Privacy

Who is responsible

Noam Shuster-Eliassi is responsible for the data described here.

Back to top

The short version

• No cookies. None at all, so there is nothing to consent to.
• No advertising trackers, no social embeds, no tag managers. Exactly two pieces of code written by another company run in your browser when a page loads: the cookieless page counter, which is served from this site’s own server, and the spam check on the two forms. A third runs only if you choose to: pressing play on a video loads that video’s player from the platform that hosts it. All three are described below.
• There is no database behind this site and no account to create. Nothing you do here is stored on our side.
• Data reaches us in exactly three ways: you send the contact form, you sign up for date alerts, or your browser loads a page and counts as one anonymous visit.

Back to top

What is collected, and why

If you use the contact form

The form takes four things: your name, your email address, your message, and which of the four routes it should go to (booking, press, accessibility or other). There are no hidden fields and nothing else is recorded - not your IP address, not the time you sent it.

The message is passed straight to an email delivery service, which delivers it to the mailbox for that route, and is not stored anywhere on this site. The reply address is set to yours, so an answer comes back to you directly.

Legal basis: our legitimate interest in reading and answering an enquiry you deliberately sent us (GDPR Art. 6(1)(f)). For booking enquiries it is also a step taken at your request before a possible contract (Art. 6(1)(b)). We do not ask you to consent, because you cannot send a message without sending it, and consent that has no alternative is not real consent.

If you sign up for date alerts

The signup takes three things: your email address, your city and your country. It exists to do one thing - tell you if a show is booked near you. It is not a newsletter and there is nothing else it sends.

Those three fields go to an email marketing platform based in the European Union, which stores the subscription and sends the alerts. Your address is added to one list and used for nothing else. Every alert carries an unsubscribe link, which removes you immediately.

Signing up takes two steps: you submit the form, then you click a link in a confirmation email. Nothing is sent to you until you do, so an address cannot be added to the list by somebody else, and the confirmation is also the record that you agreed. If you never click it, the address is dropped - it is never stored as a subscriber.

The confirmation email comes from the platform, and the platform keeps a record of that step as proof that you agreed: when you submitted the form, and when and from which IP address you clicked the confirmation link. That is the one place anything about your connection is kept on your behalf, and it is kept with your subscription - it goes when the subscription does. This site itself does not see or store it.

That platform counts clicks on the links in alert emails, so we can see which dates draw interest, but the count is anonymous, and no record of which links you clicked exists. Tracked links work by redirecting through the platform, so nothing is stored on your device and no cookie is involved.

Legal basis: your consent (GDPR Art. 6(1)(a)), given by confirming the address, and covering the link tracking described above as part of the same subscription. Israeli law treats a message promoting ticket sales as advertising and requires that consent in advance; UK subscribers are covered by the same consent under PECR reg. 22, since nothing is sold on this site and the soft opt-in for existing customers does not apply. You can withdraw it at any time by unsubscribing, without giving a reason and without affecting anything that happened before.

When you simply read a page

Pages are counted, visitors are not. The site uses a privacy-focused, cookieless analytics service hosted in the European Union, and it is routed through this site’s own server so that nothing in your browser ever talks to the analytics company directly.

What is passed on is the page you viewed, the referring page if there was one, your browser’s user-agent string, and your IP address - which the analytics service converts into a one-way hash with a salt that changes every day, and then discards. Approximate country and device type are derived from that; nothing more precise exists.

All actions are counted as well: a click on a link or a button, downloading a file, submitting a form and so on. Each is recorded with the thing it concerned - which show, which calendar, which page, and so on - and never with anything about you.

Legal basis: our legitimate interest in knowing which pages and which shows people actually look at (GDPR Art. 6(1)(f)). Because nothing is written to or read from your device, the rules that require consent for cookies and similar storage do not apply here - which is precisely why this site has no cookie banner.

The spam check and the flood limit

All forms are protected by Cloudflare Turnstile, a privacy-preserving alternative to a CAPTCHA. It is the second of the two pieces of third-party code that run on page load, and the only one loaded from another company’s server without you asking. It runs in your browser and tells our server whether the submission looks human. Cloudflare necessarily sees your IP address and some browser characteristics in order to make that judgement; deliberately, we do not pass your IP address to it ourselves.

Each form also has a limit on how many submissions one IP address can make in a minute. Your IP address is used as the key for that counter and for nothing else: it is not written to a log, not stored, and not sent anywhere. Request logging on this site’s server is switched off, for the same reason.

Legal basis: our legitimate interest in keeping the forms usable and not being flooded (GDPR Art. 6(1)(f); the regulation names network and information security as such an interest).

What is kept in your browser

No cookies are set - not by this site, and not by anything on it. One thing is stored on your device: when you submit either form, what you typed is saved in your browser’s session storage so that an error page does not cost you a written message. It stays on your device, is never sent anywhere, is removed the next time the form loads, and disappears when you close the tab.

Videos

The videos on this site are hosted elsewhere: YouTube and Vimeo. Until you press play, all this site shows is a still image served from here, and neither platform is contacted. When you press play, that platform’s player loads in your browser and you are then subject to its privacy terms; it may set its own storage. The YouTube player is loaded through its no-cookie address and the Vimeo player with its do-not-track setting, which is as far as we can limit what they do. If you never press play, nothing happens.

Back to top

Who else sees your data

Only companies that process it on our behalf, under contract, for the purposes described above. Nothing is sold, and nothing is shared for advertising.

• Cloudflare (United States) - hosts and serves this site, provides the spam check and the flood limit. It handles every request as part of delivering the page.
• An email delivery service (United States) - carries contact-form messages to the mailbox.
• A business email provider (established in Ireland, with data centres worldwide) - the mailbox that receives contact-form messages.
• An email marketing platform (European Union) - stores date-alert subscriptions and sends the alerts.
• Plausible Analytics (European Union) - the cookieless page counting described above.

The three email services are described by role and location rather than by name, for the same reason there is no address on this site: naming the platform that holds a subscriber list is useful to someone attempting a targeted attack. If you make a request to see your own data, you will be told exactly which companies hold it.

Back to top

Where your data goes

Analytics and the date-alert list are stored within the European Union; the platform that holds the list has support staff outside it, who work under the standard contractual clauses. Hosting and contact-form delivery involve companies established in the United States, and the mailbox provider, although established in Ireland, may hold a message in its data centres outside the EU. So a contact-form message and the ordinary metadata of your connection are processed outside the EU and outside Israel.

Two things make that lawful. Israel is recognised by both the European Commission and the United Kingdom as providing adequate protection, so data reaching Israel needs no further safeguard. For the companies that process data in the United States, the safeguard is contractual: each is engaged under a data processing agreement containing the standard contractual clauses, which is also what Israeli law requires before data leaves the country, and each is also certified under the EU-US Data Privacy Framework. Ask through the contact form if you want the current state of any of them.

Back to top

How long it is kept

• On this site: nothing, ever. There is no database, and the forms hold what you typed only for the moment it takes to pass it on.
• Contact-form messages: three years from the last message in the exchange, then deleted from the mailbox. The one exception is a booking that led to a paid engagement, kept for seven years from the last interaction. The delivery service that carries a message also holds a copy for thirty days.
• Date-alert subscriptions: until you unsubscribe or ask for deletion - a list you asked to be on has no natural expiry. No record of which links you clicked is kept; clicks are counted without being tied to anyone.
• The flood-limit counter: about a minute.

Back to top

Your rights

You can ask to:

• see what data is held about you, and get a copy;
• have anything inaccurate corrected;
• have it deleted;
• object to processing based on legitimate interests, and to have processing restricted while an objection is considered;
• receive the data you gave us in a portable form;
• withdraw consent to date alerts at any time - the unsubscribe link in any alert does it instantly.

How to use them

Send a request through the contact form, choosing “Other”, and say what you want. Because an email address is the only identifier that exists here, a request has to come from - or be confirmed from - the address concerned; you will not be asked for an identity document, which would mean collecting more about you than is held. You will get an answer within 30 days.

If you are not satisfied

You can complain to the Israeli Privacy Protection Authority; if you are in the European Union or the European Economic Area, to the data protection authority of the country where you live; and if you are in the United Kingdom, to the Information Commissioner’s Office.

Back to top

What this site never does

• Set a cookie, of any kind, for any purpose.
• Load advertising, tag managers, or social media embeds.
• Build a profile, score you, or make an automated decision about you.
• Log your IP address. (The one exception is the date-alert platform’s record of the IP address you confirmed from, described above - kept by the platform as proof of consent, never by this site.)
• Sell, rent or share your data for anyone else’s purposes.
• Ask for anything beyond the fields listed above - there are no hidden fields in either form.

If any of that ever changes, this page changes with it, in the same release.

Back to top

Changes to this page

Last updated 12 September 2026.