Privacy Policy

Who is responsible for your data

The Season (theseason.vip) is operated by Katrina Thunem, Norway, who is the data controller for the purposes of the EU and UK General Data Protection Regulation and the Norwegian Personal Data Act. For anything in this policy, write to [email protected].

The public site sets no cookies

theseason.vip uses no cookies, no analytics, no advertising pixels and no third-party trackers. Nothing is stored in your browser and there is no consent banner because there is nothing to consent to.

That includes the pictures. Every photograph on the site is stored on our own servers, so looking at an event page tells nobody but us. Where we have no photograph of an event itself we show one of the venue or the city and say so underneath it, with the photographer and licence named.

Some event pages link to the homepage with a tag naming the event you came from, for example /?event=royal-ascot. That tag is only attached to a waitlist signup if you choose to sign up. It tells us which events people find useful. It is not a profile, it is not linked to any identifier, and it is discarded if you do not sign up.

The waitlist

What we collect: your email address, the slug of the event page you arrived from if there was one, the address of the page on our site where you signed up, and the domain of the site that sent you there if your browser shares it. We keep that domain only, never the full address of the page you came from.

Why: to send your invitation when membership opens, then a few follow-ups about it until you join, and to understand which events bring people in. If you signed up on or after 8 October 2026, that is at most three follow-ups over the four weeks after your invitation, and they stop the moment you join or unsubscribe. If you signed up on 6 or 7 October 2026, we send one reminder a week after the invitation; before that, the invitation only. Every one of these emails has a one-click unsubscribe link, which deletes your address from the list straight away. We do not sell, rent or share the list.

Lawful basis: your consent, given when you submit the form. You can withdraw it at any time, and withdrawing does not affect anything we did before you withdrew.

How long: if you do not join, we delete your address five weeks after your invitation, when the last follow-up has gone. If you join, we keep your waitlist entry while your account is open, so we can see which events and sites bring members in, and delete it when you close your account. Unsubscribing or asking us deletes it straight away. If the project does not launch, the list is deleted.

The Journal

If you sign up for the Journal, we keep your email address only to send it, never share it, and delete it the moment you unsubscribe.

What we collect: your email address, which form you used (the homepage, the Journal page, a named article, or the switch in the app), and when you signed up and confirmed. Nothing else: no name and no location. The Journal list is kept in its own table, separate from the waitlist; if you subscribed from the app it is linked to your account only so that the switch shows the right setting.

How sign-up works: we email you a confirmation link and send nothing more until you press it. If you do not press it within seven days your address is deleted automatically. Members can instead switch on Monthly Journal email in Account in the app, which uses the email address of their account; it is off until they switch it on.

Why: to send you the Journal, once a month. We do not sell, rent or share the list, and we do not use it for anything else.

Lawful basis: your consent, given when you confirm. You can withdraw it at any time.

How long: until you unsubscribe. Every Journal email has an unsubscribe link, and pressing it deletes your address from the list straight away; switching the app setting off does the same, and so does closing your app account if you switched the Journal on there.

No tracking: the Journal email has no tracking pixels and its links are not rewritten, so we do not know whether you opened it or what you clicked. To stop the sign-up form being misused we count sign-up attempts per network address over ten minutes. That count lives only in the memory of the running server: it is never written to a database or a log, and it disappears when the server restarts.

The app at app.theseason.vip

If you hold an account, we additionally hold the email address you registered with, the events, dates, notes and budget figures you choose to save, and your subscription status. That data exists to run your account and is processed to perform the contract between us.

When you create an account we also note how you reached us: the tag on the link you followed if there was one, the domain of the site that sent you if your browser shares it, and the page on our site you started from. It is stored with your account, used only in counts of where members come from, and deleted with your account.

The app keeps two things in your browser: the session that keeps you signed in, and the answers you gave during onboarding. Both are strictly necessary to run the app for you, neither is used for tracking or advertising, and clearing your browser data removes both. Payments are handled by Stripe. Card numbers are entered on Stripe's systems and are never seen or stored by The Season. We receive only whether a subscription is active and when it renews.

Account data is kept while your account is open and deleted within 30 days of you closing it, except where we are required to keep billing records for longer to satisfy accounting and tax law.

Who else processes your data

We keep the list of third parties as short as the product allows. Each of these acts on our instructions under a data processing agreement:

The waitlist, the Journal list and every account record are stored in the EU (Ireland) and are not transferred out of it. Cloudflare, Resend and Stripe operate globally; where any of them processes data outside the European Economic Area the transfer relies on the safeguards in that provider's data processing terms, including the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to our processing it. You can withdraw consent for the waitlist or the Journal at any time. We do not make automated decisions about you and we do not profile you.

If you hold an account, two of those rights are built in and need no request at all. Open Account in the app: Download my data gives you a JSON file containing everything we hold about you, and Delete my account permanently removes your saved events, budget, fixed dates, preferences and your login. Deletion is immediate and cannot be undone, so export first if you want a copy.

For anything else, or if you are on the waitlist rather than in the app, email [email protected] and we will act within one month. There is no charge.

If you think we have handled your data badly you can complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no, or to the supervisory authority in your own country.

Security and breaches

Data is held in named systems with access limited to the operator of The Season. If a breach occurs that puts your rights at risk, we will report it to Datatilsynet within 72 hours of becoming aware of it and tell you directly where the regulation requires it.

Children

The Season is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

Changes

If this policy changes materially we will update the date at the top and, where the change affects the waitlist, tell subscribers by email.