Privacy policy

• No tracking, no analytics, no advertising.
• Your email address is only used for the reminders you ask for, and only after you confirm it.
• In the chat you pick a name. You need no account and we do not ask for your real name.
• There are two cookies, each only once you use what it is for: one remembers your chat identity, the other your bag in the shop.
• In the shop you pay in the checkout of the band's store on Shopify. This website never sees your payment details.

The controller for this website under the GDPR is the band Ashes of Eden:

For any question about your data, write to this address.

This website is hosted by Vercel. When you open a page, your browser sends technical data that Vercel records in server logs: your IP address, the date and time, the page you asked for, your browser and operating system, and the page you came from.

We need this to deliver the website and to keep it safe from attacks. Legal basis: our legitimate interest in a working and secure website (Art. 6 (1) (f) GDPR). Vercel deletes these logs after [period, to be confirmed].

The fonts are delivered by this website itself. Your browser makes no request to Google or other font services.

If you sign up for a reminder, we store your email address, what you want to hear about (the premiere, and if you tick the box, the merch), the time of your consent and of your confirmation, and a scrambled, non-reversible fingerprint of your IP address that helps us stop abuse. This data is kept in our database at Supabase, which runs in the EU (Paris).

The emails are sent by Resend. Resend receives your email address and the content of the email.

We use double opt-in: after you sign up, you get one email with a link. Only when you click it are you on the list. Then you get the emails we promised on the form: when the date is set, the day before, and when the stream opens. If there is a replay, we may tell you about it.

Every email has a link to unsubscribe. You can unsubscribe any time, and you can also just write to us. Legal basis: your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

You can listen without the chat. If you write in it, we create an anonymous profile for you: the name you pick and a scrambled fingerprint of your IP address, which lets moderators stop abuse. We store your messages with your name and the time. After the closing words you can leave a name, a word or a prayer on the afterglow wall and say which song found you; we store that in the same way. All of this is kept in our database at Supabase in the EU (Paris).

Messages and reactions reach the other listeners live through Ably. For this, Ably receives your IP address, technical connection data and what you post.

Moderators can delete messages, hide entries and block profiles that break the rules. Legal basis: providing the chat you choose to use (Art. 6 (1) (b) GDPR) and our legitimate interest in a safe room for everyone (Art. 6 (1) (f) GDPR).

The film and the album are delivered by Cloudflare Stream. To send the video to your browser, Cloudflare processes your IP address and technical data about your device and connection. Legal basis: our legitimate interest in delivering the stream reliably to everyone at the same time (Art. 6 (1) (f) GDPR).

The reminder form and the chat sign-in are protected by Cloudflare Turnstile. It checks in the background whether a person or a bot is at work, usually without you having to do anything. For this, Cloudflare processes your IP address and technical data about your browser. Legal basis: our legitimate interest in protecting the sign-up and the chat from spam and abuse (Art. 6 (1) (f) GDPR).

The band sells its merch in the shop on this website. Products, prices and your bag come from the band's store at Shopify; this website shows them and passes on what you choose.

When you put something in your bag, we set a cookie named aoe_cart. It holds only the ID of your bag at Shopify, nothing about you, so the bag is still there when you come back. It is kept for 30 days after your last change to the bag.

For your bag, Shopify receives what is in it, your IP address and your country. Shopify uses the IP address to tell people from bots. We work out your country from your IP address, so that prices, tax and currency fit where you are. This website does not keep your IP address or your country; Shopify keeps the country with your bag. Legal basis: the steps you take towards a purchase (Art. 6 (1) (b) GDPR) and our legitimate interest in a shop that bots cannot overrun (Art. 6 (1) (f) GDPR).

When you go to the checkout, you leave this website for the checkout of the band's store on Shopify, at [domain of the checkout]. There you enter what the order needs: your email address, your name, the delivery and billing address and how you want to pay. This data goes to Shopify and the payment provider, not to this website. The checkout runs under the store's privacy policy ([link to the store's privacy policy]) and sets cookies of its own. Shopify explains its own handling of data in its privacy policy: [link to Shopify's privacy policy].

We see your order in the store to pack and send it, and keep it as long as tax and commercial law require. Legal basis: the purchase contract (Art. 6 (1) (b) GDPR) and our legal obligations (Art. 6 (1) (c) GDPR).

We set two cookies, each only when you use what it is for. The chat cookie holds a random ID for your anonymous chat profile, so the chat recognizes you when you come back. It is kept for 180 days. The bag cookie holds the ID of your bag in the shop and is kept for 30 days after your last change. The name you pick for the chat is also saved in your browser's local storage, so you do not have to type it again.

All of this is needed for what you asked to use, so we do not ask for consent. There are no tracking, analytics or advertising cookies on this website. The checkout on Shopify sets its own cookies, explained in the store's privacy policy. You can delete cookies and local storage at any time in your browser settings.

These companies work for us as processors, under a data processing agreement, and only on our instructions:

• Vercel Inc. (USA): hosting of this website
• Supabase Inc. (USA; our database runs in Paris, EU): database for sign-ups, chat and profiles
• Resend (USA): sending the reminder emails
• Cloudflare, Inc. (USA): bot check (Turnstile) and video delivery (Stream)
• Ably Realtime Ltd (United Kingdom): live delivery of chat messages and reactions
• Shopify International Limited (Ireland): the shop: products, bag, checkout and orders

Some of them are based outside the EU or may access data from there. Transfers to the USA rely on the EU-U.S. Data Privacy Framework or on the EU standard contractual clauses. For the United Kingdom, and for Canada, where Shopify also processes data, there are adequacy decisions of the European Commission. [To be confirmed for each provider]

• Reminder sign-ups: until you unsubscribe.
• Sign-ups you never confirm: the link expires after 48 hours, and we delete the sign-up after 7 days.
• Chat messages, chat profiles and the afterglow wall: deleted 90 days after the premiere.
• The chat cookie: 180 days, or until you delete it.
• The bag cookie: 30 days after your last change to the bag, or until you delete it.
• Orders: as long as tax and commercial law require, [period, to be confirmed].
• Server logs at Vercel: [period, to be confirmed].

Under the GDPR you have the right to:

• know which data we hold about you and get a copy (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17)
• have the processing restricted (Art. 18)
• get your data in a common, machine-readable format (Art. 20)
• object to processing based on our legitimate interest (Art. 21)
• withdraw a consent at any time, with effect for the future (Art. 7 (3))

To use any of these rights, write to [Email address]. You also have the right to complain to a data protection supervisory authority, for example the one where you live.

When the website changes, this policy changes with it. The version on this page is the one that applies. Who runs the website is in the imprint.

Draft of 21 October 2026