Privacy policy

Last updated: 11 November 2026

This policy explains what data concerts.paris processes, why, and how to exercise your rights. It supplements the legal notice (in French). The General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Data Protection Act (loi Informatique et Libertés) apply. This English text is a translation of the French version, which prevails in case of discrepancy.

1. Data controller

The data controller is the publisher of the site, Hestia Data (SAS), 29 boulevard Edgar Quinet, 75014 Paris, France. Data contact: privacy@concerts.paris.

2. Data we collect

concerts.paris deliberately keeps data to a minimum:

• Optional account: browsing the listings and event pages never requires an account. You can create one, with no password, to save events and receive your reminders (see “Your account” below).
• Browsing data (server logs, IP address, user agent, pages viewed) for security and proper operation.
• Your email address, if you enter it yourself — and only then: newsletter sign-up, a request to be notified when an artist comes back to Paris, or a request to be notified if tickets go back on sale for a sold-out show. We then record the address, the date of your consent, the page you signed up from, the display language, the text shown to you, your browser and your truncated IP address — these details serve only to demonstrate your consent, as the law requires. Depending on the case, we also record the artist or show concerned. None of these addresses is sold or transferred; every email includes an unsubscribe link.
• Cookieless usage measurement: to know which features are actually used, the site records anonymous interactions (filter used, a venue's calendar viewed, an audio/video player opened, page viewed, visit duration). Each record carries an ephemeral visit identifier, randomly generated, kept in the tab's memory (sessionStorage, not a cookie) and destroyed when the tab is closed: it can neither recognise you from one visit to the next nor follow you from one site to another. No IP address, no profile.
• Connector for assistants (ChatGPT, Claude…): when an assistant queries the listings through our connector (api.concerts.paris/mcp), we count the call anonymously — the tool used, the assistant's name, the city and language requested, and whether an answer was found. No account, no stored IP address, no text from your conversation: we only receive the technical question sent to the catalogue (for example "concerts tonight in Paris"), never your identity.
• Audience measurement: see the section Cookies and trackers.
• Clicks on “Book”: when you follow a link to a ticketing site, we record one line per click, with no IP address and no visit code: the event page, the ticketing site, the page and position of the button, the language, the type of device, the country (derived from the connection, without keeping the address), the first page of your visit, the site you came from, the A/B test under way and the version you were shown if there is one, and, where relevant, the AI assistant or our advertising campaign you arrived from. The affiliate network only receives from us the reference of the event page (or the campaign name), never anything that identifies you. When the click leads to Tiqets, we add a randomly drawn click number, sent to Tiqets and kept with the click line, which lets a possible sale be matched to that click; it contains nothing that identifies you.
• Messages you send us (email to one of our addresses, contact, report): your address, your name if it appears, the content and any attachments. See section 6 for who reads them.
• Organisers' orders (listing or promoting an event, organisers' page, in French): the contact's email, the billing details (name, address, SIRET, VAT number), the acceptance of the terms of sale (version, date and truncated IP address) and the payment references at Stripe. The card number is entered at Stripe: we never see it.

Your account (optional)

If you create an account, we process:

• your email address, which serves as your identifier. You sign in with a 6-digit code sent to you by email, valid for 10 minutes. There is no password;
• what you keep in it: the events you save (and those where you mark “I was there”), the artists and venues you follow, your alerts (city, genre or category, free or not), your shared lists, and your preferred city and categories;
• your email settings (reminders, alerts, personalised newsletter) and a record of the reminders already sent, so that we never write to you twice about the same thing;
• your signed-in devices: a label such as “iPhone · Safari”, the date of each device's last visit and the date you last signed in. A device stays signed in for at most 180 days after its last visit; you can sign it out from the account page.

What this data is used for. Only to make the account work: finding your saved events on all your devices, building the “For you” row, and sending you the emails the account provides for (a reminder before a saved event, a change of date, a cancellation, tickets available again, tickets going on sale, and once a week the new listings matching your alerts). These emails can be turned off from the account page or through the link in each email. If you receive our newsletter, we add to it a few events chosen from your saved events and from the artists and venues you follow. Legal basis: performance of the service you request by creating the account. We do not sell this data and do not use it for advertising.

What others can see. When you share a list, anyone who has its link sees its title and its events, never your address; you can delete it at any time. The subscription link to your calendar is personal: anyone who has it sees your saved events; you can replace it from the account page, and the old one then stops working.

Import from Deezer. If you enter a public Deezer profile, we read its list of artists once to suggest the ones that have a page on our site. We keep nothing from Deezer (neither the profile ID nor the list): only the artists you choose to follow remain.

Retention. The account is kept until you delete it. A sign-in request (code) is deleted once it is more than 24 hours old, at the weekly purge: at most 8 days after it was created.

Download or delete. The account page lets you download everything the account keeps (“Download my data”) and delete it (“Delete my account”). Deletion is immediate: devices, saved events, alerts, lists and reminders are erased; you choose whether your sign-ups (artists and venues followed, newsletter) are erased too.

3. Purposes and legal bases

• Providing the listings and event pages — performance of the service / legitimate interest.
• Security, abuse prevention, logs — legitimate interest.
• Newsletter and alerts (an artist coming back, tickets available again) — your consent, given by entering your address in the dedicated form. You can withdraw it at any time (unsubscribe link or a simple email), without giving a reason: withdrawal does not affect the lawfulness of emails already sent.
• Cookieless usage measurement (knowing which features are used, and improving the site) — legitimate interest. The measurement is strictly limited to this purpose, combines no personal data and follows no one from site to site: it falls within the audience measurement that the CNIL (French data protection authority) guidelines exempt from prior consent.
• Audience measurement with cookies — your consent.
• Replying to your messages — legitimate interest.
• Organisers' orders — performance of the contract, and our accounting obligations for invoices.
• Ticketing affiliation — legitimate interest (commercial tracking of the sales generated), the affiliation cookies being set by the partner after your click.

4. Cookies and trackers

• Strictly necessary — the cp_consent cookie remembers your choices (duration: 6 months). Exempt from prior consent.
• Address verified on this device — after you click the confirmation link of one of our emails, two cookies remember that this device verified your address, so you can follow another artist or venue without typing it again: __Host-cp_suivi (a signed random identifier, never your address, unreadable by the page's scripts) and cp_suivi_vu (which only says “device recognised”). Duration: 90 days. They only serve this service you ask for, on concerts.paris only. To delete them: “Forget this device” on the My follows page, or “Stop all alerts” in an alerts email (all your devices forget it).
• Cookieless audience measurement — Cloudflare Web Analytics sets no cookie and does not track visitors from one site to another. In line with the CNIL guidelines, this measurement is exempt from consent.
• Cookieless usage measurement (internal) — an ephemeral visit identifier is written to the tab's memory (sessionStorage, key cp_session) and disappears when the tab is closed. No cookie, no third-party tracker, no cross-site tracking. Details of the data: section 2.
• Audience measurement with cookies — Google Analytics 4 (Google Ireland Ltd), loaded only after your consent via the banner. Google Consent Mode v2 is enabled: no signal is sent without consent. Cookie duration: 13 months maximum (CNIL recommendation).
• Affiliation — our “Book” links to partner ticketing sites are tracked (Awin, Impact and Kwanko programmes, active today). We set no affiliation cookie: the ticketing site sets its own, on its site, after your click, to attribute the sale (variable duration, often 7 to 30 days). You then leave concerts.paris and fall under the partner's privacy policy. On our side, we set no cookie for this click: we keep one line for it, with no IP address and no visit code (section 2).

On your first visit, a banner lets you accept, refuse or customise non-essential cookies. You can change your choice at any time via “Manage cookies” at the bottom of the page. See the CNIL guide on cookies (in French).

Everything the site keeps in your browser

The full list of the cookies and storage keys that concerts.paris itself writes in your browser. Apart from Google Analytics (after your consent) and the embedded players (section 5), no other service sets any on our site. Nothing in this list follows you from site to site; you can delete all of it from your browser settings.

5. Embedded third-party content and media

To help you discover artists, some event pages embed media players provided by third-party services:

• Spotify and Deezer — we may show a Spotify listening player and Deezer audio previews of the artist. These players are governed by the respective privacy policies of Spotify and Deezer.

YouTube (YouTube API Services)

• What we use. concerts.paris uses the YouTube API Services (YouTube Data API) to find an artist's video or a show's trailer, and the YouTube embedded player to display it on event pages and artist pages. By watching a YouTube video on our site, you agree to be bound by the YouTube Terms of Service. Data processed by YouTube is handled under the Google Privacy Policy.
• What we collect and store. No personal data goes through the YouTube API: we never ask you to sign in to YouTube or Google, we access no account and keep no authorisation token. We only store the public ID of the video to display (and, for some venues, the ID of their official YouTube channel). Every ID is re-checked with YouTube at least every 30 days: if it is no longer public or embeddable, it is deleted; the ID of an archived event page is deleted.
• Use and sharing. These IDs are used only to display the corresponding video. We do not share any data obtained through the YouTube API, do not sell it, and do not use it for advertising or to track you.
• What happens on your device. Before you click, only the video thumbnail is loaded (an image served by YouTube, i.ytimg.com): your browser then sends Google the technical information of any web request (IP address, browser). When you click “Play the video”, the YouTube player loads in privacy-enhanced mode (youtube-nocookie.com) and shares basic data about your use with YouTube (IP address, device, playback). YouTube and Google may then place or read cookies and local storage data on your device, and serve third-party content, including advertisements, in the player. On our side, we set no YouTube-related cookie; we only count, anonymously, that a player was opened (cookieless usage measurement, section 2).
• Control and revoke. concerts.paris never asks for access to your Google account. You can review or revoke the access you have granted to applications at any time on the Google security settings page, and clear YouTube cookies from your browser. Any request to delete data relating to you, sent to privacy@concerts.paris, is handled within 7 days.
• Contact us. Questions or complaints about how concerts.paris uses YouTube: privacy@concerts.paris or the contact page (in French).

6. Recipients

• Cloudflare, Inc. (United States), our host and technical processor: it runs the site, its databases and its content delivery network. Our databases are located in Western Europe; pages are served from the Cloudflare data centre nearest to you (contact details in the legal notice, in French).
• For the messages you send us: Google (the Gmail mailboxes of our two co-founders, to which our addresses are forwarded and which also receive a copy of our replies), Anthropic (Claude, an artificial intelligence assistant that reads and sorts messages, summarises them and prepares or sends our replies) and Slack (our internal messaging: a private channel there receives, for each request, your name, your address and a one-sentence summary).
• Stripe (Stripe Payments Europe Ltd, Ireland), for organisers' orders: it takes the payment, issues and keeps the invoice.
• Scaleway (Scaleway SAS, a French company) — our email provider, whose servers are located in France (Paris region). For sending, it processes your address on our behalf, solely to deliver the messages you asked for (sign-up confirmation, newsletter, artist alert, “tickets available” alert) or to reply to a message you sent us. It also stores the backup of our databases, encrypted before upload: it has no access to its content.
• Embedded media providers — Google / YouTube, Spotify and Deezer — when a page loads an embedded player (see section 5). We send them no data: it is your browser that connects to them.
• Partner ticketing sites and their affiliate networks, only through what they collect on their own websites after you click “Book” (their own privacy policies apply), and the reference of the event page we add to the link (for Tiqets, also a randomly drawn click number).
• Competent authorities, upon legal request.

We do not sell your data and we do not share it for advertising.

Transfers outside the European Union

Your data is processed in the European Union and in the United States. For Cloudflare, transfers to the United States rely on its certification under the EU-US Data Privacy Framework and, as a fallback, on the European Commission's standard contractual clauses, included in its data processing terms. For Google, they rely on Google LLC's certification under the same framework; for Slack and Stripe, on their certification under that framework and on standard contractual clauses. Anthropic handles the messages you send us under its own terms of service: we have switched off any use of them to train its models, and Anthropic keeps them for 30 days. You can ask us for a copy of these safeguards at privacy@concerts.paris.

7. Retention periods

• Technical logs: 12 months maximum.
• Audience measurement cookies: 13 months maximum.
• Consent choice (cp_consent): 6 months.
• Address verified on a device (__Host-cp_suivi, cp_suivi_vu): 90 days, or until “Forget this device” or “Stop all alerts”.
• Cookieless usage measurement: 90 days, then automatic deletion by the database. Nothing is kept beyond that.
• Email address (newsletter, artist alert, “tickets available” alert): until you unsubscribe, and at most 3 years from your last interaction (sign-up, click on a link, email received), in line with the CNIL recommendation on marketing files. Deletion is automatic. We also delete: a sign-up still unconfirmed 30 days after the confirmation request was sent, and an alert whose concert took place more than 30 days ago.
• Proof of your consent: to be able to show that you did agree (and to what), we keep, for the same period as your address, the date, the sign-up page, the language, the exact text displayed to you, your browser and your truncated IP address (only the network is kept, never the full address).
• After you unsubscribe: we keep an irreversible fingerprint of your address (never the address itself) so as never to contact you again, even if it reached us again by another route. This fingerprint cannot be used to recover your address.
• Emails received: 1 year after the last exchange.
• Clicks on “Book”: with no time limit, as sales statistics: these lines contain nothing that identifies you (no cookie, no IP address, no visit code).
• Organisers' orders: invoices and accounting records for 10 years (legal obligation), kept by Stripe.
• YouTube video and channel IDs (no personal data): re-checked with YouTube at least every 30 days, deleted if no longer available (see the YouTube section).

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent to cookies and to set instructions regarding what happens to your data after your death.

To exercise them: privacy@concerts.paris (reply within one month). You may also lodge a complaint with the CNIL.

9. Contact

Questions about this policy: privacy@concerts.paris · contact page (in French).