Privacy policy

Effective September 23, 2026.

German Events NYC is operated by Ben Shaw, an individual sole proprietor. Contact hello@germaneventsnyc.com.

1. Who is responsible

Ben Shaw, an individual sole proprietor operating as German Events NYC, is responsible for the personal information described here. Contact hello@germaneventsnyc.com. This policy is effective September 23, 2026 and was last updated September 28, 2026.

We use information to provide requested services, communicate with you, maintain security, understand use of the guide and meet legal obligations. We do not sell newsletter email addresses or private saved lists. Optional advertising measurement shares technical information with Meta only after the separate choice described below. Public event listings, member-visible profiles and private saved lists have different visibility settings, as explained below.

2. Newsletter and email engagement

When you subscribe, the service records your email address, a supplied name or name inferred from the address, signup source, privacy-notice version and subscription status. These details support delivery, personalisation and administration of the newsletter.

Active newsletter subscriptions are linked to a private account using the same email address. If you do not already have an account, the service prepares one without asking you to choose a password or sending an account invitation. You can request a password link when you want to use saved events or account settings. You must verify your email before accessing the account or managing newsletter preferences. This does not create a public directory profile or change your subscription choices.

Resend handles newsletter delivery. HTML newsletters may contain a tracking pixel and tracked links. Resend may receive your subscribed address, campaign and message identifiers, time, link destination, IP address and device or browser information when an email is opened or a link followed. I use approximate open and click information to improve the newsletter.

The German Events NYC database does not copy individual open events. Its newsletter click records contain a subscriber reference, campaign and message references, event or page and link placement, click time, and an assessment of whether an automated security scanner may have followed the link. These records exclude the reported IP address, raw browser identifier, recipient email address, unrelated URL parameters and complete delivery reports. Identifiable click records and associated recipient snapshots are scheduled for automatic deletion after 90 days through a daily cleanup. Aggregate campaign statistics can remain longer. Resend’s own retention is separate.

Automatic image loading, security scanners, forwarding and shared inboxes can affect these measurements. A tracked click does not prove that a particular person clicked. You can unsubscribe through a newsletter link or ask me to stop all marketing emails. Blocking remote images may reduce open tracking but does not prevent tracked-link measurement.

3. Accounts, profiles and messages

Member-directory pages, community profile setup and messaging are currently hidden on the website. Account settings, saved events and newsletter preferences remain available. Existing profile and conversation records have not been deleted by this change.

An account uses your email, authentication details and account identifiers. You may add your full name, display name, photo, biography, city or neighbourhood, country of origin, interests, languages, work details, connection goals and links. The service stores your profile and account settings.

If you choose Google or Apple sign-in, the service receives the account information that provider shares for sign-in, which may include an identifier, email address and name. The fields shared depend on the provider and your choices. The sign-in integration does not receive your Google or Apple password.

Profiles enabled for directory visibility can be viewed by signed-in members. Displayed information may include your name, work, social links and other profile answers; the directory does not show your account email. Turning off directory visibility is different from deleting your profile.

Messages include their content, sender, conversation participants and timestamps. The service also stores membership or invitation status and when a participant last read a conversation. Accepted participants can read messages through the service. Messages are not end-to-end encrypted; I and infrastructure providers may technically access stored messages when necessary to operate, secure or support the service. Recipients may keep their own copies.

Profile-photo files use publicly accessible URLs. Anyone who has a photo URL may be able to view it even when the directory profile is hidden. A photo hosted elsewhere remains subject to that host’s visibility settings. Do not upload a photo that you require to remain private.

4. Saved events and newsletter preferences

Guest event lists are saved in this browser. Signing in merges your guest list into your private account list so you can access it across devices. Removing an event updates your account list. Clearing browser data can erase unsynced guest lists.

Public tracking counts show the number of accounts that saved an event, once per account. They do not expose names, emails or private lists and are not attendance or ticket counts. Some initial lists were selected by the site owner using the account holder’s known interests; account holders can remove these selections.

We link newsletter records to accounts using the verified account email. Creating an account or saving events does not subscribe you or restore an unsubscribed address. You can view and change newsletter subscription and interests in account settings.

5. Event submissions and support

The event-submission form stores your name, email address, event title, optional event date and link, and any message you provide. If you contact me, I also receive your correspondence. I use this information to consider the event for publication, respond, investigate problems and maintain service records. Event information accepted for publication becomes public; providing private contact details does not authorise their publication as editorial content.

The guide also uses publicly available event, venue and organiser information, which may include professional names, biographies and images. Contact me to request a correction or raise a rights concern.

6. Website activity, browser storage and outside content

The site records event-detail views and selected event-link clicks with event identifiers, action types and timestamps. Hosting and database services may also process IP addresses, requested URLs, browser information and operational logs to deliver and protect the service. Event click counters are separate from subscriber-linked newsletter clicks.

Browser local storage and session storage support sign-in sessions, saved viewing preferences and signup-prompt state. These can include session credentials and whether a newsletter prompt was completed or dismissed. Removing browser storage may sign you out or reset preferences. It does not delete information already held on the server.

Cloudflare helps deliver and protect the website and may set security cookies, including a bot-management cookie, to distinguish ordinary visits from automated abuse. These cookies support website security.

The map uses Mapbox. Loading maps, remote images and other externally hosted resources sends technical request information to their providers. Following an outside link also brings you under that site’s practices.

Optional Meta advertising measurement respects Global Privacy Control and Do Not Track browser signals. The site does not provide a site-wide analytics opt-out. Newsletter unsubscribe, advertising choices and profile visibility controls apply to their respective features; they do not control all browser storage or requests to external resources.

Optional advertising measurement

The Meta Pixel and Conversions API help us understand how Instagram and Facebook ads bring readers to German Events NYC. Both operate only after you choose “Allow ad measurement”. This is optional and separate from newsletter consent: declining it does not prevent you from browsing, subscribing or creating your private account.

With your permission, we send public page visits, event-detail views, use of the top search bar, successful new email subscriptions and successful first password setup. A subscription event means the email signup succeeded; a registration event means password setup succeeded. We never send the email address, password, search text, name or account identifier. Event-detail measurements include the public event identifier. Automatic event detection and advanced matching are disabled by this integration.

Meta can receive page paths, event times, IP addresses, browser and device information, ad-click identifiers and cookies such as _fbp and _fbc. The Conversions API sends these measurements from our server using the same event identifier as the browser Pixel to prevent duplicate counts. Server event URLs exclude query strings and fragments; browser Pixel events are withheld on URLs or referrers with those values. Authentication links carrying tokens are excluded until the tokens have been removed. Meta may associate measurements with your Meta account and use them under its own privacy policy. First-party Meta cookies last up to 90 days and are created only with advertising permission.

Your advertising choice is stored in this browser. You can reopen “Advertising choices” below public pages, or use the panel on the subscribe page, and choose “Turn off”. Withdrawal stops future browser and server events from this integration, aborts pending server requests where possible and removes accessible first-party Meta cookies; it cannot recall information already sent. A Global Privacy Control or Do Not Track signal keeps both forms of advertising measurement off even if you previously allowed them. The earlier subscribe-only advertising grant requires a fresh choice for this expanded measurement; earlier declines remain respected. Clearing browser storage resets your choice. Newsletter email engagement tracking has its own disclosure above.

7. Who processes or receives information

Service providers support the database, authentication, file storage, messaging, website hosting and delivery, transactional email, newsletter delivery and maps. These include Supabase, Lovable, Cloudflare, Resend and Mapbox. Google and Apple process information when you choose their sign-in options. Each provider receives information needed for the function you use.

Information may also be disclosed when reasonably necessary to comply with law, respond to lawful requests, investigate abuse or protect people and the service. Member-visible content and messages are shared as described above. Private saved lists are not shared with partners or advertisers.

There is currently no direct checkout. Before payments are introduced, this policy and the purchase information will identify the payment provider, the data it receives, and the transaction information available to me.

8. How long information is kept

Identifiable newsletter click records and associated recipient snapshots are scheduled for automatic deletion after 90 days, as described above. Newsletter subscription records are kept to administer your subscription. After an unsubscribe, I may retain a minimal suppression record so your address is not added to future sends by mistake.

Account and profile information is kept while needed to provide your account. Conversation records support messaging and participant access. Saved events remain until you remove them or delete your account. Records from retired features remain restricted and can be deleted on request; they will not be used to operate a new service without permission.

Support correspondence, event submissions and operational records are kept for as long as needed to respond, maintain published information, resolve disputes, prevent abuse or meet legal obligations. Retention depends on the purpose, sensitivity of the information, whether an issue remains unresolved, and applicable legal requirements. Information no longer needed is deleted or de-identified. Copies in backups may remain until those backups are replaced, and providers maintain their own operational retention periods.

Any specific legal retention or deletion requirement takes priority over these general criteria.

9. Your choices and privacy requests

Manage newsletter preferences in account settings, unsubscribe from newsletters, or contact me to request access, correction, deletion or consent withdrawal, including changes to retained profile information while profile controls are unavailable. Account deletion and newsletter unsubscribe are separate operations; you may request all of them together.

I may need to verify that a request relates to your information, using only what is reasonably necessary. Do not email passwords, full card numbers or identity documents unless a secure, necessary verification method has been agreed. I will respond within applicable legal deadlines and explain any lawful restriction or extension.

Where applicable law grants additional rights—such as portability, restriction, objection, consent withdrawal, an authorised-agent request, appeal or a complaint to a privacy regulator—you can exercise those rights through hello@germaneventsnyc.com. I will not discriminate against you for exercising a protected privacy right.

10. International processing and legal bases

This service focuses on New York City. Its providers may process information in the United States and other countries. The service name and your nationality do not alone determine which privacy laws apply.

Where EU or UK data-protection law applies, I rely on consent for optional marketing; steps you request or performance of a contract for account and purchased-service functions; legitimate interests, balanced against your rights, for security and essential administration; and compliance with legal obligations where applicable. A separate consent will be requested for an activity when required by law. Marketing consent does not automatically cover every form of tracking.

Where applicable, you may withdraw consent without affecting processing that was lawful before withdrawal, object to processing based on legitimate interests, and complain to the relevant supervisory authority. Contact me for information about processing locations and any safeguards applicable to an international transfer of your information.

11. Security and children

The service uses access restrictions and provider security features to protect information. No system is completely secure. Please use a unique password and take care when sharing personal information in profiles or messages.

The service is not directed to children under 13 and does not knowingly seek their personal information. If you believe a child has provided information, contact me so I can investigate and take appropriate action. Community accounts are for adults aged 18 or older, as set out in the terms of service.

12. Changes and contact

Updates to this policy will show the effective and last-updated dates. Material changes will be communicated in a way appropriate to the change, and fresh consent will be requested where required. For privacy questions, contact Ben Shaw at hello@germaneventsnyc.com.