the date above and, for material changes, tell you by email or in the service before they take effect.

14. Contact

Privacy questions and requests: hello@side-a.co. See also the Terms of Service.