Privacy Policy of thefolklore.app

This notice explains how Gymber s.r.o. processes personal data when operating Folklore (thefolklore.app, Folklore Manage and related apps). You can print it from your browser.

Last updated: 20 September 2026

Controller

The controller is:

Gymber s.r.o.
Company ID (IČO): 17600090
Registered office: Pod Terasami 779/5, 664 48 Moravany, Czech Republic
Registered at the Regional Court in Brno, file C 130593
Email: support@thefolklore.app

We have not appointed a data protection officer. Send GDPR requests to the email above.

What this notice covers

• the public website thefolklore.app (festival discovery on a map, programmes, articles, contact form; no login yet),
• Folklore Manage (organiser admin, including tickets and AI programme import),
• the Folklore mobile app where it uses the same account and backend.

Organisers who publish programmes or sell tickets may be independent controllers of visitor data for that content and for the ticket contract. Gymber then processes data as the platform operator, as described below.

What we process

• Data you give us: name, email, organisation or website, and message on the contact form; for an account, name, email and avatar; for organisers, festival, venue and programme data; for a ticket purchase, the buyer’s name and email.
• Usage data: URL, device and browser type, clicks and other events (including PostHog autocapture), and error logs. On the public site we do not create a person profile and we do not use IP address to identify you. Folklore Manage may include email, name, organisation and role for signed-in organisers.
• Location: precise device location only if you allow it in the browser or app (map centring, travel-time estimate).
• Payments: order status, amount, platform fee and payment-method tokens. Gymber does not store card numbers; Stripe processes them.
• Form protection: device signals and IP for Cloudflare Turnstile.

We do not collect a phone number or a separate surname field on the public contact form.

Purposes and legal bases

We do not process data in the public interest or in the exercise of official authority.

Purpose	Legal basis (GDPR Art. 6)
Running the site, festival map and public programmes	legitimate interests (f); also contract (b) for signed-in accounts
Account, OTP / magic-link sign-in, organisation invites	contract (b)
Organiser contact form (including UTM and page URL)	pre-contractual steps (b) and checkbox consent (a)
Ticket sales, organiser payouts, accounting and tax	contract (b) and legal obligation (c)
Security, fraud prevention, Turnstile, operational logs	legitimate interests (f) and, where applicable, legal obligation (c)
Precise location and Mapbox Directions	consent (a) — optional; browsing festivals does not require location
PostHog analytics on the public site; PostHog and Vercel Analytics in Folklore Manage	Public site: anonymous usage analytics (no person profile; we do not use IP to identify you). A short notice on the map states that using the site means you agree to this. Folklore Manage: organisers are signed in, so analytics run as part of the registered service (contract (b) and legitimate interests (f)). You may object at support@thefolklore.app.
AI programme import and drafting (OpenRouter, AgentQL)	contract with the organiser (b); content may be sent to providers outside the EEA

Recipients and processors

We share data only as needed for the purposes above:

• Supabase — database, storage and authentication (accounts, content, orders, media).
• Vercel — hosting of the website and Manage; in Manage also Vercel Web Analytics (page views, coarse location/device).
• PostHog Inc. — product analytics and error capture, EU project (eu.i.posthog.com). On the public site this is anonymous (identified_only, no person profile). In Folklore Manage, for signed-in organisers, this may include email, name, organisation, role and session recording.
• Stripe Payments Europe / Stripe, Inc. — payments and Stripe Connect. Folklore receives a platform fee. Organiser identity and KYC data are processed by Stripe as an independent controller for its own compliance.
• Resend — transactional email (login codes, invites, internal lead notices). Not marketing.
• Cloudflare — Turnstile on the contact form (bot protection).
• Mapbox, OpenFreeMap / OpenMapTiles, Esri — map tiles and, if you enable ETA, the route and precise location.
• Google Ireland Limited — venue search (Places API) in Folklore Manage, not an embedded Google Map on the public site.
• OpenRouter and selected model providers, AgentQL — AI programme import for organisers.
• Apple and Google — app distribution via the App Store and Google Play, including the Google Play beta programme if you join it.

We do not embed a Google Maps widget on the public site.

Cookies and similar technologies

Strictly necessary cookies and storage are those required for sign-in (Folklore Manage and the app), security and basic settings (for example language). Public-site analytics are anonymous and are covered by the short notice on the map. Folklore Manage analytics run for signed-in organisers as part of that service. You may object at support@thefolklore.app.

You can block cookies in your browser; some parts of the Service may then fail (especially sign-in).

Location

You can browse festivals without sharing location. If you allow it, we use it to centre the map and estimate travel time. With ETA on, coordinates are sent to Mapbox. A browser permission is not by itself a recorded GDPR consent; the purpose and recipients are set out here.

Tickets and payments

The ticket contract is with the organiser, not Gymber, unless we say otherwise at checkout. Gymber operates payment infrastructure through Stripe Connect and may charge a platform fee. We keep order data to perform the contract and meet accounting duties.

Transfers outside the EEA

Some recipients (in particular Stripe, Mapbox, Esri, Google, OpenRouter, Apple, Google Play) may process data in the United States or another third country. Where there is no adequacy decision, we rely on standard contractual clauses or other Chapter V GDPR safeguards.

Retention

• contact-form leads: until handled, then up to 12 months, longer only if needed to defend legal claims,
• accounts: for the life of the account; you can delete a Folklore app account in the app; for Folklore Manage email support@thefolklore.app; after an erasure request without undue delay unless a legal duty prevents it,
• orders and accounting records: typically 10 years under Czech accounting and tax rules,
• operational and security logs: typically up to 12 months,
• analytics and session recordings: typically up to 14 months; session recordings are intended to be shorter (tens of days),
• location for ETA: we do not store it as a lasting profile; it is sent to the routing provider for that request.

Children

The public map is for a general audience, including families. Accounts, Folklore Manage and ticket purchases are for people with legal capacity to do so (typically 18). In Czech law, a child’s consent to information-society services is assessed from age 15. We do not target children’s personal data.

Your rights

To the extent GDPR allows, you have in particular the right to:

• withdraw consent at any time, where processing is based on consent;
• object to processing that is not based on consent (in particular legitimate interests);
• access your data, information about the processing, and a copy of the data;
• rectify inaccurate data and complete incomplete data;
• restrict processing — we will then store the data without using it for other purposes, except as the law allows;
• erasure (“right to be forgotten”), unless a legal duty prevents it;
• data portability for data you provided that we process by automated means on the basis of consent or a contract;
• lodge a complaint with a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

You also have the right to information about the legal basis for transfers outside the EEA and the safeguards used (for example standard contractual clauses).

Objection

Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. If we processed data for direct marketing, you could object at any time without giving reasons; we would then stop using it for marketing. Folklore does not run email direct marketing on the public website.

How to exercise these rights

Send requests to support@thefolklore.app or to Gymber s.r.o.’s registered office. They are free of charge. We will reply without undue delay and at the latest within one month; in complex cases we may extend this by a further two months and will tell you. We may ask you to prove your identity. We will inform recipients to whom we disclosed the data of any rectification, erasure or restriction, unless this is impossible or involves disproportionate effort.

Legal action and logs

We may use data to defend legal claims arising from a breach of this notice or of the law. We may have to disclose data if a public authority lawfully requires it. For operation and maintenance, Folklore and its processors may record system logs (including IP address where needed to run the service).

Definitions

• Personal data — information relating to an identified or identifiable natural person.
• Usage data — information collected automatically when you use the service (for example IP, browser, pages).
• User / data subject — the person using the service whose data are processed.
• Controller — Gymber s.r.o., unless another controller is named for a specific purpose (for example Stripe for card data, the organiser for the ticket contract).
• Processor — a party that processes data for the controller (for example Supabase, Vercel, PostHog).
• Service / thefolklore.app — the public website, Folklore Manage and related apps operated by Gymber.

Changes

We will publish the current version on this page and update the date. Material changes that affect you will be notified in a suitable way (for example by email if you have an account). If a change affects processing based on consent, we will ask for a new consent where the law requires it.