Privacy Policy

Data Controller

The Between, based in Sweden, is the data controller for the processing of your personal data. Contact: info@thebetween.se.

What data we collect

• Account information: Name, email address and encrypted password when you create an account.
• Payment information: Handled directly by Stripe. We never store card numbers or full payment details.
• Profile information: Company and role if you choose to provide them.
• Form responses: Name, email, city and message when you submit a form (contact, newsletter, interest applications, membership applications).
• Discord account: Discord user ID if you choose to connect your account via OAuth.
• After Commerce attendance: Name and email address of attendees registered by The Between. Your name and contact details are shown by default to the other attendees of the same event — you can switch yourself to Hidden at any time. If you activate an account via your personal invitation link, the data is linked to your user account.
• Extended profile information: LinkedIn URL if you choose to provide it in your profile on My Pages.
• Attendee reflections: Optional answers to three post-event reflection questions. Stored linked to your attendee record and visible only to you.
• Calendar token: A unique personal identifier that may be included in the URL of personalised iCal calendar feeds. Used to improve calendar analytics and is not linked to your web session.
• Analytics data: Aggregated and anonymised data on page views and feature usage via Google Analytics 4.
• Technical data: IP address (anonymised by Google Analytics), browser type and device information.
• Attending without an email address: We may record your attendance with your name alone, before we have any address for you. If you later create an account, the attendance is linked to it.
• Logged connections: LinkedIn URLs of people you tell us you connected with at an event. Stored against your account and visible only to you.
• Referrals: Email addresses of people you would like to invite to After Commerce. Stored solely to see whether the referral led to an attendance.
• Calendar preferences: The cities you have chosen for your personal calendar feed. Stored against your email address and changeable at any time in My Pages.
• Boardroom bookings: If you are booked onto a forum, the booking is recorded with name, email address and optionally company. Booked forums are added automatically to your personal calendar feed.

Cookies

• Strictly necessary cookies: Login session (Auth.js) – required to keep you signed in. Stored until logout or maximum 30 days.
• Analytics cookies (require consent): Google Analytics 4 sets _ga and _ga_[ID] to measure anonymous visit statistics. Stored for up to 2 years. Only loaded if you have given consent.
• You can withdraw your consent to analytics cookies at any time via the cookie settings at the bottom of the page.

Legal basis for processing

• Contract (GDPR Art. 6.1.b): Account information, payments, Discord integration and event registrations – necessary to fulfil our service.
• Legitimate interest (GDPR Art. 6.1.f): Form responses for interest applications and contact requests – we have a legitimate interest in responding to and following up on incoming enquiries.
• Consent (GDPR Art. 6.1.a): Google Analytics and analytics cookies – you give consent via the cookie banner. Newsletter subscription – you give consent upon sign-up.
• Legitimate interest (GDPR art. 6.1.f): After Commerce attendance data – we have a legitimate interest in documenting attendance and enabling contact and networking between participants. You may object to this processing at any time.

How we use your data

• Provide and improve the website and our services.
• Manage your account, Commerce Commons subscription and payments.
• Give you access to the Discord community for Commerce Commons subscribers.
• Send transactional emails: welcome emails, confirmations and replies to form submissions.
• Send newsletters and updates (if you subscribe – you can unsubscribe at any time).
• Respond to contact and interest enquiries.
• Analyse anonymous visit statistics to improve the website.
• Enable contact and networking between After Commerce attendees: your name and, if provided, LinkedIn URL are shown by default to other attendees from the same event. You can switch yourself to Hidden at any time via My Pages.
• Send personalised follow-up emails after After Commerce events with a link to the event page on My Pages.

Third-party providers and data processors

• Stripe (Stripe Inc., USA/Ireland) – payment processing. Stripe is independently responsible for payment data. See Stripe's privacy policy at stripe.com.
• Discord (Discord Inc., USA) – community platform for Commerce Commons subscribers. See Discord's privacy policy at discord.com.
• Resend (Resend Inc., EU) – transactional emails (confirmations, welcome emails).
• Google Analytics (Google LLC, USA) – anonymised visit statistics. Data may be processed in the USA under the EU–US Data Privacy Framework. Only loaded with your consent.
• Google Search Console (Google LLC, USA) – SEO tool. Does not process personal data about website visitors.
• Vercel (Vercel Inc., USA/EU) – web hosting. Data stored within the EU (Stockholm region).
• Neon (Neon Inc., EU) – database hosting. Data stored in Stockholm, Sweden.
• Anthropic (Anthropic PBC, USA) – AI service powering The Between Dialogue. Your chat messages are sent to Anthropic to generate responses. See Anthropic's privacy policy at anthropic.com.
• OpenAI (OpenAI OpCo LLC, USA) – search embeddings for the AI assistant's contextual retrieval. Used only if the feature is configured. See OpenAI's privacy policy at openai.com.

The Between Dialogue AI assistant

• Your messages in the AI chat are sent to Anthropic to generate responses in real time. Conversations are not stored in our database – they exist only for the duration of the active session.
• Your IP address is used temporarily in memory to limit the number of requests (rate limiting). It is not stored.
• Legal basis: legitimate interest (GDPR Art. 6.1.f) – you actively initiate the conversation to receive information about The Between.
• The Between Dialogue is an AI system. Do not share sensitive personal data – national ID numbers, payment details, passwords or health information – in the chat.

Retention and deletion

• Account data is stored for as long as your account is active. Upon account deletion, personal data is anonymised within 30 days.
• Form responses are stored for up to 24 months.
• Payment history is stored in accordance with Swedish accounting law (7 years).
• Analytics cookies: up to 2 years (Google Analytics default).
• After Commerce attendance data is retained until you request deletion or your account is closed. Anonymisation takes place within 30 days.

International transfers

Some of our providers (Stripe, Discord, Google, Vercel) are based in or transfer data to the USA. These transfers are made under appropriate safeguards, including the EU–US Data Privacy Framework or EU Standard Contractual Clauses.

Your rights (GDPR)

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data (subject to legal obligations).
• Right to object: Object to processing based on legitimate interest.
• Right to data portability: Receive your data in a machine-readable format.
• Right to withdraw consent: At any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: With the Swedish Authority for Privacy Protection (IMY), imy.se.

Contact

Questions about your privacy or to exercise your rights: info@thebetween.se.