Privacy Policy

1. Who is responsible (controller)

The controller within the meaning of Art. 4(7) GDPR for all processing described here is:

Demo Nights is co-organised by Dominique Paul, who acts on behalf of the controller. Full operator details are in our Impressum. We have not appointed a Data Protection Officer, as we are not legally required to; for all data-protection matters contact the email above.

2. What we process, and where it comes from

We only process personal data that you give us, that is technically required to deliver the site, or that arises from taking part in a Demo Night. In detail:

2.1 Visiting the website

When you open demonights.eu, our hosting provider Netlify receives the technical data your browser sends with every request (IP address, date and time, requested page, referrer, browser and operating system) and keeps it in short-lived server logs for delivering the site, capacity management and defence against attacks. We do not use these logs to identify visitors.

We currently run no web-analytics or tracking service on demonights.eu. Should we switch on a cookieless, aggregate-only measurement tool in the future, we will describe it here first.

Our web fonts are loaded from Google Fonts (fonts.googleapis.com / fonts.gstatic.com) and Fontshare (api.fontshare.com / cdn.fontshare.com). To deliver the font files, these providers necessarily receive your IP address and the usual request metadata. No cookies are set by these requests. Legal basis: our legitimate interest in a consistent, fast-loading presentation (Art. 6(1)(f) GDPR).

2.2 Forms on the website (apply, sponsor, notify)

The three forms on the homepage are handled by Netlify Forms and store exactly what you type:

• Apply to demo: name, email address, what you want to demo, optional links to your project, and your city.
• Sponsor: name, company, email address and your message.
• Get notified: email address, optional city, and your consent checkbox.

Each form contains a hidden anti-spam field (“honeypot”) that humans never see; submissions that fill it are discarded. Netlify also records the submission time and technical metadata for spam filtering.

2.3 Event registration via Luma

Tickets for Demo Nights are issued through Luma (luma.com), an independent event-registration platform with its own privacy policy. Luma collects your registration data directly. Before and during an event we export the attendee list from Luma (name, email address, phone number if you gave one, ticket and check-in status, and all answers you gave at registration — e.g. what you’re building, your LinkedIn/X/GitHub links and your comments; the complete export row is kept as submitted) and import it into our event tool in order to run check-in, build the demo line-up, and — if you registered as a demoer — list your demo on the live ballot and on this site. Demo titles are shown publicly; the names of demoers are published only for prize winners.

2.4 Live voting and feedback (/vote)

At each edition the audience votes for the prize categories by scanning a QR code. Two modes exist:

• Vote without sign-in (default): your phone receives a technically necessary, signed device cookie containing a random identifier. It is used solely to ensure one ballot per device per category and is not linked to your name or email unless you sign in. Stored: the demo you voted for, the prize category, the device identifier and the time of the vote.
• Vote with sign-in: for some editions we may require a verified vote. You then enter your email address, receive a one-time code by email (sent via our authentication provider Supabase) and your ballot is linked to that email so that one person can vote once per category — in this mode organizers could in principle see how a given attendee voted; they do not publish or use this. Optionally we restrict voting to people checked in on Luma.

You may leave free-text feedback for a demo; it is stored with the ballot identifier and shown to the organizers and, in anonymised form, to the demoer. Please do not include personal data about third parties in feedback.

Votes are shown to attendees only as aggregate results after the organizers close the vote; individual ballots are never published. To prevent automated abuse, our rate-limiting keeps short-lived counters keyed by a keyed hash of your IP address (never the plain address); these counters are purged daily and are not linked to your ballot.

2.5 Event photo gallery (/gallery)

Attendees can upload photos and short videos from the evening to a shared gallery and download them. When you upload, we store the file, its size and type, the upload time, the edition it belongs to and the same signed device identifier as above (so that you can delete your own uploads and so we can act on abuse). Photos are re-encoded in your browser before upload, which normally removes camera metadata (EXIF, including GPS location); in rare cases where your browser cannot re-encode a file, the original is uploaded as it is — so strip metadata yourself if that matters to you.

Uploaded photos typically show other attendees. We process such images on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in documenting and promoting a public event, balanced against the interests of the people shown; galleries are only opened by the organizers and may be protected with a password handed out at the event. If you appear in a photo and would like it removed, email us and we will take it down without undue delay (see section 8). Organizers can review, hide and delete any upload.

Photo and video files are stored in Cloudflare R2 object storage, the index of the gallery (which file belongs to which edition, upload time, device identifier) in our Supabase database. Files are only ever served through demonights.eu; the storage itself is not public.

2.6 Organizer area (/admin)

Organizers log in either through Cloudflare Access (Cloudflare sends a one-time code to the organizer’s email address, or they sign in with a Google account; Cloudflare then confirms the verified email address to us) or with an email sign-in link issued by Supabase Auth. A successful login sets a session cookie (HttpOnly, Secure, 7 days) containing a signed token with the organizer’s email address. Only the organizers’ own email addresses are processed here; this area is not available to the public.

2.7 Email and other contact

If you email us, or we correspond with you about an application, a sponsorship, a talk or a prize, we process the data contained in that correspondence (name, email, content) to answer and follow up.

3. Purposes & legal bases

Where we rely on legitimate interest, our interest is in running, funding, securing and communicating about a free community event; we have weighed it against your interests and provide an easy way to object (section 7). Providing your data is voluntary; without it we simply can’t process an application, vote, or upload.

4. Cookies & local storage

We use no advertising, tracking or third-party cookies, and therefore show no cookie banner. The only cookies are strictly necessary for the functions you actively use (§ 25(2) no. 2 TDDDG / Art. 5(3) ePrivacy):

The gallery and admin pages may additionally keep small settings or cached thumbnails in your browser’s local storage purely for speed; nothing in it leaves your device. The homepage’s 3D cards read your device’s motion sensors only after you tap “allow motion”; this is processed in your browser and never transmitted.

5. Recipients, processors & international transfers

We do not sell or rent personal data. We share it only with the service providers below, which process it on our behalf and on our instructions under data-processing agreements pursuant to Art. 28 GDPR, or with authorities where the law requires it.

Where data is transferred to the USA or other third countries, we rely on the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023). You can request a copy of the relevant safeguards from us.

6. How long we keep your data

• Get-notified list: until you withdraw consent (reply to any email or write to us); then deleted.
• Demo applications and sponsor enquiries: for the duration of the selection and correspondence; if not selected and no further contact is agreed, deleted or anonymised 12 months after the edition you applied for.
• Attendee lists imported from Luma: deleted from our event tool within 3 months after the edition; anonymised demo titles remain in the public record of past editions.
• Votes and feedback: individual ballots and feedback are deleted or irreversibly anonymised within 3 months after the edition; only aggregate results and winners are kept. Rate-limit counters are purged daily.
• Gallery photos and videos: as long as the gallery of that edition is online (typically up to 24 months), or earlier on request of the uploader or a person shown.
• Published winners (name and project): indefinitely as part of the event archive, unless you object.
• Server logs (Netlify): deleted automatically after at most 30 days.
• Emails and correspondence: for the duration of the relationship plus statutory retention periods that apply to business correspondence (up to 6 years, § 257 HGB / § 147 AO) where relevant.

We delete or anonymise personal data as soon as its purpose has ended and no legal retention duty applies.

7. Your rights

Under the GDPR (and, for people in Switzerland, the FADP) you have the right to:

• Access — confirmation of and a copy of the data we hold about you (Art. 15).
• Rectification — correction of inaccurate data (Art. 16).
• Erasure — deletion of your data (Art. 17), including removal of photos you appear in and anonymisation of your winner entry.
• Restriction of processing in certain cases (Art. 18).
• Data portability — your data in a structured, machine-readable format (Art. 20).
• Object — to any processing based on legitimate interest, for reasons arising from your particular situation (Art. 21). We then stop unless we can show compelling legitimate grounds.
• Withdraw consent — at any time with effect for the future, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise any right, email ben@physicalfusion.ai. We answer within one month. We may ask you to confirm your identity (for example by writing from the email address concerned) so that we don’t hand your data to someone else.

8. Photography and filming at our events

Demo Nights are public events. Organizers, partners and attendees take photos and short videos during the evening. We use them on demonights.eu (gallery and edition cards), in our social-media channels and in materials about Demo Nights to document the event and announce future editions. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) together with §§ 22, 23 of the German Art Copyright Act (KUG) for images of public events; for group and stage photos this interest usually prevails, and we avoid publishing close-ups of individuals who clearly object.

If you prefer not to be photographed, tell a member of the team on the night. If you later find a picture of yourself that you want removed, email us with a link or description and we will take it down from our channels without undue delay.

9. Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

In Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

10. Note for Switzerland (FADP)

Demo Nights also takes place in Zürich. Where the revised Swiss Federal Act on Data Protection (FADP / revDSG) applies, the information in this notice also serves as information under Art. 19 FADP; the references to GDPR articles apply to the corresponding FADP provisions, and the rights listed in section 7 (information, access, correction, deletion, objection) are equivalent. Given the limited scale and low risk of our processing, we are not required to appoint a representative in Switzerland (Art. 14 FADP). Data is transferred to the countries named in section 5 on the basis of the safeguards described there.

11. Changes to this notice

We update this notice when our services or the law change; the current version is always published here with its date. Significant changes relevant to a running event will additionally be announced on the relevant page (for example on /vote or /gallery).