Privacy notice
Last updated: 29 July 2026 · Draft, pending legal review
This notice explains what personal information Collective Hub Center collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It covers this website, our booth booking system, and our email announcements.
You can browse this site and attend our events without telling us anything at all. We only hold personal information about people who choose to give it to us - vendors who book a table, people who join the mailing list, and anyone who contacts us. We do not sell it, we do not share it for advertising, we run no analytics and we set no tracking cookies. Card numbers never reach our systems.
Who we are
Collective Hub Center runs collectors events in San Gabriel, California. In this notice, "we" and "us" mean Collective Hub Center, and "you" means anyone who visits this website, attends an event, books a booth, or contacts us.
We are the business responsible for the personal information described here. Our contact details are at the end of this notice.
What we collect
If you just visit the site or attend an event
Nothing that identifies you. Admission is free and unticketed, so there is no registration, no guest list and no door scan. We do not run analytics, advertising pixels or visitor tracking of any kind on this website.
Some pages load resources from other companies, and those requests reveal your IP address and browser to them as a technical necessity of loading. That is Google Fonts on every page, an embedded Google Map on the homepage, and photographs served by Unsplash. Their own privacy policies govern what they do with that. We receive none of it.
If you book a booth as a vendor
To sell you a table we collect your name, email address, Instagram handle, phone number, the city and state you are based in, and the categories of item you intend to sell. We record the date and time you acknowledged the vendor rules, which booths you bought, what you paid, and the status of that booking.
Some applications are taken through a form hosted by Jotform rather than through this site directly. The same fields apply.
If you join the mailing list or contact us
Your email address, and for a contact message your name and whatever you write to us. We use these to reply to you and to send event announcements, and for nothing else.
Automatically, to stop abuse
When a booking is started or an administrator signs in, we record a salted, one-way hash of the connecting IP address so we can rate-limit repeated attempts. The raw IP address is never written to our database and cannot be recovered from the hash. We do this because a booth booking system with no rate limit is a booth booking system that gets abused.
Categories, in CCPA terms
California law asks businesses to describe personal information using a fixed set of categories. Mapped onto that list, here is everything we hold.
| Category | Do we collect it? | What, specifically |
|---|---|---|
| Identifiers | Yes | Name, email address, phone number, Instagram handle, city and state. Hashed IP address only, never raw. |
| Customer records | Yes | Booking history and payment status for vendors. No card or bank details. |
| Commercial information | Yes | Booths purchased, amounts paid, refunds, the product categories a vendor sells. |
| Internet activity | No | No analytics, no advertising pixels, no browsing profiles, no cross-site tracking. |
| Geolocation data | No | City and state, only because a vendor typed them. No device or precise location. |
| Protected classifications | No | We never ask about race, religion, age, sex, disability or similar. |
| Biometric information | No | None. |
| Audio, visual or similar | See note | Photography and filming take place at our events and may include attendees. See the terms of service. |
| Employment or education | No | None. |
| Sensitive personal information | No | We collect none of the categories California treats as sensitive, and so we have nothing to limit the use of. |
| Inferences | No | We build no profiles and draw no inferences about you. |
Why we use it
- To sell and allocate booths, and to tell you which ones are yours.
- To take payment, and to issue a refund when one is due.
- To send you booking confirmations, changes and refund notices.
- To send event announcements, if you asked for them.
- To answer messages you send us.
- To keep the booking system from being abused, through rate limiting.
- To keep the financial records a business is required to keep.
We do not use your information to build advertising profiles, and we do not make automated decisions about you that produce legal or similarly significant effects.
Payments
Card details never reach our servers. Payment is completed on pages hosted by Stripe or PayPal. We receive back only a reference to the transaction, the amount, the currency and whether it succeeded. We could not disclose your card number if we wanted to, because we never hold it.
Stripe and PayPal handle your payment details as their own privacy policies describe.
Cookies and tracking
This website sets no cookies for ordinary visitors, and there is no cookie banner because there is nothing to consent to. We use no analytics, no advertising or social media pixels, and no cross-context behavioural advertising.
Our booking system sets one strictly necessary cookie for event organisers signing in to the administrative dashboard. It holds a signed session and nothing else. It is never set for members of the public.
Because we do not track you, there is nothing for a Global Privacy Control signal to opt you out of. We honour such signals regardless.
Who we share it with
We disclose personal information only to companies that process it on our behalf, for the purposes above, under contracts that forbid them using it for anything else.
- Stripe and PayPal - taking payments and issuing refunds.
- Resend - sending booking confirmations and notices.
- Neon - hosting the database our booking records live in.
- Vercel - hosting this website and the booking application.
- Jotform - hosting the vendor application, mailing list and contact forms.
We may also disclose information where the law requires it, to enforce our terms, or to protect the safety of people at our events. If the business is ever sold or transferred, booking records may transfer with it.
Selling and sharing
We do not sell your personal information, and we never have. We do not share it for cross-context behavioural advertising. We have not sold or shared the personal information of any consumer, including anyone under 16, in the preceding twelve months. There is accordingly no "Do Not Sell or Share My Personal Information" link on this site, because there is nothing for it to switch off.
How long we keep it
- Vendor bookings and payment records - four years after the event, which is the period California requires supporting records for sales and use tax to be kept. Then deleted.
- Mailing list - until you unsubscribe, which you can do from any email we send.
- Contact messages - up to twelve months after the conversation ends.
- Hashed rate-limit records - a rolling short window, currently measured in days. They exist only to count recent attempts.
Your rights
If you are a California resident, you can ask us to:
- Tell you what we hold - the categories and the specific pieces of personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
- Delete it - subject to records we are required to keep, such as completed transactions.
- Correct it - if something we hold about you is wrong.
- Opt out of sale or sharing - we do neither, so this is already the case for everyone.
- Limit the use of sensitive personal information - we collect none, so there is nothing to limit.
We will never deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.
Making a request
Email privacy@collectivehubcenter.com and say what you want us to do. You do not need to use any particular wording.
We will confirm we received your request within ten business days and respond within forty-five calendar days. If we need longer we will tell you why, and we will not take more than ninety days in total.
Before we act we have to be reasonably sure you are who you say you are, so we will ask you to confirm details we already hold - typically the email address a booking was made under. We will not ask you for a government ID, and we will not use anything you send us to verify a request for any other purpose.
Someone may make a request on your behalf as an authorised agent. We will ask for written permission signed by you, and we may still contact you directly to confirm it.
Children
Our events are family friendly and children are welcome at them. This website and our booking system are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
Security
Administrative access is password protected, with the password stored only as an Argon2 hash, and sessions expire. Traffic to this site is encrypted in transit. Payment details are handled entirely by Stripe and PayPal. IP addresses are stored only as salted hashes.
No system is perfectly secure, and we will not pretend otherwise. If we ever discover a breach affecting your personal information, we will notify you as California law requires.
Changes
If we change this notice we will update the date at the top of the page. If the change is significant - new categories of information, a new purpose, a new recipient - we will say so on the site, and by email to anyone on the mailing list.
Contact
Privacy questions and requests: privacy@collectivehubcenter.com
Anything else: @collectivehubcenter on Instagram.
Collective Hub Center, San Gabriel, California.