Privacy Policy
This Privacy Policy explains how Eventscue, operated as a sole proprietorship ("Eventscue", "we", "us"), collects, uses, shares, and protects personal data when you use the Eventscue website and application (the "Service"). Eventscue is a business-to-business account- and event-intelligence tool intended for use by professionals; it is not directed to children and we do not knowingly collect data from anyone under the age of 16.
1. Who we are
The data controller is Eventscue, operated as a sole proprietorship. For any privacy question, or to exercise your rights, contact us at hello@eventscue.com; a postal address is available on request.
2. Data we collect
a. Account & usage data (data you give us)
- Account details: your name, email address, workspace name, and password (stored hashed by our authentication provider). We also record the date and time you accept this Policy and the Terms of Service, and which version of them you accepted.
- Billing data: if you subscribe, our payment provider (Stripe) collects and processes your payment details. We never receive or store your full card number. We keep only your subscription status, plan, and the provider's customer and subscription identifiers.
- Enquiries: if you use our contact form, we store the name, email address, company, and message you submit so we can reply to you.
- Ideal-customer profile (ICP): the industries, regions, buyer titles, company sizes, competitors, and notes you enter to run research.
- Usage & diagnostic data: logs, timestamps, and error data generated as you use the Service, used to operate and secure it.
b. Research data about third parties (data we process on your behalf)
To do its job, the Service builds an event catalog containing limited professional information about people connected to public B2B events, namely a person's name, job title, employer, employer domain, the way they participate in an event (e.g. speaker, sponsor), and the public source URL and text snippet that evidenced it. This information is gathered only from surfaces that are already public: an event's own speaker / agenda / sponsor pages, and public search-engine results. We deliberately do not collect email addresses, phone numbers, or home/private addresses, and we never fetch LinkedIn pages. Where a search-result snippet references LinkedIn, the search engine is the source, not LinkedIn.
Our lawful basis for processing this professional data is our and our customers' legitimate interest (GDPR Art. 6(1)(f)) in B2B event prospecting, balanced against the rights of the people concerned. Our internal Legitimate Interest Assessment is available on request. The catalog is shared across customer workspaces, but each customer can only see catalog people for events on their own radar.
c. Scanned leads from the Eventscue Scan iPhone app (data you capture on our behalf)
The Eventscue Scan app lets you capture the people you meet at an event by pointing the phone's camera at their attendee badge QR code or business card. The app asks for camera permission before it is used, and the camera runs only while the scanner screen is open. Text on a business card is read on the device (Apple's Vision framework); no image leaves the phone for that step.
A scanned lead contains what the badge or card carried: typically the person's name, job title, company, email address, and phone number, plus any notes you add. Unlike the event catalog above, this data is collected only at your explicit initiative, one person at a time, from someone who handed you their badge or card, and it is visible only inside your own organization's workspace. It is not added to the shared event catalog and is never sold or used for advertising.
To fill in fields the badge or card did not spell out, the scanned text and, for business cards, the card photo are sent to OpenAI (see section 4) for one automated pass. The app tells you this and asks you to acknowledge it before the first upload. Card photos are used for that pass and discarded; we do not store them. Scanned leads are kept until you or your organization delete them, or the organization's account is deleted.
3. How we use data
- To provide the Service: research your ICP into ranked accounts, map events, and surface likely event participants for your review.
- To operate, secure, debug, and improve the Service.
- To communicate with you about your account and service-related matters.
- To comply with legal obligations.
We do not sell personal data. Outputs are provided to you for a human reviewer to act on; the Service does not send outreach on your behalf and performs no automated decision-making with legal or similarly significant effects.
4. How we share data
- Service providers (processors): providers that help operate the Service, under contract and only as needed. Currently: Supabase (authentication, database, and hosting), OpenAI (LLM processing: research extraction, and completing the fields of leads scanned with the iPhone app from the scanned text and card photo; OpenAI's API does not use this data to train its models), Serper and Google (search), Stripe (subscription payments), Resend (transactional and enquiry email), and Hostinger (server hosting).
- Legal: where required by law or to protect rights, safety, and security.
- Business transfers: in connection with a merger, acquisition, or asset sale.
5. International transfers
Data may be processed in the United States. Where data leaves your region, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Retention
- Account & ICP data: kept for the life of your account and deleted or anonymised within 30 days of account closure (immediately for data you delete yourself, with residual backups purged within 30 days), subject to legal retention needs.
- Cached search results: expired on a rolling basis (currently a 7-day window).
- Event-catalog people: our retention window is 18 months from the latest event edition a person is associated with. The automated sweep that enforces this window is built and is in the process of being switched on; until it runs on a schedule, records past the window are removed by operator sweep or on request. Removal on request is always available and is actioned straight away: see "Your rights".
7. Your rights
Depending on your location (e.g. GDPR/UK GDPR, CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to processing based on legitimate interest. This applies both to account holders and to people included in the event catalog.
You can delete your account and all associated workspace data yourself at any time from Settings → Account → Delete account on the web, or Settings → Delete account in the Eventscue Scan iPhone app; this removes your login, workspace data, and scanned leads immediately, and cancels any subscription.
If someone scanned your badge or business card with the app and you want that record removed, email hello@eventscue.com with the event and the company you met; we will locate and delete it.
If you are named in our event catalog and did not sign up for Eventscue, you can ask us to remove you using our removal form. We record the request, remove the matching records from the catalog and from every customer workspace holding them, and keep a suppression entry so a later refresh does not add you back. The form asks for the employer listed against you; if you do not know it, or you want every listing removed whatever the employer, email hello@eventscue.com and we will action it by hand.
California residents: we do not sell or share personal data as the CCPA/CPRA define those terms, and we do not use it for cross-context behavioural advertising. You can still exercise the opt-out directly: Do Not Sell or Share My Personal Information. That link goes to the same removal and suppression process described above.
To exercise any other right, email hello@eventscue.com: we will confirm what data we hold, and on request delete or suppress it. We aim to acknowledge within 1 business day and complete within 7 business days. You also have the right to lodge a complaint with your supervisory authority.
8. Security
We protect data with tenant isolation (row-level security), encrypted transport, scoped access tokens, and least-privilege service credentials. No system is perfectly secure, but we work to protect your data and to notify you and regulators of qualifying breaches as required by law.
9. Cookies & local storage
The application uses strictly necessary storage to keep you signed in (authentication session tokens). We do not use third-party advertising or cross-site tracking cookies, and we do not use third-party analytics.
10. Changes
We may update this Policy; we will revise the "Last updated" date and, for material changes, provide additional notice. Continued use after changes take effect constitutes acceptance.
11. Contact
Questions or requests: hello@eventscue.com (a postal address is available on request).