Privacy Notice

Who controls your data

Szőke Andor is the data controller for personal data processed by What a Night.

What the service does

What a Night is a travel-video streaming service. It lets you choose a destination, build a continuous journey from curated place-based YouTube videos, save the journey to your account, and watch it later. The service is currently in a validation stage, so available destinations, features, and access conditions may change.

Data we process

• account and authentication data, including your email address, optional display name, authentication identifiers, and security session data;
• account content and access data, including saved journeys, selected or declared regions, plan and entitlement information, and related timestamps;
• records of your Terms acceptance, Privacy Notice acknowledgement, and optional newsletter choice;
• voluntary product-validation answers, the destination from which a survey was opened, displayed pricing information, and an estimated country code used to select relevant pricing;
• identifier-free aggregate product statistics: UTC date, event type, destination and content labels relevant to the event, limited UTM source/medium/campaign/content labels, and an immediately incremented count. Tracked landing routes also count whether they remained visible for 20 or 50 accumulated seconds without a pointer, touch, mouse, keyboard, scroll, wheel, input or change interaction; hiding the page pauses the clock. A coarse traffic channel (Meta, other tagged campaign, organic search, referral, direct or unknown) is derived without retaining the full referrer. Tracked arrivals also use only an allowlisted sender category (for example Facebook, Instagram, Google, YouTube, Reddit, WhatsApp, other website, direct or unknown) and an allowlisted opening context (a recognised in-app browser, regular browser or unknown). The Spain demo also counts whether its main experience remained at least half visible for 3 or 10 seconds, the first play-button pointer interaction, play activation, display and acceptance of the contextual external-media choice, and actual playback. For landing-page views, actual video starts, passive landing stages, and these Spain demo stages, the request is also reduced immediately to a coarse device category: desktop (including notebooks), mobile, tablet, or unknown. The raw User-Agent is not retained. The application does not store a raw event, session or visitor identifier, IP address, IP hash, account ID, browser fingerprint, full referrer, fbclid orgclid for these counters;
• with product-research consent, random pseudonymous session and journey identifiers, product-funnel events (landing-page view, country selection, region-card click, real tab click, playlist changes, My Night opening, journey start, and actual video start), destination and tab slugs, YouTube video IDs, limited UTM campaign labels, and an anonymised daily participation count. The separate daily reach table stores a one-way hash rather than the browser identifier, together with the two-letter country code estimated by the hosting provider from the request, when available; and
• limited technical and security information needed to operate, protect, and troubleshoot the service.

We do not intentionally store your raw IP address in the survey or daily reach tables. Hosting and security providers may process IP addresses and technical request data in their operational logs.

Opening any What a Night page with ?silent=1 stops What a Night's own analytics and daily-reach requests for the rest of that browser-tab visit. A necessary sessionStorage flag containing only this opt-out choice keeps it active during internal navigation and disappears with the tab session. It is not sent to the server. It cannot undo a statistic already sent, and it does not suppress the hosting provider's technical request logs.

Google Sign-In and Google user data

Google Sign-In is optional. If you use it, What a Night receives your name, email address, and Google account identifier through Google and Supabase. This information is used only to create and secure your What a Night account, authenticate you, and associate saved journeys and access settings with your account.

What a Night does not request access to your Gmail, Google Drive, Google Calendar, contacts, or other Google content. Google authentication data is not sold, used for advertising, or shared for unrelated purposes.

Why we process data and our legal bases

• to create and secure accounts, provide saved journeys, and enforce access limits where processing is necessary to provide the service you request;
• to prevent abuse, maintain security, troubleshoot failures, and defend legal claims where this is necessary for our legitimate interests or to meet a legal obligation; and
• to understand at an aggregate level whether core service features are used, based on our legitimate interest in validating and improving the service. This identifier-free measurement does not use device storage or attempt to single out a visitor; and
• to send optional news emails, record product-research data, or load external YouTube and Google Maps media only where you have made the relevant voluntary choice or given consent. You may withdraw consent at any time.

Newsletter consent is not required to create or use an account. You can change that choice in My account. Cookie, product-research and external-media choices can be changed through Privacy & video settings in the website footer.

Service providers and international transfers

What a Night currently relies on Vercel for hosting, Supabase for authentication and database services, Google for optional account sign-in, and YouTube/Google for external video playback and maps after the relevant media choice. These providers process data only to the extent needed to supply their services and may process data in countries outside Hungary or the European Economic Area under their applicable contractual and legal safeguards.

No external newsletter-delivery provider is currently connected. At present, the service records only your newsletter preference. This Notice will be updated before a third-party email-delivery provider is used.

How long we keep data

• account, profile, entitlement, region, and saved-journey data is kept while your account is active and then deleted or anonymised when it is no longer needed to provide the service, unless a legal obligation or legal claim requires longer retention;
• newsletter preference data is kept until you withdraw your choice; a minimal consent or withdrawal record may be retained for as long as needed to demonstrate compliance;
• raw pseudonymous product-funnel events are kept for up to 90 days, after which they are deleted; identifier-free aggregated statistics may be kept for longer;
• survey and pseudonymous daily-reach data is kept only while it remains necessary for product validation and trend analysis. Its necessity is reviewed at least annually, after which it is deleted or irreversibly anonymised when no longer needed; and
• technical and security logs are kept for the shortest period needed for security, abuse prevention, and troubleshooting, subject to the configured retention practices of the service providers listed above.

You may request account or personal-data deletion at any time by emailing main@whatanight.tv. Deletion requests are handled without undue delay, subject to any data that must be retained by law or for legal claims.

Your data-protection rights

Depending on the applicable law, you may request access to your personal data, correction, deletion, restriction, portability, or object to processing. Where processing is based on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal.

To exercise a right or ask a privacy question, email main@whatanight.tv. You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or another competent supervisory authority.

Cookies and external media

Necessary storage supports sign-in, security, user-requested saved nights, and choices you explicitly ask us to remember. Product-research storage and embedded YouTube or Google Maps media are optional. Advertising and Google Ads measurement tags are not currently loaded. External media is not contacted before its separate choice. More detail is available in the Cookies & technologies notice.

Changes to this Notice

This Notice may be updated when the service, providers, or legal requirements change. The latest version and its update date will remain available on this page. Where required, users will be informed of material changes or asked to acknowledge an updated version.