Privacy policy.

The Archive Pass is run by Leandro Miguel Vasconcelos Antunes, a sole trader (empresário em nome individual) based in Lisbon, Portugal, with tax number (NIF) 275828476. That person is the data controller for the personal data collected through this site, the waitlist, and our support email.

You can reach us at any time at support@thearchivepass.com.

When you join the waitlist, we ask for your name, email address, and city. If you want, you can also give us your Instagram handle, your TikTok handle, and a short note. You also tick a box to confirm we can email you, and we store the exact wording you agreed to so we have a record of your consent.

When you visit, we automatically pick up some technical and marketing data: how you got here (for example the link, campaign, or ad you came from, through UTM tags and the referring page), and a generated event ID that lets us match one signup to one ad click without double-counting. Our analytics and advertising tools also collect usual things like your IP address, device, and how you move through the site.

When you become a member, your card details are entered with and handled by Stripe, our payment processor. The Archive Pass never sees or stores your full card number. We keep a record that you are a member (in our database) so the membership works.

If you choose to add your membership to Apple Wallet or Google Wallet, we create a pass with a pseudonymous pass identifier, your membership tier, and a link whose QR code checks your current membership live. The Apple pass can also show the name and member code already displayed on your Archive pass. The standard Google pass deliberately does not include your name, email, member code, card details, or Stripe information. During an account-scoped test, a personalised Google Founders preview limited to the Archive operator's own account may send Google the name, public member code, and ‘Since’ year already shown on the Archive pass so Google can display them. It does not send email, card details, or Stripe information. This preview remains test-only while we confirm Google's policy requirements.

At events, we and the people we work with may take photos and video, which can show you, so you should expect an event may be photographed or filmed. We may use these images in our own communications, and to feature you recognisably in a paid advert we ask you first. You can opt out on the night or by emailing support@thearchivepass.com, and we will not publish images where you are identifiable. Our Terms explain this too.

We use your name, email, and city to manage the waitlist, email you launch news, answer your support messages, and understand who wants The Archive Pass and from which cities.

We use product analytics (PostHog) to see how people use the site and what needs fixing. When you join the waitlist, we link that event to your email, name, and city, so PostHog holds data that can identify you, not anonymous numbers.

We use the Meta pixel to measure and improve our ads, and only after you accept advertising cookies. Some events (a page view, and a Lead when you join) are shared with Meta from your browser. We do not send Meta your email address, and we do not run a server-to-server connection to them. The marketing data we pick up automatically (UTM tags, referrer, event ID) feeds this so we can tell what is working.

We do not make any decision about you by purely automated means, and we do not profile you in a way that has a legal or similarly significant effect.

We do not sell your information. A few trusted companies process it on our behalf so we can run things, and we only share what each one needs to do its job:

Supabase stores the waitlist (and the members table once memberships open) in a Postgres database.

Vercel hosts the site and serves it, so it handles requests and basic server logs. Vercel Analytics also measures page traffic, and only after you accept analytics cookies.

Resend sends our email. It receives the address we are writing to, your name, and the contents of the message, so that membership, reservation and news emails can reach you.

GitHub holds our encrypted database backups, so that we can restore the service if something is lost. The backup is encrypted before it leaves our machine.

Stripe processes payments when memberships open, including your card details, which it handles directly.

PostHog runs our product analytics and receives your email, name, and city tied to your activity on the site.

Meta Platforms (Facebook and Instagram) receives advertising events through the Meta pixel in your browser, to measure our ads. It does not receive your email address. For this advertising, Meta may act with us as a joint controller rather than only as a processor.

Google runs our support inbox (Gmail), so emails you send to support are processed by Google.

Apple and Google provide the optional Wallet services. If you ask us to add your pass, the chosen provider processes the pass data needed to store and display it in your Wallet account or device.

When you go to a night through your membership, we share your name and your membership status with the partner venue or promoter running that event, so their door can check you in. They may only use it to validate your entry, cannot use it for their own marketing, and delete it after the event.

We ask each of these companies to protect your data and to use it only for what we ask. If a court or the law requires it, we may also have to share data, and we would only do so where we are legally obliged.

We keep data in Europe where we can. Our database (Supabase) is hosted in Zurich, Switzerland, which the European Commission recognises as providing adequate protection, so data can be kept there under the same rules as inside the EU. PostHog (analytics) is set to an EU region. Some providers are US-based, so some data is still processed outside the European Economic Area: Meta (advertising), Vercel (hosting, delivery and traffic measurement), Resend (sending our email), GitHub (encrypted backups), Google (our support inbox and Google Wallet), and Apple (Apple Wallet).

When data goes outside Europe, the law expects a safeguard. These transfers are meant to be covered by mechanisms such as the EU Standard Contractual Clauses or, where available, the EU-US Data Privacy Framework, which we are putting in place with each provider. If you want to know exactly what protects your data with a given provider, email us and we will tell you what we have.

We use cookies and similar storage. Some are essential, like the local storage that remembers your chosen language. Others are not essential: PostHog (analytics) and the Meta pixel (advertising) set cookies or storage to do their job.

Non-essential analytics and advertising only run with your consent. When you first visit, we ask, and nothing non-essential runs until you accept. You can change your mind at any time on our cookies page at /cookies.

We join you to the waitlist and send you launch emails based on your consent, given through the checkbox on the form. PostHog analytics and the Meta pixel also run on your consent, given through the cookie banner. You can withdraw any of these at any time, and that does not affect anything we did lawfully before.

We answer your support messages and prepare to offer you a paid membership based on our legitimate interest in helping you and getting ready to launch, and to take steps before a contract at your request.

Photos and video from events, used in our own communications, run on our legitimate interest in showing what the nights are like, and you can opt out at any time as described above. Where we feature someone recognisably in a paid advert, we rely on their consent.

Paid memberships and card processing run on the contract between us. Keeping accounting and tax records runs on a legal obligation.

Sharing your name and membership status with a partner venue to check you in at an event runs on your membership contract with us, so we can deliver the access and perks you signed up for.

Creating an Apple Wallet or Google Wallet pass is an optional part of the membership service that we perform only when you ask for it, so it runs on our membership contract and the steps you request before we deliver that feature.

We keep your waitlist details (in Supabase) while The Archive Pass is launching and while you still want to hear from us. If you withdraw consent or ask us to delete them, we remove them, except anything we are legally required to keep.

We keep support emails for as long as we need to handle your request and a reasonable time after.

Once memberships open, accounting and tax records have to be kept for the period Portuguese law requires, which is generally around ten years.

Analytics and advertising data held by PostHog and Meta is kept according to those companies' own retention settings, which we configure to be as short as we reasonably can.

An Apple Wallet pass stays on your device until you remove it. A Google Wallet pass stays in your Google account according to your Wallet settings and Google's retention rules. If your membership ends or you delete your Archive account, its QR validation stops confirming access and the public validation page no longer reveals member identity. You can remove either pass from Wallet at any time.

You can ask us to access, correct, export (data portability), restrict, object to, or delete your personal data. If you are on the waitlist, you can also ask us to take you off the list. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not undo anything we did lawfully before.

To change your cookie and tracking choices, including analytics and the Meta pixel, use our cookies page at /cookies.

Just email support@thearchivepass.com and we will get back to you, normally within 30 days.

If you are in Portugal or the EU and you think we have got something wrong, you have the right to complain to your data protection authority. In Portugal that is the CNPD (Comissão Nacional de Proteção de Dados).

The Archive Pass is meant for adults (18 and over) and is not directed at children. We do not knowingly collect data from children. If you think a child has given us their data, email us and we will delete it.