Who we are
This site, jonasmonteiro.com, is run by Jonas Castilho Monteiro, a sole proprietorship based in Bengaluru, Karnataka, India, performing as Jonas Monteiro and Jovah. In the language of India's data protection law, that makes us the "data fiduciary": the person who decides why and how your personal data is used. The companies that host, store and send things for us are "processors" and act only on our instructions. They are named below.
Every line here describes something the site actually does. When the site changes what it collects, this page changes with it, and the effective date at the top moves.
What this covers
This policy covers the site, its forms, the "Ask Jonas" chat, the newsletter, the calendar feed, and the emails we send you. It does not cover the venues where shows happen, ticket sellers you are sent to for ticketed shows, or the social and streaming platforms we link to. Each of those has its own policy.
What we collect, and why
You can read the whole site without giving us anything. Data is collected only when you do one of these things.
| When | What | Why | Basis |
|---|---|---|---|
| You request a guestlist spot (event page form or the chat) | Name, email, phone number with country code, how you are walking in (ladies, couples, mixed group, stags), party size, whether you want a table, your yes or no to the weekly email, and which event. Plus, from your browser: IP address, browser and device type, language, screen size, time zone, and similar technical details, with a random session id. | To put your names on the venue's list, email you a confirmation, avoid duplicate entries, and stop abuse of the form. | Your request. You give these details so we can act on it. |
| You start typing in the guestlist form | A draft of what you have typed so far (name, email, phone, group, party size) is saved about two seconds after each change, with the technical details above, even if you never press submit. | To recover a request when a phone browser (Instagram's in-app browser is the usual culprit) drops the submission. An hourly check looks for requests that were submitted but never saved, re-creates them, and sends the confirmation. | Keeping the form working. If you would rather not have drafts saved, do not start the form. |
| You send a booking enquiry | Name, email, phone, venue, city, country, your fee or offer with currency, the date, and your message. | To reply with a quote and, if it goes ahead, to run the booking. | Your request. |
| You say yes to the weekly email, or ask us to add you | Email, name, where the subscription came from, and the dates you subscribed, unsubscribed or resubscribed. For each issue we send: whether it was opened, when, and which links were clicked. | To send the weekly events email and see whether it is worth reading. | Your consent. Withdraw it with the unsubscribe link in any issue. |
| You talk to the "Ask Jonas" chat | Everything you type, the assistant's replies, a session id, your browser type, timestamps, and the assistant's own notes on how it understood each message. If you check or request a guestlist spot in the chat, the name, phone or email you give become part of the transcript. | To answer you, and to read transcripts afterwards so the assistant gets better at answering. | Your choice to use the chat. The widget also checks for a saved conversation on every page load, which sends only the session id. |
| You accept analytics cookies | Pages viewed, clicks on social and streaming links, tracks played, searches typed on the news page, guestlist submissions (event, group type, party size, success or error), chat opened, and similar events. Google assigns a random client id in a cookie. | To see which shows, pages and features people use. | Your consent in the cookie banner. Until you accept, Google's script loads but sets no cookie and receives only non-identifying pings. |
| Something breaks in your browser | The error, the page you were on, your browser type, and a sample (one in ten) of page-load timings. If you had already typed your name and email into the guestlist form, they are attached to the report so we can find and fix your request. | To find and fix bugs. | Keeping the site working. |
| You open the Map tab or a video page | Google Maps and YouTube load in your browser and receive your IP address and browser details, and may set their own cookies. | To draw the venue map and play videos. | Your choice to open those pages. |
| Any visit | Our host records requests (IP address, page, time) in short-lived server logs. Images are served from a content delivery network that sees the same. | To serve the site and spot attacks. | Keeping the site running. |
What we do not collect
- No payment or card details. Cover charges are paid to the venue, and booking fees are invoiced separately. We never ask for payment details through this site or by direct message.
- No identity documents, date of birth, or photographs of you through the forms.
- No accounts or passwords. There is nothing to log into.
- No precise location. The map shows venues; it does not ask where you are.
- No advertising pixels. There is no Meta, TikTok or other ad tracker on the site.
- No SMS or WhatsApp messages from us to you, and no phone numbers used for marketing.
How we use it
- Guestlist requests go into a spreadsheet for that event. The venue gets the names, group type and party size for the door. If you asked about a table, the venue's team contacts you to confirm it, and may use your phone number to do so.
- A later request with the same phone number updates your earlier one rather than adding a second entry, and you get a fresh confirmation.
- Booking enquiries are read by Jonas and answered by email or phone about that enquiry only.
- Newsletter data is used to send the weekly email and to see what was opened and clicked. We do not use it to build profiles or to advertise to you elsewhere.
- Chat transcripts are read by us in the site's admin area to improve the assistant's answers. The assistant can confirm a guestlist entry when you give it the name and the phone number or email used, and will tell you the name, group type and party size of the matching entry.
- Technical details (IP address, browser, device) are used for rate limits, abuse prevention, and to work out why a submission failed.
We do not sell personal data, and we do not share it with anyone for their own marketing.
Who we share it with
These providers process data for us. Each one receives only what its job needs.
| Who | What they receive | Why |
|---|---|---|
| Netlify | Everything the site handles: form submissions, guestlist drafts and audit trail (including IP address and device details), chat transcripts, booking enquiries, newsletter drafts, and server logs. | Hosting, serverless functions, storage and forms. |
| Google (Sheets and Drive) | Guestlist entries: name, email, phone, group type, party size, table interest, time. | The per-event guestlist spreadsheets. |
| Google (Gemini AI models) | Your chat messages and the recent conversation, including any contact details you type there. | Understanding questions and writing the assistant's replies. |
| Google (Analytics, Maps, YouTube) | Usage events after consent; IP and browser details when the map or a video loads. | Analytics, the venue map, video playback. |
| Supabase | Newsletter subscribers, opens and clicks. | The mailing list database. |
| Zoho Mail | Guestlist confirmation emails (your name, phone, group, party size, event) and internal alerts about failed submissions. | Sending transactional email. |
| Amazon Web Services (SES) | Your email address and the newsletter issue, with a personal unsubscribe link. | Delivering the newsletter. |
| Sentry | Error reports, with your name and email attached if you had filled them into the guestlist form. | Error monitoring. |
| Cloudinary | Your IP address and browser details when images load. | Serving photos. |
| GitHub | Runs the scheduled newsletter send and the hourly guestlist check. Its job logs can contain failed recipient addresses and, for the guestlist check, names and phone numbers of affected requests. | Scheduled jobs. |
| Google Cloud (Mumbai region) | Event listings and Jonas's notes. No visitor data. | Drafting the newsletter. |
| The venue for the event | Names, group type and party size on the guestlist, sometimes sent by WhatsApp from our phone. Your phone number only if needed for a table booking. | Door entry and table bookings. |
| Tempestronics | Access to the systems above for maintenance. | Building and running the site. |
We will also disclose data where the law requires it, for example to a court or a government authority with the power to ask.
Where your data lives
Most of these providers store data outside India, mainly in the United States and the European Union. Newsletter drafting runs in Google's Mumbai region. Indian law allows transfers to any country the Central Government has not restricted, and none has been restricted at the effective date. Wherever the data sits, this policy and our contracts with the providers apply to it.
Cookies and browser storage
The banner at the bottom of the page controls the optional categories. "Essential" cannot be switched off because the site does not work without it. You can change your choice any time with the "Manage cookies" link in the footer.
| Name | Set by | Category | Purpose | Lasts |
|---|---|---|---|---|
cookie-consent-v1 | Us (local storage) | Essential | Remembers your cookie choice and when you made it. | Until you clear your browser data. |
jonas_chat_session_id, jonas_chat_flow, jonas_chat_* | Us (session storage) | Essential | Keeps your chat conversation together, holds a signed record of a guestlist request in progress, and keeps a local copy of the conversation. Local copies older than seven days are removed. | Until you close the tab. |
_ga, _ga_SES1SJZF08 | Google Analytics | Analytics | Tells Google Analytics that later visits come from the same browser. | Two years. |
| Google ads signals | Google Analytics | Marketing | The "Marketing" switch lets Google use your Analytics activity for ads measurement and personalisation on Google's side. There are no ad tags on this site; switching it on adds nothing here. | Follows the Analytics cookies. |
YouTube cookies (for example VISITOR_INFO1_LIVE, YSC) | YouTube | Third party | Set by the video player on video pages, under Google's privacy policy. | Set by YouTube, up to two years. |
Google Maps cookies (for example NID) | Third party | Set when the venue map loads on the Dates page, under Google's privacy policy. | Set by Google, up to six months. |
The site does not use any other cookies. The consent record and the chat keys are browser storage, not cookies, but we list them because they behave the same way for you.
Messages from us
- Guestlist confirmation. One email per request, from an address on jonasmonteiro.com, with a calendar file attached. You get another if you update the request, and one if our hourly check recovered a submission that failed. These are part of the service and are not marketing.
- Booking replies. By email or phone, about your enquiry only.
- Table bookings. The venue's team contacts you, usually by phone or WhatsApp, to confirm.
- The newsletter. Usually one email a week, around Thursday evening, from an address on jonasmonteiro.com. Each issue has an unsubscribe link that works in one click, and mail apps that support it show an unsubscribe button. The Newsletter and Messaging page has the full detail.
- WhatsApp and SMS. We do not send these today. If we start event reminders on WhatsApp or SMS, they will need a separate tick box that names the channel, and they will never be switched on for existing subscribers without asking.
How long we keep it
These are the periods we commit to. Where a period ends, the data is deleted or made anonymous. Some of the deletion is done by hand on a schedule rather than automatically, which is why the periods are stated as maximums.
| Data | Kept for |
|---|---|
| Guestlist entries (the spreadsheet rows) | Up to 24 months after the event, so we can answer disputes and see who comes back. |
| Guestlist drafts, audit trail, IP addresses and device details | Up to 90 days. |
| Booking enquiries | Up to 24 months after our last contact about it, or for as long as a booking contract and tax law require. |
| Newsletter subscription (email, name, dates) | While you are subscribed. After you unsubscribe we keep your email marked as unsubscribed indefinitely, so that we never email you again by mistake. Ask us to erase it entirely if you prefer. |
| Newsletter opens and clicks | Up to 24 months. |
| Chat transcripts | Up to 90 days. |
| Error reports | 90 days, set by Sentry. |
| Server and job logs | A few days to a few weeks, set by the provider. |
| Backups held by our providers | Up to 90 days after the live copy is deleted. |
Security
The site is served over HTTPS only. The admin area needs a login, and only Jonas and Tempestronics have one. Forms have hidden traps for bots and per-address rate limits. Guestlist requests started in the chat are carried in a signed token that expires after two hours. Provider accounts use strong, unique credentials.
Two things you should know. Newsletter links carry your email address in encoded form, so anyone you forward an issue to could unsubscribe you or register an open on your behalf; treat those links as personal. And a chat transcript can be re-opened by anyone who has the session id from your browser, which is why the site never shows it and clears it when the tab closes.
If we learn of a breach that affects you, we will tell you and the Data Protection Board of India in the way the law requires.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can ask us to:
- Tell you what we hold. A summary of your personal data, what we do with it, and who we have shared it with.
- Correct or complete it. For example a misspelt name on a guestlist, or a wrong email on the newsletter.
- Erase it. We delete it unless a law requires us to keep it (tax records for a paid booking, for instance).
- Withdraw consent. Unsubscribing from the newsletter or changing your cookie choice is as easy as giving consent was. Withdrawing does not undo what was lawfully done before.
- Nominate someone to exercise these rights for you if you die or become unable to.
- Complain. First to our grievance officer below. If you are not satisfied with the answer, you can approach the Data Protection Board of India.
Write to hello@jonasmonteiro.com from the email address you used with us, or tell us the phone number you registered with, so we can find your records and know it is you. We answer within 30 days. There is no charge.
The Act's provisions are coming into force in stages. Until each one applies, the Information Technology Act, 2000 and the rules on sensitive personal data under it govern, and we honour the rights above anyway.
Age
The forms and the chat are for people aged 18 or over. We do not knowingly collect personal data from anyone younger, because the law requires a parent's verifiable consent and the site cannot obtain it. If you think a child has given us their details, tell us and we will delete them.
Grievance officer
- Name
- Jonas Castilho Monteiro
- Role
- Proprietor and Grievance Officer
- hello@jonasmonteiro.com
- Location
- Bengaluru, Karnataka, India
- Response time
- Within 30 days
Changes to this policy
When the site starts collecting something new, or shares data with someone new, this page is updated first and the effective date changes. Newsletter subscribers are told about material changes in the next issue. Older versions are available on request.