How RaveDragons handles your data across our website, shop, and mobile app — transparently and under GDPR (AVG).
Who we are
RaveDragons (KVK 42007416, BTW NL869257110B01), Maasdijk 169, 4827 MA Breda, Netherlands. Contact: info@ravedragons.com. We are the controller of your personal data within the meaning of the GDPR (AVG).
This policy covers our website, checkout, and the RaveDragons mobile app.
Personal data we collect
Website and shop
Order data: name, email, phone (optional), shipping address, ordered items, total amount.
Payment data: processed by Mollie B.V. We never see your full card or banking details.
Technical data: IP address, browser type, pages visited, only when you allow analytics cookies.
Communication: messages you send us and our replies.
Community content: festival posts (photos, captions, tags), comments, likes, direct messages, friend requests, festival requests you submit, crew membership and names, crew map pins, crew group chat messages, raised-hand messages (the short intent text and the festival you attach), reports you file, and moderation outcomes.
Crew map (optional): if you join or create a crew and choose to appear on the map, the App reads your device location only while you are viewing the crew map screen (not in the background), at most once every five minutes. We upload a map coordinate snapshot to our servers so other logged-in users can see your approximate position on the crew map. This is a last-known pin, not live tracking — others may see a position from when you last opened the map. Your exact street address is never stored. You can remove your pin at any time in App settings. Device location is also used locally to centre the map on your screen. The crew map's base map is provided by Mapbox; displaying it sends technical request data — including the map area you are viewing and your device IP address, from which an approximate location can be inferred — to Mapbox. To show the place name and current weather for the area you are looking at, the App also sends the coordinates of the map's centre (which you control by panning and zooming) to your device's mapping/geocoding service (Apple on iOS, Google on Android) and to Open-Meteo (a weather provider). These receive only a map coordinate, not your account details.
Rave buddies — Raise Hand (optional): when you “raise a hand” to find rave buddies for a festival, we share a short free-text message you write and the festival you select, together with your exact raise location shown as a precise pin on the map, with other logged-in users near you who are sharing their location, and we may send them a push notification. Raising a hand is an explicit “come find me” action, so only raise a hand when you are comfortable sharing where you are. If you are already sharing a live location on the crew map, that live position is used; if you are not, the App captures your device location at the moment you raise your hand. While your hand is raised, the App periodically checks your device location (roughly every 30 seconds, and only while the crew map is open in the foreground) so your search stays anchored to where you raised it; if you move more than 5 km from that spot, your hand is lowered automatically. The App stops checking your location once you lower the hand or it expires (within 8 hours). You are only discoverable while your hand is raised. When another user joins your hand, the two of you form a crew — a persistent group with a shared name and group chat (the person who raised the hand first becomes the owner); crew data is handled as described in the Crew map and retention sections. You can lower your hand at any time, and you can turn off nearby raised-hand notifications in Settings.
In-app purchases: when you buy a digital feature (such as crew creation), we receive a transaction identifier from Apple or Google to verify the purchase. We do not receive your payment card or bank details.
Event activity: festivals you mark as attending, check-ins, passport memories, wallet/challenge entries where enabled.
Device data: Expo push notification token, platform (iOS/Android), app version when registering for notifications.
Permissions you grant: camera and photo library access when you choose to take or upload photos; Face ID / device biometrics are processed locally on your device for faster login and are not sent to our servers; location access when you use the crew map (see Crew map above) or when a map screen needs to centre on your position.
Maps (iOS and Android): the crew map is rendered using Mapbox on both iOS and Android; other map screens (such as the festival map and event location previews) use Apple Maps on iOS and Google Maps on Android. When you open a map screen, the relevant map provider may process technical data needed to render the map.
Why we use your data and our legal basis
Contract (Art. 6(1)(b) GDPR): processing shop orders, shipping, after-sales support; providing App accounts, festival features, rave-buddy matching (Raise Hand), crews, and digital purchases (such as crew creation) you request.
Consent (Art. 6(1)(a) GDPR): optional analytics/marketing cookies on the website; push notifications (device permission); non-essential marketing where applicable.
Legitimate interest (Art. 6(1)(f) GDPR): preventing fraud and abuse; securing our services; automated content moderation to keep the community safe; improving our products.
Automated moderation
Photos and text you submit in the App (posts, avatars, direct messages, crew chat) may be scanned automatically before publication or delivery using Amazon Rekognition and automated text checks. This helps detect illegal or prohibited content. If content is blocked, you will see a message in the App. Automated decisions do not permanently ban accounts without human review in serious cases.
How long we keep your data
Orders and invoices: 7 years (Dutch fiscal law).
App account and profile: until you delete your account, then erased without undue delay except where we must retain data by law.
Festival posts and messages: for the active festival window and a limited period afterwards, then deleted or anonymised; exact timing may vary by feature.
Crew data: crew membership, chat, and map pins are kept while the crew is active and you remain a member. If you leave, are removed, or delete your account, your membership and map pin are removed. If a crew is dissolved, crew chat and related data are deleted. Purchase records for in-app features may be retained as needed to verify transactions and handle refunds.
Raise hands: a raised hand is removed when you lower it or automatically within 8 hours. If a hand leads to a match, the resulting crew and its chat are kept as described under “Crew data” above. Reports you file are kept as needed for moderation.
Push tokens: until you sign out, disable notifications, or delete your account.
Marketing/analytics (website): no longer than 24 months and only with your consent.
Support messages: no longer than 12 months unless needed for an ongoing dispute.
Who we share data with
Payment: Mollie B.V., the Netherlands (website checkout); Apple App Store and Google Play (in-app purchases in the App).
Hosting and database: Vercel and Supabase (EU regions where available).
Content moderation: Amazon Web Services Rekognition (image analysis; EU region recommended).
Maps, geocoding and weather: Mapbox (crew map display, iOS and Android); Apple (iOS map display and place-name lookup) and Google (Android map display and place-name lookup); Open-Meteo (current weather for the map area you are viewing).
Shipping carriers used to deliver shop orders.
Authorities when legally required.
We never sell personal data.
International transfers
Where data is processed outside the EU/EEA (for example by Expo, AWS, Mapbox, or Open-Meteo depending on configuration), we rely on EU Standard Contractual Clauses or equivalent safeguards and limit transfers to what is necessary to provide the service.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You can delete your App account in Settings. Email info@ravedragons.com for other requests. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Children
The App is not intended for users under 16. We do not knowingly collect data from children under 16. Contact us if you believe a child has created an account.
Security
Connections are encrypted (HTTPS/TLS). Passwords and passcodes are stored hashed; sensitive secrets are stored only on the server. Database access is restricted to least-privilege service roles.
Changes
We may update this policy. Material changes will be communicated on the site or in the App.