1. Information We Collect
Account Information: When you register, we collect your email address and create a profile.
Usage Data: We collect information about how you interact with the Service, including events you view, save, and search for.
Profile Data: Information you voluntarily provide such as your name, organization, job title, and SDG interests.
Technical Data: IP address, browser type, device information, and cookies (with your consent).
2. How We Use Your Information
- To provide and improve the Service
- To personalize your event recommendations
- To send event reminders and alerts you have opted into
- To process your subscription payments
- To communicate with you about the Service
- To comply with legal obligations
3. Sharing Your Information
We do not sell your personal data. We may share data with:
- Service Providers: Supabase (database), Stripe (payments), Resend (email). Each subject to data processing agreements.
- Legal Requirements: When required by law or to protect our rights.
4a. Event Analytics
What we log. If — and only if — you opt in via the consent banner or your profile settings, we record three actions on individual events: view (when you open an event page), save / unsave (when you bookmark or remove a bookmark), and registration click (when you click the “Register” link to the external site). For each action we store: which event, which series (if any), the action name, your account identifier or a short-lived per-tab anonymous identifier, the referring site's host (not the full URL), and the timestamp.
What we do NOT log. No IP address. No precise location. No browser fingerprint. No cross-site tracking. No durable anonymous identifier — the anonymous id is generated per browser tab in sessionStorage and is destroyed when the tab closes.
Lawful basis. Consent (Art. 6(1)(a) GDPR). Logging is off until you explicitly opt in. If your browser sends a Do-Not-Track or Global Privacy Control signal, we treat that as an opt-out automatically and the in-app toggle is locked off.
Retention. Raw analytics rows are auto-deleted after 14 months. You can also request immediate deletion of all your analytics rows at any time via Data deletion → Analytics logs.
Who can see what. Organization managers can see aggregate counts (views, saves, registration clicks) and a daily trend for their own org's events. They cannot see who viewed or saved any individual event — the dashboard query explicitly excludes user identifiers, and we never expose them to the client.
Your rights. Access, export, and erasure of analytics data. Change your consent any time at Profile → Privacy preferences.
5. Your Rights
Under GDPR and CCPA, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to processing or request restriction
- Data portability
- Opt out of the sale of personal information (we do not sell data)
To exercise these rights, contact admin@forahub.org.
6. Data Retention
We retain your account data for as long as your account is active. You may delete your account at any time from your Profile settings, which removes all personal data within 30 days.
7. Event Data Sourcing
ForaHub aggregates publicly available event information from organizational websites, press releases, and official event directories. We respect the public nature of this information. If you are an organization and wish to update or remove your event listing, contact us at admin@forahub.org.
8. Security
We implement industry-standard security measures including encrypted data transmission (TLS), secure authentication, and limited access controls. No method of transmission over the Internet is 100% secure.
9. Contact
For privacy questions, contact our data controller at admin@forahub.org.