Privacy notice

This explains what personal data we hold, why, who else handles it and for how long. We collect very little.

Who we are

Casa Longarai Ltd, registered in England and Wales, company number 14562281. Registered office: 275 New North Road, Unit #2277, London, England, N1 7AA.

We decide how your data is used. In data protection law, that makes us the "controller".

To ask about anything in this notice, email contact@casalongarai.com or write to us at the registered office.

We haven't appointed a Data Protection Officer. The law requires one only where an organisation's core work is large-scale monitoring of people or large-scale use of sensitive data, and ours isn't.

What we collect

If you leave your email on our site

Your email address.
Which link brought you: the short tag in the link, such as c=bio.
Whether you confirmed you're 18 or over. Yes or no, never your date of birth.
A copy of the words on the page when you pressed the button, and what you ticked.
When you signed up, when you last used the sign-up form, and when you unsubscribed if you did.
A random code that makes your unsubscribe link work.

That's all. No name, address, phone, date of birth, IP address or device details.

If you email us: your email address and what you write.

If you visit the site: anonymous counts of how the site is used. See "Analytics and your device" below.

If you message us on Instagram: we read it in Instagram, and Meta's own privacy policy covers Instagram. We don't copy Instagram names or handles into our own systems.

We don't knowingly collect data from anyone under 18. If we find out we have, we delete it.

Why we use it, and the lawful basis

The law only lets us use personal data for set reasons, called "lawful bases". In short: consent means you asked for it; contract means we need it to do what we agreed with you; legal obligation means the law requires it; legitimate interest means a reason of our own, named in each row below.

Emailing you when a release opens: Consent. The sign-up page tells you exactly what we'll send before you press the button; leaving your email there is how you ask for it. There's no separate box. You can withdraw at any time.
Release emails, if you signed up on a page with its own box for them (such as an event page): Consent, only if you ticked that box.
Writing to you about an event you registered interest in: Consent, given when you registered.
Asking whether you're 18 or over when you sign up: Legitimate interest: not marketing alcohol to under-18s.
Keeping a copy of what you agreed to: Legal obligation: we must be able to show you consented. We use it for nothing else.
Recording which link brought you: Legitimate interest: knowing which of our links work. The tag names a link, never a person.
Answering your emails: Legitimate interest: replying to you.
Analytics: Legitimate interest: understanding and improving the site. The rules for your device are under "Analytics and your device".
Server logs and backups: Legitimate interest: keeping the site secure, working and recoverable.

What we do	Lawful basis
Emailing you when a release opens	Consent. The sign-up page tells you exactly what we'll send before you press the button; leaving your email there is how you ask for it. There's no separate box. You can withdraw at any time.
Release emails, if you signed up on a page with its own box for them (such as an event page)	Consent, only if you ticked that box.
Writing to you about an event you registered interest in	Consent, given when you registered.
Asking whether you're 18 or over when you sign up	Legitimate interest: not marketing alcohol to under-18s.
Keeping a copy of what you agreed to	Legal obligation: we must be able to show you consented. We use it for nothing else.
Recording which link brought you	Legitimate interest: knowing which of our links work. The tag names a link, never a person.
Answering your emails	Legitimate interest: replying to you.
Analytics	Legitimate interest: understanding and improving the site. The rules for your device are under "Analytics and your device".
Server logs and backups	Legitimate interest: keeping the site secure, working and recoverable.

We don't sell your data or use it for advertising.

Who else handles it

Only Casa Longarai staff with an admin account can see sign-ups. These companies handle data for us, under contracts that limit them to our instructions:

Supabase: What for: Our database; What they handle: Everything listed above; Where: London, UK
Google Cloud: What for: Runs our server, its logs and our backups; What they handle: Everything in the database (in backups), and request logs; Where: London, UK
Cloudflare: What for: Serves the website, and forwards email sent to contact@ and orders@; What they handle: Every request to the site, including your IP address and what you type into our pages, such as your email. Also emails sent to those addresses.; Where: Global network
PostHog: What for: Analytics; What they handle: See "Analytics and your device"; Where: EU (Germany)
Resend: What for: Sends our emails; What they handle: Your email address and what the email says; Where: May be processed in the United States

Company	What for	What they handle	Where
Supabase	Our database	Everything listed above	London, UK
Google Cloud	Runs our server, its logs and our backups	Everything in the database (in backups), and request logs	London, UK
Cloudflare	Serves the website, and forwards email sent to contact@ and orders@	Every request to the site, including your IP address and what you type into our pages, such as your email. Also emails sent to those addresses.	Global network
PostHog	Analytics	See "Analytics and your device"	EU (Germany)
Resend	Sends our emails	Your email address and what the email says	May be processed in the United States

Emails you send to contact@ or orders@ arrive in our Gmail inbox. Google runs Gmail under its own terms and privacy policy, so it's a controller in its own right, not a company following our instructions. It holds the emails you send us and our replies, and may process them in the United States and other countries.

Transfers outside the UK

Our database, server, logs and backups are in London. PostHog stores analytics in the EU, which UK law treats as protecting data adequately.

Some of these companies are based in the United States, including Google, which runs our inbox. Cloudflare's network spans the world. Where data leaves the UK, we rely on the UK–US "data bridge" for companies certified to it. Otherwise we use contract terms the UK has approved for this: the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Ask us and we'll send you a copy of the terms.

How long we keep it

Your email, while you want release emails: Until you unsubscribe or ask us to delete it. No time limit while you still want them.
Your email after you unsubscribe: 12 months from the day you unsubscribed, so we can show what you'd agreed to. Then deleted.
Your email, if you only registered interest in an event: 12 months from when you last registered. Then deleted.
The copy of what you agreed to: Kept with your sign-up and deleted with it.
A "do not email" marker: A scrambled code made from your address, not the address itself. We keep it so we never email you again after you unsubscribe or ask us to delete your data, even if an old backup is restored. Removed if you ask for release emails again.
Emails you send us: As long as we need to deal with what you asked, and no more than 2 years after our last exchange.
Copies of emails we sent, kept at Resend: 30 days.
Server logs: 30 days. They record which web address on our site was requested and when, and sometimes the browser type. Not your IP address (requests reach our server through Cloudflare), and never your email, address, phone or date of birth.
Operational logs for our database, at Supabase: No more than 7 days.
Backups: Deleted 30 days after they're made, and unrecoverable 7 days after that.
Analytics: 1 year. Anonymous; see below.

What	How long
Your email, while you want release emails	Until you unsubscribe or ask us to delete it. No time limit while you still want them.
Your email after you unsubscribe	12 months from the day you unsubscribed, so we can show what you'd agreed to. Then deleted.
Your email, if you only registered interest in an event	12 months from when you last registered. Then deleted.
The copy of what you agreed to	Kept with your sign-up and deleted with it.
A "do not email" marker	A scrambled code made from your address, not the address itself. We keep it so we never email you again after you unsubscribe or ask us to delete your data, even if an old backup is restored. Removed if you ask for release emails again.
Emails you send us	As long as we need to deal with what you asked, and no more than 2 years after our last exchange.
Copies of emails we sent, kept at Resend	30 days.
Server logs	30 days. They record which web address on our site was requested and when, and sometimes the browser type. Not your IP address (requests reach our server through Cloudflare), and never your email, address, phone or date of birth.
Operational logs for our database, at Supabase	No more than 7 days.
Backups	Deleted 30 days after they're made, and unrecoverable 7 days after that.
Analytics	1 year. Anonymous; see below.

Analytics and your device

We use PostHog to see how the site is used, so we can improve it: how many people view a page, and whether people who arrive from a given link go on to sign up.

What it records for each page view or step:

The page address, with everything after the "?" removed except our link tag.
The website you came from (its domain only).
Your browser, operating system and device type (phone or computer).
Which page it was, and whether the release had closed.

What it doesn't do:

No cookies, and nothing stored on your device for analytics. Each page load gets a new random ID that lives only in that page, so we can't link your visits or recognise you when you come back.
Never your email or name. It isn't linked to your sign-up.
No recording of your screen, no click tracking, no heatmaps.
Not used for advertising, and not shared with anyone else.

Our emails carry no tracking pixels. Each link in a release email carries one tag, the same for everyone who gets it. We count visits per email, never per person.

PostHog receives your IP address and your browser's identifying string (its "user agent") with each request, as any server you connect to does. We've set it to discard your IP address and not to work out your location from it. We don't include the identifying string in the data it keeps.

The law lets us run analytics like this without asking you first, as long as it's only to understand and improve the site, we explain it here, and you can object simply and for free.

To object: . The same link is next to "Privacy notice" on every page that runs analytics. It stops PostHog straight away, and PostHog won't load again on this browser. To remember your choice, we store one item on your device, called cl_analytics_off. It's the only thing this site stores on a visitor's device. If you clear your browser's site data, your choice goes with it. If your browser blocks site storage, as some in-app browsers do, your choice lasts only for the page you're on.

If your browser sends a Global Privacy Control signal (a privacy setting some browsers offer), we treat it as an objection: PostHog never loads, and we store nothing.

The staff-only admin area uses one sign-in cookie. It doesn't affect visitors.

Your rights

You can ask us to:

give you a copy of what we hold about you
correct it
delete it
restrict how we use it
object to how we use it
send data you gave us to you or to another company.

Write to contact@casalongarai.com. We'll reply within one month. If a request is complex we may need up to two more months, and we'll tell you why within the first month.

You can stop release emails at any time, with the unsubscribe link in any of them or by writing to us. You don't need to give a reason. Withdrawing consent doesn't affect what we did before.

Some things we can't delete on request while the law requires us to keep them, such as records of payments to hosts. We'll tell you if that applies.

Decisions made automatically

We don't make automatic decisions about you, and we don't profile you.

Complaints

If you think we've got something wrong, tell us at contact@casalongarai.com. We'll acknowledge your complaint within 30 days and tell you what we've done about it. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

If you work with us

If you host for us or supply us, we hold your name and contact details, and for hosts, your postal address and pay rate. We use them to work with you and pay you. Lawful basis: contract, or our legitimate interest for supplier contacts. We keep hosts' records for 6 years after the last payment (tax law), and supplier contacts for 2 years after we last worked together.

Changes

This version was published on 19 October 2026. If we change it, we change the date. If a change would mean using your data in a new way, we'll ask you first, not just update this page. Ask us for any earlier version and we'll send it.

Back