Last Updated: September 26, 2026

Want to delete your account? How deletion works, and how to start it.

What we set on your device

We try to keep this simple. The lists below cover every cookie our site sets, every key we save in your browser's local storage, and every place we send what you type. If something here changes, we update this page.

Last audited: 2026-05-04.

Cookies

Cookies are small files stored by your browser. We use them sparingly.

Name	Category	Purpose	Lifetime
xlnt_session	Strictly necessary	Authenticated session token Set by: Server-side auth flow (gated in lockdown — never set on the marketing site without sign-in, which is hidden in lockdown).	Session
xlnt_cookie_consent	Strictly necessary	Stores the visitor's cookie consent choices (Do Not Sell or Share, analytics, functional). Without this, the consent UI cannot remember the choice. Set by: scripts/cookie-consent.njk.	90 days
xlnt_privacy_notice	Strictly necessary	Tracks dismissal of the consent nudge bar so it does not reappear on every page load. Set by: scripts/cookie-consent.njk.	7 days
xlnt-theme	Functional (legitimate interest)	Light / dark / auto theme preference for the marketing site. Set by: scripts/settings-menu.njk (mirrored to localStorage).	1 year
CF_AUTHORIZATION	Strictly necessary	Cloudflare Zero Trust access gate. Blocks anonymous traffic on non-prod environments. Not present in production. Set by: Cloudflare Access (non-prod environments only — staging, lane previews).	Session
_ga	Analytics	GA4 client identifier. Set by: Google Analytics 4 — only loaded if analytics-ga4-{env} setting is configured AND the visitor's stored consent grants analytics_storage.	2 years
_gid	Analytics	GA4 session/visit identifier. Set by: Google Analytics 4 — same gating as _ga.	24 hours

Browser storage

Some preferences live in your browser's local storage instead of cookies. They never leave your device unless you submit a form that includes them.

Name	Type	Category	Purpose
xlnt-theme	localStorage	Functional	Theme preference (mirrors the cookie of the same name).
xlnt_events_zip	localStorage	Functional	Visitor's entered ZIP code for homepage geo personalization.
xlnt_events_location	localStorage	Functional	Resolved city/county label paired with the stored ZIP.
auto-open-sheet:seen-versions	localStorage	Functional	Suppresses repeat auto-opens of versioned sheets after the visitor has dismissed one.

What we send to our servers

Forms and a few configuration loaders send data back to our servers. Form submissions are always something you typed and pressed submit on.

Endpoint	Triggered by	What's sent	Lawful basis
POST /api/signals type='contact'	ContactForm submission on /contact-us/	Visitor-provided name + email + subject + message	Consent by submission
POST /api/signals type='preference'	Be the Signal section pill submissions	None — aggregate selections only, no email captured	Legitimate interest (aggregate-only telemetry posture)
GET /api/community/nearby ?zip={zip}	Hero geo derivation chain on the homepage	Visitor-provided ZIP (5-digit) — used to derive city/county; not persisted server-side beyond standard request logs	Legitimate interest

Third-party services

We rely on a small number of outside services to deliver fonts, analytics, and acknowledgment emails. Each one is listed here.

Provider	Host	Purpose	Cookies
Cloudflare Web Analytics	static.cloudflareinsights.com/beacon.min.js	Cookieless site analytics. Only loaded if analytics-cloudflare-{env} is configured.	None
Google Analytics 4	googletagmanager.com/gtag/js	Site analytics. Loaded via gtag consent mode — analytics_storage defaults to denied per base.njk and is granted only after explicit consent through the existing cookie-preferences UI.	_ga, _gid (see Cookies above)
Resend	api.resend.com (server-side)	Server-side delivery of acknowledgment emails (ContactForm acks, Newsletter acks). Egress only; no client-side SDK.	None
SimpleMaps US ZIP dataset	static reference data (no runtime fetch)	ZIP → county/city resolution. Loaded as static reference data at build time.	None

Your choices

You can review and change your cookie preferences at any time using the Privacy Choices control below. California residents may use this same control to exercise their CCPA rights regarding personal information.

Your choices

Privacy Policy

Summary: XLNT Events is a service operated by XLNT Experiences, LLC (“we,” “us,” or “our”). We respect your privacy: we collect only the information needed to provide our services, we never sell your data, and we give you control over your information.

1. Information We Collect

1.1 Information You Provide

When you interact with our services, you may provide us with:

• Contact Information: Name, email address, phone number, and location
• Date of Birth: Asked for when you create an account (see Date of Birth below)
• Profile Information: Your role (venue owner, musician, chef, etc.), business details, and professional background
• Preferences: Event interests, communication preferences, and feedback
• Communications: Messages you send to us through forms, email, or other channels

1.2 Information Collected Automatically

When you visit our website, we may automatically collect:

• Device Information: Browser type, operating system, and device identifiers
• Usage Data: Pages visited, time spent, and interaction patterns
• Location Data: General geographic location based on IP address
• Referral Information: How you found our website (search engine, social media, etc.)

1.3 Date of Birth

When you create an account, we ask for your date of birth.

• Why we ask: To confirm that you are 18 or older, which is required to have an account.
• How we hold it: Your date of birth is stored apart from your profile, in restricted storage for identity information. It is never shown on your profile or on any public page. We do not verify your age against identity documents; we rely on the date you give us. Venues may check identification at the door.
• How long we keep it: For as long as you have an account. When you delete your account, your date of birth is withdrawn from use immediately and permanently erased seven days later, when the period in which you can cancel the deletion ends.

2. How We Use Your Information

We use the information we collect to:

• Provide Services: Process event registrations, manage partnerships, and deliver experiences
• Communicate: Send event invitations, updates, and respond to inquiries
• Acknowledge Your Input: Send confirmation emails when you submit feedback, feature signals, suggestions, bug reports, or support requests through the platform
• Improve: Analyze usage patterns to enhance our website and services
• Personalize: Tailor recommendations based on your interests and preferences
• Protect: Detect and prevent fraud, abuse, and security threats
• Legal Compliance: Meet our legal and regulatory obligations

2.1 Transactional Emails

By providing your email address — whether during registration, when signaling interest in a feature, or when submitting feedback — you agree to receive transactional emails related to your activity on the platform. These include:

• Account-related messages (security alerts, password resets, consent updates)
• Event confirmations and updates for events you register for
• Acknowledgment emails confirming receipt of feedback, feature signals, suggestions, bug reports, or support requests you submit
• Release updates about platform improvements shaped by community input

Transactional emails are part of the service and cannot be opted out of while your account is active. Marketing communications (event recommendations, community newsletters) are optional and can be managed in your communication preferences.

2.2 SMS Communications

When you provide a phone number — during signup or in your profile — you may receive transactional SMS messages from XLNT Events. These include:

• Verification codes for signup, login, and account recovery
• Booking confirmations when you reserve a spot at an event
• Event reminders the day of an event you have booked, hosted, or are contributing to
• Schedule changes if an event you are involved in is updated, postponed, or canceled
• Payment receipts for tickets purchased and contributor payouts received

We do not share your mobile information — including your phone number, opt-in status, or message content — with third parties or affiliates for their marketing or promotional purposes. Phone numbers are used solely to deliver the messages described above and to verify your identity.

Standard message and data rates may apply. Message frequency varies based on your activity on the platform. To opt out at any time, Reply STOP to any message. Reply HELP for support. Opting out of SMS does not affect your account or your ability to receive email notifications.

For questions about SMS, contact help@xlnt.events.

3. Legal Basis for Processing

We process your personal information based on:

• Consent: When you explicitly agree to specific uses (e.g., marketing communications)
• Contract Performance: To fulfill our obligations when you register for events or partner with us
• Legitimate Interests: For business operations that don’t override your privacy rights
• Legal Obligations: When required by applicable law

4. Information Sharing

4.1 We Never Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4.2 Limited Sharing

We may share your information with:

• Service Providers: Companies that help us operate our business (hosting, email, analytics) under strict confidentiality agreements
• Event Partners: Venues, artists, and collaborators involved in events you attend, only as necessary
• Legal Requirements: When required by law, court order, or to protect rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit (HTTPS/TLS)
• Secure data storage with access controls
• Regular security assessments and updates
• Employee training on data protection
• Incident response procedures

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain business records

When no longer needed, we securely delete or anonymize your data. You may request deletion at any time (see Your Rights below).

6.1 Deleting Your Account

You can ask us to delete your account at any time. We accept your request straight away and never refuse it. This is exactly what happens, and when:

• Straight away: Your profile, photo, preferences and interests are withdrawn from use, and your account becomes read-only. You can still sign in, but only to see where your deletion is up to, anything it is waiting on and why, and how to contact us.
• For 7 days: You can cancel the deletion, and everything comes back: your account, your information and your points.
• On day 7: The information we withdrew is permanently erased. From then on, the deletion cannot be undone.
• By day 30: Your deletion completes, and we remove your personal information from any record we still hold.

What we keep, and why: Where you have taken part in an event that is still running, or where money is still moving, we keep only the records tied to that activity until it completes, and we use them only to finish what is already under way. Events and payments are other members’ records too, so they stay on record after your deletion completes, without your name or anything else that identifies you. If you hosted events, they stay listed with the host shown as removed, and the people who came keep their history and receipts.

If you host or supply an event: If you host an event, or are booked and paid to supply one, and money on it has not settled yet, your deletion completes once it has settled, rather than by day 30.

Your points: Your points will be forfeited when your deletion completes. If you cancel within the 7 days, they come back.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Withdrawal: Withdraw consent at any time
• Opt-Out: Unsubscribe from marketing communications

To exercise these rights, contact us using the information below. We will respond within 30 days.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Remember your preferences
• Analyze website traffic (Google Analytics)
• Improve user experience

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any information.

Geographic data (ZIP codes, cities, counties) is provided by the SimpleMaps US ZIP Code Database.

10. Children’s Privacy

Our services are not directed to individuals under 18, and you must be 18 or older to have an account. Signup asks for your date of birth and refuses any date that makes you younger than 18: no account is created, and the date you entered is not stored. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Transfers

Your information may be processed in countries other than your own. We ensure appropriate safeguards are in place when transferring data internationally.

12. California Privacy Rights

California residents have additional rights under the CCPA:

• Right to know what personal information we collect and how it’s used
• Right to delete personal information
• Right to opt-out of the sale of personal information (we don’t sell your data)
• Right to non-discrimination for exercising your rights

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the “Last Updated” date
• Sending email notification for significant changes (if you’ve provided email)

Your continued use of our services after changes constitutes acceptance of the updated policy.

This Privacy Policy is effective as of March 31, 2026.