THE WILD SHOW

Privacy Policy

Version 1.0 · Effective 14 July 2026

Data controller: The Goat Consulting SARL, registered in Switzerland (CHE) · Privacy contact: privacy@thewild.show. This policy explains what personal data thewild.show processes and your rights under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).

1.Scope

This policy covers the thewild.show website, viewer accounts, and the consented email streams. It does not cover third-party websites linked from the site, or the independent practices of embedded players (Twitch, Dailymotion) once you interact with them (see Section 4).

2.Data we collect

Email addressYour account identity; where sign-in links and consented emails go.You provide it

Language (locale)Which of the site's six languages your account uses.You provide it

Name & nicknameFirst name, last name and a unique nickname, for your account and how we address you on the site.You provide it

Birth yearOnly the year, plus a timestamp that the over-16 check passed. Month and day are used transiently for the check when needed and never stored.Age verification

CountrySo we know which events to invite you to.You provide it

GenderFemale / male / other / prefer not to say, so we know how to address you.You provide it

Shoe size & longest runShoe size (EU) and, optionally, your longest run, used to make partner offers and giveaways relevant.You provide it

Profile photo (optional)An avatar you may upload; stored until you replace or remove it. Never required.You provide it

Consent recordsTwo separate booleans (show updates / partner content), each with the timestamp of when you consented. Null when off.Your choices

Authentication cookiesStrictly-necessary session cookies that keep you signed in.Automatic

Infrastructure logsOur hosting and authentication providers process IP addresses and request metadata transiently to serve and secure the site.Automatic

Social sign-in (optional)If you sign in with Google, Facebook, X or GitHub, the provider shares your name, email and profile picture with us to create your account. We never post to your accounts.You choose it

That is the whole list. No tracking pixels, no advertising identifiers, no profiling, and no automated decision-making within the meaning of Article 22 GDPR.

3.Purposes and legal bases

Account access & sign-inCreating your account, sending magic links, keeping your session.Contract, Art. 6(1)(b)

Member contentShowing account-gated content where it is offered.Contract, Art. 6(1)(b)

Show updates emailsNew episodes, live dates, replays, only if you ticked that box.Consent, Art. 6(1)(a)

Partner content emailsOccasional partner offers, only if you ticked that separate box.Consent, Art. 6(1)(a)

Security & abuse preventionProtecting accounts and infrastructure.Legitimate interests, Art. 6(1)(f)

Legal complianceResponding to data-subject requests; keeping consent evidence.Legal obligation, Art. 6(1)(c)

Each consent is separate, never a condition of the account, and withdrawable at any time (Section 7).

4.Sharing: sub-processors only

We share personal data only with the service providers that run the site, under data processing agreements:

SupabaseAuthentication and database (accounts, profiles, consents). EU-region hosting.EU

VercelWebsite hosting and delivery; processes request metadata to serve pages.US, SCCs

DailymotionEmbedded replay player. Acts as its own controller when you play a video.EU

TwitchEmbedded live player and chat. Acts as its own controller when you interact.US, see their policy

Email providerDelivery of magic links and consented emails; provider to be confirmed; this policy will be updated when selected.TBD

NO DATA SALES. We do not sell, rent, license, or otherwise commercially transfer personal data to any third party for their own marketing or commercial purposes. This applies to identifiable, pseudonymised, and aggregated data alike. We do not share personal data with advertisers.

5.International transfers

Data is primarily hosted in the EU (Supabase, EU region). Switzerland and the EU/EEA mutually recognise adequacy, so Swiss-EU transfers are lawful without further safeguards. Where a provider processes data in the United States (Vercel; the email provider if a US provider is selected), transfers rely on the EU Standard Contractual Clauses (2021) with encryption in transit.

6.Retention

Account & profileFor the life of your account; deleted when your account is deleted.

Consent recordsWhile your account is active; after withdrawal or deletion, kept up to 3 years solely as evidence of consent, then deleted.

Infrastructure logsShort rotation periods set by our providers (security purposes only).

7.Your rights (GDPR Articles 15 to 22)

You may exercise all of the following at any time, free of charge:

Access, Art. 15Confirmation of what we hold about you, and a copy of it.

Rectification, Art. 16Correction of inaccurate data (email, display name, locale).

Erasure, Art. 17Deletion of your account and data (see Section 10).

Restriction, Art. 18Processing restricted while a dispute is resolved.

Portability, Art. 20Your data in a structured, machine-readable format (JSON on request).

Objection, Art. 21Object to legitimate-interest processing; the right to object to direct marketing is absolute.

Automated decisions, Art. 22We perform none. If you believe otherwise, contact us immediately.

Withdraw consentUntick either email stream on your account page, or write to us. Withdrawal is immediate and without detriment, and does not affect processing before withdrawal.

To exercise a right: email privacy@thewild.show from your account address (we may verify identity). We respond within 30 days.

You may also lodge a complaint with a supervisory authority: in Switzerland the FDPIC (edoeb.admin.ch); in France the CNIL (cnil.fr); or your national data protection authority anywhere in the EU/EEA.

8.Security

Encryption in transit (TLS) on all connections; encryption at rest (AES-256) on the database; row-level security scoping every account to its own data; magic-link authentication with no passwords to leak; administrative access server-side only, least-privilege. In the event of a personal data breach we notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay where the breach poses a high risk (Art. 34).

9.Children

The website and accounts are not directed at children under 16, and we do not knowingly process their data.

10.Deleting your account

Email privacy@thewild.show from your account address and we will delete your account and profile. Consent records are retained as evidence per Section 6, then deleted.

11.Cookies

We set strictly-necessary cookies only (authentication and session). We set no analytics and no marketing cookies. Embedded players (Twitch, Dailymotion) may set their own cookies when you interact with them, under their own policies.

12.Changes and contact

Material changes to this policy are announced on the website 30 days in advance. Contact: privacy@thewild.show. The Goat Consulting SARL, Switzerland.