Privacy policy

Last updated: 13 October 2026

Controller

Lukas Alexander Kaffer (sole proprietorship)
Klederinger Straße 15/2/27
2320 Schwechat
Austria

Privacy contact: [email protected]

Data processed and purposes

When you visit the website and use the app, technical access data are processed, in particular IP address, time of access, requested URL, referrer, and browser, app, device and operating system information. This processing serves the provision, security, error analysis and stability of Vienna Event Radar.

When you use a user account, the data required for registration, login and app features are processed. This may include in particular email address, user ID, username, display name, profile picture, group memberships, invitations, saved events, ratings, attendance markers, group suggestions, group responses, and settings and status information.

If you upload a profile picture, the image is first transferred to a private upload area, checked on the server for impermissible content and only stored as a publicly accessible profile picture if it is approved. Rejected uploads and uploads that are no longer needed are deleted. Approved profile pictures may be visible to other users, in particular in shared groups.

Content that users create or trigger themselves may include in particular usernames, display names, profile pictures, group names, group memberships, invitations, group suggestions, votes in groups, reports of content and blocks of other users. These data are processed to provide the respective account, group, security and moderation features.

For personalised recommendations, in particular the “For you” view, your interactions with events are processed. These include, for example, saved events, ratings, attendance markers, group suggestions and similar usage signals. This personalisation serves exclusively to make the selection of events within Vienna Event Radar more relevant.

If you use “Frag dein Radar” (Ask your radar) while logged in, we process the question you enter in order to find suitable events in Vienna. Cloudflare may be used as a technical processor for AI-assisted recognition of your search intent. Only the search text you enter is transmitted to Cloudflare, so that search criteria such as date, category, price range, indoor/outdoor or mood can be derived from it. The actual selection of events is then made on the basis of our own event data. We do not store your free-text question as raw text in our database.

For “Frag dein Radar”, we do not transmit any email address, user ID, profile information, group information, favourites, ratings, attendance markers or location data to Cloudflare. Nevertheless, please do not enter any sensitive or private information in the free-text field that is not required for the event search.

To prevent abuse, daily counters are processed for the AI-assisted search assistance, in particular user identifier, date, number of requests and time of the last request. These counters do not contain any questions entered, prompts, answers or event data.

In the mobile apps, technical error data may be transmitted to our server or to technical error analysis services where this is necessary for error analysis, security and stability. This may include in particular app version, build number, operating system version, device model, language, time zone, pseudonymous installation and session identifiers, technical error messages and cleaned diagnostic metadata. The apps are designed not to send email addresses, names, passwords, tokens or free-form user text in error reports.

If you use local reminders, calendar functions, sharing functions or the system search of the mobile apps, the app processes the event data required for this on your device. Reminders are only scheduled for saved events and only shown after you have granted the respective system permission. The calendar is only accessed if you actively want to add an event to your calendar. In the Android app, selected event information may also be indexed locally for the Android system search.

If you use the map or nearby function in the iOS or Android app, the app may, after you have granted location permission, process your current device location on the device in order to centre the map and show events near you. The Android app uses Google Maps and Google Play Services Location for this. Your current device location is not transmitted to the Vienna Event Radar backend, not used for automated event research and not used for profiling. Without location permission, search, lists, event details, favourites and groups remain usable; the map can still show events with existing coordinates.

When you contact us by email or via the contact form, the information provided is processed in order to handle your enquiry. This may include in particular name, email address, message, time of the enquiry and technical protection data such as IP address and user agent.

For event submissions via the organizer page, we store organisation, contact person, email address, event link, dates, venue, voluntary price information and messages, as well as the time at which the privacy notice was confirmed. This information is used for editorial review and follow-up questions. For processing, we keep an internal contact status, review notes and, where applicable, an assignment to the published event. Contact addresses and internal notes are not displayed publicly. We automatically delete submissions 6 months after receipt. Submitting an event does not subscribe you to the newsletter. To prevent abuse, we briefly process salted hash values of the IP address and email address, separately from the submission.

Messages sent via the feedback function of the iOS app are forwarded to us by email – without name and without email address. Only the app version, iOS version and device type are included. To prevent abuse, the IP address is processed exclusively in pseudonymised (hashed) form for a short time window and is not stored together with the message.

For the feedback question in the iOS app, we store for signed-in accounts the number of distinct days of use, whether and when the question was shown, which response path was chosen (“Going great” or “Could be better”), whether it was postponed or completed, and when another attempt is possible. This information helps us to check how often the question is asked and to improve its usability. It contains neither the message text nor an App Store rating. The status is assigned to your account; the separately sent feedback message still contains no account ID and no sender address. Due to the time of sending, it cannot be completely ruled out that the two can be linked in individual cases.

When you subscribe to the newsletter, your email address, subscription status, the source of the subscription (for example the Weekly Radar issue through which you subscribed), consent text, consent version, time of consent, technical subscription data such as IP address and user agent, and confirmation and unsubscription information are processed. The Weekly Radar usually informs you by email on Mondays about selected events of the week in Vienna.

If you subscribe via the sign-up form, you confirm your email address via a link in a confirmation email (double opt-in); only then is the subscription active. If you are logged in with an account whose email address has already been confirmed, the subscription becomes active as soon as you sign up for the newsletter, and you receive a confirmation by email. If you select the Weekly Radar when registering, the confirmation of your email address also applies to the newsletter. You can unsubscribe at any time via the unsubscribe link in every email or, if you are logged in, in your account.

To improve the product, simple first-party usage signals are processed, in particular opening event details, clicks on original sources, setting favourites, opening sharing functions, opening and browsing a Weekly Radar issue, and newsletter sign-ups and newsletter confirmations. For each signal, the page visited, the language, the domain of a referring website and – if the link contains them – campaign parameters (utm_source, utm_medium, utm_campaign) are stored. This allows us to see, for example, via which partner site or which newsletter an issue was opened. Opening and browsing the Weekly Radar is stored without reference to an account. These analytics data serve to improve the selection, usability and launch evaluation of Vienna Event Radar. No marketing cookies are used, no raw IP addresses or raw user agent strings are stored in the analytics table, and session identifiers are only processed in hashed form. Browser signals such as Do Not Track or Global Privacy Control are respected.

Legal bases

Insofar as processing is necessary for the account, login, groups, favourites, recommendations, event interactions, profile functions, app functions or support, it is based on Art. 6(1)(b) GDPR. Technical data, error data, security data, moderation data and abuse prevention are processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in the operation, security, troubleshooting, prevention of abuse and further development of the service.

The newsletter is sent on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future.

Simple product analytics are processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in developing the service further so that it is usable, relevant and reliable, without using advertising third-party profiles or marketing cookies for this purpose.

The account-related status of the iOS feedback question is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to ask the question only at appropriate intervals and to recognise whether the process works. You can object to this additional status evaluation, on grounds relating to your particular situation, at the privacy address given above.

Your input in “Frag dein Radar” is processed, insofar as this is necessary for using the function, on the basis of Art. 6(1)(b) GDPR. Security, rate-limit and error data of the search assistance are processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in preventing abuse, stability and troubleshooting.

Insofar as individual functions rely on permissions of your device, such as notifications, calendar access, location access or photo selection for profile pictures, they are only used after your active choice or after the respective system permission. You can change such permissions in your device's system settings.

Services used

External service providers are used for operation, authentication, database, storage, edge functions, hosting, performance measurement, error analysis, transactional emails, newsletters and email forwarding. These include in particular Supabase, Vercel, Sentry, Resend and ImprovMX.

For “Frag dein Radar”, Cloudflare Workers AI may be used as a technical service to recognise search intent. Cloudflare only receives the search text entered and returns structured search criteria from it. Cloudflare does not select any events, does not receive an event list and does not formulate event recommendations for you. According to Cloudflare's current information, content processed via Workers AI is not used to train the AI models available there or to improve Cloudflare or third-party services, unless explicit consent has been given. For this function, we do not use a Cloudflare AI Gateway with payload logging.

When you log in with Google OAuth, Google Sign-In on Android or Sign in with Apple, the account information required for login is processed by the respective provider and transmitted to Vienna Event Radar insofar as this is necessary for signing in.

OpenAI may be used as a technical moderation service to check uploaded profile pictures. The uploaded image is transmitted for automated content checking.

For the map display and optional location determination in the mobile apps, Apple MapKit/CoreLocation or Google Maps/Google Play Services Location are used, depending on the platform. In the current implementation, location processing takes place locally on your device. Geoapify may be used on the backend to resolve public event locations and venues to coordinates. This concerns event and venue data, not your current device location.

Insofar as service providers process personal data outside the European Union or the European Economic Area, this is done only on the basis of appropriate safeguards, in particular adequacy decisions or standard contractual clauses under the GDPR. This may be relevant in particular for US providers such as Cloudflare, Vercel, Sentry, Resend, ImprovMX, OpenAI or Geoapify.

Cookies and local storage

Cookies or comparable storage mechanisms may be used for login, session management and technically necessary functions. A locally stored theme setting may be used to display the colour scheme. For product analytics, a random identifier is stored in the browser's session storage for the duration of a session. It is deleted when the tab is closed and only stored in hashed form on the server. In the mobile apps, data may be stored locally, such as session data, feed cache, group and invitation cache, interaction status, reminder status, app settings and pseudonymous diagnostic identifiers. In the Android app, session data are stored encrypted via the Android Keystore; local feed and interaction caches are intended for performance and offline availability and, in the current implementation, are not included in Android cloud backups. In the current implementation, the current device location for the map function is not stored permanently by Vienna Event Radar. This local storage serves the functionality, performance and offline availability of the app. No marketing or tracking cookies are currently used.

Visibility in groups and profiles

Your username, display name and approved profile picture may be shown to other users insofar as this is necessary for groups, invitations, group suggestions, moderation or joint event planning. Group names, member lists, suggestions and responses are generally restricted to members of the respective group.

Automated decisions

Vienna Event Radar uses interaction signals to personalise event recommendations and sorting. No automated decision within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

Storage period and deletion

Personal data are only stored for as long as this is necessary for the stated purposes or legal obligations exist. Account data, profile information, group information, event interactions and personalisation signals are generally stored for as long as your account exists or the respective function is needed. Newsletter data are stored until you unsubscribe or for as long as this is necessary to prove consent and to prevent abuse. Product analytics, moderation, security and error data are stored for as long as this is necessary for evaluation, review, abuse prevention, troubleshooting and verification purposes.

The server-side status of the iOS feedback question is deleted when the account is deleted and is otherwise removed by a daily clean-up after 365 days without a new status report. On the device, the local question status remains stored for the repetition rules as long as the app data exist. If you object, we delete the server-side status and, until the account is deleted, only keep the user ID as a block marker so that a later app start does not transfer the status again.

Account deletion

You can delete your account in the web app as well as in the iOS and Android apps. If you own groups, you may need to decide before deletion whether the groups are deleted or transferred to another group member. After the account has been deleted, personal account data are removed or anonymised, unless legal obligations or legitimate reasons require further storage. Public profile pictures and uploads that are no longer needed are removed in accordance with the technical deletion processes.

If you can no longer open your account in the app or no longer have the app installed, you can request account deletion at any time by email to [email protected].

General enquiries about data protection or account deletion can also be sent to [email protected].

Rights of data subjects

Under the GDPR, data subjects have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. In addition, there is a right to lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, www.dsb.gv.at.