Privacy policy

Who is responsible

Sindh Literary Foundation is the organisation responsible for this information. The festival is held in Karachi, Pakistan (SLF 2026: 21–22 November at Mohatta Palace Museum).

Privacy questions and requests: [email protected]. You can also use the contact form at /contact.

What we collect

Free passes: name, email, phone, city, preferred days, optional interests, and whether you asked for programme updates. We create a pass record and a signed QR token so you can enter the venue.

Applications (speakers, volunteers, stalls, media): the details you submit on the form, including contact details and answers you provide. Volunteers also receive a volunteer ID used to sign in to the visitor scanner.

Safeer-e-Sindh nominations: nominee details and the nominator’s name and email.

Newsletter: email address and language preference. We use double opt-in: we email a confirmation link, and you are only subscribed after you open it.

Contact messages: name, email, topic and message.

Certificates: name, optional email, role (speaker, volunteer or awardee), edition year, and a public certificate ID used on the verify page.

Gate and scanner use: when a pass is checked in, we store the scan time, gate label and result. Volunteer scanner sign-in uses the volunteer’s email and volunteer ID.

Technical data: IP address and basic request data for rate limits, security (including Cloudflare Turnstile when enabled), and to keep the service reliable. Server logs may include a request id.

Why we use it

To issue and verify festival passes, manage capacity and waitlists, and run entry at the venue.

To review applications and nominations, schedule volunteers, and issue certificates.

To send transactional email (pass confirmation, reminders, application replies, certificate links) and, if you confirm, festival updates.

To answer messages you send us, protect the site from abuse, and meet legal and accounting duties.

Where it is stored and who helps us

Festival content and personal records are stored in our database (hosted with Supabase) and operated through our CMS on Hostinger. The public site may be served via Cloudflare.

Email is sent through Resend using our templates. We do not sell your personal information.

Staff with the right role in the CMS can access records needed for their work (for example passes, programme or content).

Cookies

Essential cookies keep signed-in sessions working (for example staff, volunteers on the scanner, or a review gate on staging).

Optional analytics cookies help us see which pages people use. The cookie notice on the site lets you accept or decline. If you decline, the site still works. See also this privacy policy from the cookie banner.

How long we keep it

We keep pass-holder and related personal details for 12 months, then anonymise them so counts still work but the person can no longer be identified from those fields.

Speaker emails and notes follow the same 12-month rule from the relevant festival dates or last related activity. Non-admin staff accounts inactive for 12 months are anonymised. Admin accounts are kept.

Short-lived security data (rate limits, magic links, device tokens, idempotency keys) expires on a much shorter schedule (minutes to days).

Certificate records needed to verify an ID may be kept for as long as we offer public verification for that festival year.

Your choices and rights

You can unsubscribe from festival updates using the link in those emails.

You may ask for a copy of the personal data we hold about your email address, or ask us to delete it, by writing to the privacy address above. We will need enough detail to find your records and may ask you to confirm the request.

Some information must stay in anonymised or aggregated form (for example attendance counts). Message logs may retain delivery status without your address after retention runs.

Children

The festival is a public cultural event. Passes and forms are aimed at adults or young people with a parent or guardian’s involvement. If you believe we hold a child’s data without appropriate consent, contact us and we will review it.

Changes

We may update this policy when our practices or the law change. The “Last updated” date at the top of this page will change when we do. The current version is always published at /privacy.