Field notes & policies

Para-Storm Fest Privacy Policy

Last Updated: August 31, 2026

This Privacy Policy describes how Para-Storm Fest ("we," "us," or "our") handles information through para-stormfest.net (the "Site"). It is a notice about current practices, not a request for marketing consent.

1. Information We Collect

We collect both information you provide directly and information automatically collected when you interact with our Site.

A. Information You Provide Directly

We may collect information that you voluntarily provide through forms, email, or registration, such as:

• Name
• Email address
• Phone number
• Business or vendor information
• Application details, including business links, merchandise or service descriptions, and attendance counts

The Site does not host a card-entry form. A linked ticketing, merchandise, CAPTCHA, hosting, or payment provider may collect additional information under its own privacy notice.

Para-Storm Fest does not collect or store full payment-card numbers or card security codes through this Site. If ticket or merchandise sales are enabled, card entry remains on the approved third-party provider's hosted service under that provider's security, privacy, and payment-card obligations.

B. Information Automatically Collected

When you visit or interact with the Site, certain technical information may be automatically collected by our hosting and security infrastructure (including Cloudflare). This includes:

• IP address and approximate geolocation
• Browser type and version
• Device type, operating system, and screen resolution
• Internet service provider (ISP)
• Referring and exit pages
• Date, time, and duration of visit
• User-agent string
• Security and performance data (e.g., firewall events, bot detection, and access logs)
• Aggregate analytics data regarding site performance and traffic sources

This data is used for security, analytics, and operational purposes to protect the Site from abuse and ensure reliable performance.

Cloudflare provides hosting, security, and request-level operational data. If you enable the optional Analytics and monitoring category, the Site also initializes Sentry for error and performance monitoring with default personal-information collection disabled. Error-event request URLs are stripped of query strings and fragments before reports are sent; performance traces and browser breadcrumbs may still include page or route context and timing. Browser session replay is disabled. Sentry and Site-operated event telemetry stay off until that optional category is enabled.

2. Use of Information

We use the information we collect to:

• Respond to inquiries and support requests
• Review vendor applications and team registrations
• Send transactional replies about a submitted application, registration, or support request
• Improve and maintain the Site and user experience
• Protect against fraudulent or unauthorized activity
• Comply with legal obligations

3. Sharing of Information

Information may be handled by service providers used to operate, secure, and respond through the Site, including:

• Ticketing and registration providers
• Email and communication platforms
• Payment processors
• Web hosting and security providers (e.g., Cloudflare)

We do not currently use application or registration information for sale or behavioral advertising. If actual practices change, this notice must be updated before the change is introduced.

The public forms are for applications, registrations, and support. They do not subscribe a person to promotional email, automated calls, or text messages. If a marketing program is introduced, the organizer must add the required consent, sender identification, unsubscribe, suppression, and recordkeeping controls before the first campaign.

4. Cookies & Similar Technologies

The Site provides a privacy-choice popup on public pages, a floating Cookies control after a choice is saved, and Cookie Policy and Cookie Preferences controls in the footer. Rejecting optional technologies does not prevent the Site from using limited storage or processing needed to remember your choice, provide a preference you request, secure a form, or deliver core hosting and security.

A. Necessary and Requested Functions

• Privacy choice: local storage records the consent version, optional-category choices, and save time so the popup does not ask on every page.
• Accessibility preferences: local storage remembers settings you select in the Accessibility panel.
• Popup dismissal: session storage remembers that a festival announcement was closed for the current browser session.
• Form and account security: protected application and authentication forms may load Google reCAPTCHA to detect abuse. If you prefer not to use the protected form, contact the festival by email instead.

B. Optional Analytics and Monitoring

If enabled, Site-operated telemetry creates a random pseudonymous visitor identifier in local storage and sends page or action type, current path, referring page, page title, viewport width where applicable, and request time to the first-party events endpoint. Sentry error, log, metric, and sampled performance-trace delivery is also enabled through the Site's Sentry tunnel. These services are not used for behavioral advertising. Turning this category off prevents future optional telemetry and removes the browser's stored visitor identifier; it does not retroactively delete records already received.

C. Optional External Checkout

The TicketSpice checkout iframe is blocked until the External checkout category is enabled. Loading it connects your browser to the configured ticketing service, which may use its own cookies or similar technologies under its notice. Ordinary Facebook, Instagram, TikTok, merchandise, and other external links do not load those services into this Site; the connection occurs after you follow the link.

D. Choice Duration and Provider Boundaries

Your browser keeps the privacy choice until you change it, clear Site storage, or the consent version changes. Cloudflare may separately process request metadata necessary to host, secure, and deliver the Site. The organizer has not yet approved a fixed retention period for pseudonymous event records; that unresolved boundary is disclosed here rather than describing the records as anonymous. You may use Cookie Preferences in the footer to accept, reject, or revise optional choices at any time.

5. Storage, Retention, and Security

Application and registration submissions are stored in the website's configured database, and a notification copy is sent through the configured email service so the festival team can respond. Hosting, security, CAPTCHA, email, and database providers process information needed to deliver those functions. A fixed retention schedule has not yet been approved; records are retained for operational and legal needs while that schedule is pending. We use access controls and transport security, but no internet or storage system can be guaranteed completely secure.

6. Your Choices and Privacy Rights

You may request:

• Access to your personal information
• Correction of inaccuracies
• Deletion of information, subject to legal, security, recordkeeping, and operational needs
• Restriction of or objection to certain processing where applicable
• A portable copy of information you provided where applicable
• Withdrawal of consent for optional technologies at any time through the floating Cookies control or Cookie Preferences in the footer

Send a request to the address below. We may need to verify the request and will explain if information must be retained: team@para-stormfest.net

Where a comprehensive U.S. state privacy law applies, available rights may include confirming whether information is processed, access, correction, deletion, portability, and opting out of a sale, sharing, or targeted advertising. The Site does not currently sell application or registration information, share it for cross-context behavioral advertising, or use it for targeted advertising. If an applicable law provides an appeal after a request is denied, reply to the decision and ask that it be treated as an appeal.

7. GDPR and Similar Privacy-Law Information

Where the European Union or United Kingdom GDPR, or a similar privacy law, applies to a person or processing activity, Para-Storm Fest acts as the controller for information it collects through this Site. Contact the organizer at the address below for controller questions or a rights request.

Depending on the activity, the intended legal bases are:

• Consent for optional analytics, monitoring, and external-checkout technologies.
• Steps requested before an agreement when reviewing a vendor application, team registration, or related inquiry.
• Legitimate interests in operating, securing, troubleshooting, and responding through the Site, balanced against the rights of affected people.
• Legal obligations when records or disclosures must be kept or provided by law.

You may also object to processing based on legitimate interests and, where applicable, lodge a complaint with the data-protection authority where you live or work. Withdrawing consent does not affect processing that was lawful before withdrawal. The public forms do not make solely automated decisions that produce legal or similarly significant effects.

8. Children's Privacy

The Site is a general-audience festival website and is not directed to children under 13. Family attendance at the event does not make the public vendor, team, account, or support forms child-directed, and the organizer does not knowingly use those forms to solicit personal information from children under 13. Contact us if you believe a child provided information through the Site so the organizer can investigate and take the action required by applicable law.

Before adding a child-directed activity, profile, recording, contest, or form, the organizer must reassess age screening, parental notice and consent, data minimization, deletion, advertising, and biometric or media collection requirements.

9. International Provider Processing

The Site and its providers may process information in the United States or other countries. Where a restricted international transfer rule applies, the responsible party must use an available lawful transfer mechanism and appropriate safeguards. Contact the organizer to request current information about applicable provider safeguards; provider contracts and transfer settings require periodic organizer review.

10. Updates

We may revise this Privacy Policy periodically. Updates will be posted on this page with a new "Last Updated" date. Material changes will be described before they apply where notice is required.

Effective Date: August 31, 2026
Contact: team@para-stormfest.net