Privacy policy

Confispace ("Confispace", "we", "us" or "our") designs and develops event technology in California, USA. Our products — including Confispace Check-in and the Confispace Attendee App — help organizers welcome guests, run their events and show the value they deliver. Every event holds people's personal details, and we take protecting them seriously: for the people who visit our website, for our customers, and for every attendee, speaker, sponsor and exhibitor at the events our products power.

This policy explains what personal information we collect, how we use and share it, how we protect it, and the choices and rights you have. Please also read our website terms.

1. Who this policy covers

This policy applies to personal information we handle as a controller — where we decide why and how it is used. That includes:

• Website visitors — people who browse confispace.com.
• Prospects and enquirers — people who book a demo, plan a pilot event, download a resource, contact us or meet us at events.
• Customer contacts — the people at organizations that buy or trial our products, such as account owners, administrators and billing contacts.
• Partners and suppliers — people who work with us on behalf of their organizations.

It does not cover the personal information our customers put into our products to run their events — for example guest lists, registrations, check-ins, badges, session attendance, app activity and exhibitor leads. For that information we act as a service provider (processor) on our customer's behalf, and the event organizer's own privacy notice applies. Section 13 explains how we handle that data.

2. Information we collect

Information you give us

• Contact and business details — your name, work email, company, job role and, if you choose, phone number.
• Your enquiry — the kind of event, its size and date, the products you're interested in, and anything you write in a message.
• Customer and account details — if your organization becomes a customer or runs a pilot: contact and billing details, contract records, and the support and service conversations we have with you.
• Event and meeting details — if you register for an event or webinar we host, attend a demo, or speak with our team.

Information collected automatically

• Technical information — browser and device type, pages viewed, the page that referred you, and the campaign that brought you to us (UTM parameters), which we attach to your enquiry if you send one.
• Security information — a one-way, salted fingerprint of your IP address, used only to stop spam and abuse. We never store the IP address itself.
• Cookies and similar technologies — only as described in section 6, and only as far as your choices allow.

Information from others

• People and organizations who refer you to us, such as event partners, agencies and venues.
• Our customers, when they add you as a user of their account.
• Public business sources, such as your company's website, to understand an enquiry you've sent us.

We don't ask for sensitive personal information (such as health, religious beliefs or financial account details) through our website, and we ask you not to send it.

3. How we use information, and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the legal bases shown for each purpose.

• To respond to you and arrange demos and pilot events — to take steps you've asked for before a contract, and our legitimate interest in answering enquiries.
• To provide our products and services to customers — to perform our contract with your organization, including onboarding, support, billing and service communications.
• To send marketing you've asked for, or that relates to products you use — your consent where the law requires it, otherwise our legitimate interest. You can opt out at any time.
• To understand and improve our website — your consent for analytics that use cookies; our legitimate interest for cookieless, aggregate measurement.
• To keep our website, products and users secure — our legitimate interest in preventing spam, fraud and abuse.
• To meet legal obligations and protect our rights — legal obligation, and our legitimate interest in establishing or defending legal claims.

When we rely on legitimate interests, we balance them against your rights and interests, and you can object at any time (see section 10). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. How we share information

We never sell personal information, and we never share it for cross-context behavioral advertising. We share it only:

• With service providers who help us run our business, under contracts that require them to protect it and use it only on our instructions — see the list below.
• With professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
• When the law requires it, or to respond to valid legal process, protect the safety of any person, or protect our rights and property.
• In a business transaction, such as a merger, acquisition or sale of assets, subject to this policy's protections.
• With your consent, or at your direction.

Our service providers for this website

• Vercel — website hosting.
• Supabase — the database that stores form submissions.
• Resend — delivery of our replies and confirmation emails.
• Analytics providers — only if enabled, and only as your consent choices allow.

5. International transfers

Confispace is based in the United States, and our service providers may process information in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use recognized safeguards — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — and additional measures where needed.

For enterprise customers, event data can be hosted in the region their policies require; this is agreed in the customer's contract.

6. Cookies and similar technologies

What we use

• Strictly necessary — your privacy choice, a "light mode" setting that keeps the site fast on slower devices, and the details you enter during your visit (kept only until you close the tab). These don't track you, so they don't need consent.
• Analytics — if we use analytics tools that set cookies, they load only after you press "Accept". Cookieless, aggregate visit counting may run unless you decline.
• No advertising cookies. We don't use cookies to show you ads or to track you across other websites.

Your choices

• Use Privacy choices at the bottom of every page to accept or decline analytics, and to change your mind at any time.
• If your browser sends a Global Privacy Control signal, we automatically treat it as a request to opt out, and nothing that tracks you will run. We treat "Do Not Track" requests the same way where our tools support them.
• You can also block or delete cookies in your browser settings.

Fonts are served from our own website, and product videos use privacy-enhanced players that load only when you press play.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy:

• Enquiries — usually no more than 24 months after our last conversation, unless you become a customer.
• Customer records — for the length of the relationship and afterwards as required for legal, tax and accounting purposes.
• Marketing preferences and consent records — for as long as needed to honor your choices.
• Security information — for short periods, unless needed to investigate an incident.

When information is no longer needed, we delete or anonymize it.

8. How we protect information

We use organizational, technical and administrative safeguards designed for the sensitivity of the information, including:

• Encrypted connections for our website and products.
• Access on a need-to-know basis, with role-based permissions and a record of who changed what.
• Separation of each customer's data, so one client's events and guests never mix with another's.
• Data minimization — for example, storing a salted fingerprint of an IP address rather than the address itself.
• Device protection in our event apps — sign-in required, data encrypted on the device, screenshots blocked, optional face or fingerprint lock, and remote switch-off for a lost phone.

No system is perfectly secure, but we work continuously to protect your information, and we will notify you and the relevant authorities of a personal data breach where the law requires it.

9. Your choices

• Marketing emails — use the unsubscribe link in any marketing email, or email contact@confispace.com and we'll stop. We may still send service messages, such as replies to your requests or account notices.
• Analytics — use Privacy choices, or send a Global Privacy Control signal.
• Forms — you decide what to send us; only your name and work email are required.

10. Your privacy rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information.
• Stop marketing to you.

EU, EEA, UK and Switzerland

Under the GDPR and similar laws you also have the right to restrict our use of your information, to object to processing based on legitimate interests (including profiling and direct marketing), to data portability, and to withdraw consent at any time without affecting earlier processing. You have the right to complain to your local data protection authority — though we'd welcome the chance to address your concern first.

Other regions

People in other places with privacy laws — including Canada, Brazil, India, Australia, Singapore and Japan — have rights to access, correct and, in many cases, delete their information or withdraw consent. We honor these requests as the applicable law requires.

How to make a request

Email contact@confispace.com with "Privacy request" in the subject, or use the contact form on our homepage and choose "Just say hello". We may need to confirm your identity before acting on a request. We'll respond within one month (45 days for requests under US state laws), and tell you if we need more time. We won't discriminate against you for exercising your rights.

11. US state privacy notice

This section supplements the policy for residents of California and other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.

Notice at collection

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 2 and 3:

• Identifiers — such as name, email address and phone number.
• Professional information — such as company and job role.
• Commercial information — such as products you've asked about, and records of purchases or pilots.
• Internet activity — such as pages viewed and the campaign that referred you, only as your choices allow.
• Inferences — such as which product may suit your event, based on what you've told us.

We disclose these categories only to the service providers and recipients described in section 4, for business purposes. We keep them for the periods in section 7.

Sale, sharing and sensitive information

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit.

Your rights

Depending on your state, you have the right to know what personal information we collect, use and disclose; to access and receive a portable copy; to correct and to delete it; to opt out of sale, sharing, targeted advertising and certain profiling; and not to be discriminated against for exercising these rights. We honor Global Privacy Control as a valid opt-out request.

An authorized agent may make a request on your behalf with your written permission; we may ask you to verify your identity directly. If we decline your request, you may appeal by replying to our decision or emailing contact@confispace.com with "Privacy appeal" in the subject, and we'll respond within the time the law requires. If your appeal is denied, you may contact your state's Attorney General.

12. Children

Our website and products are designed for businesses and event professionals, and are not directed to children under 16. We do not knowingly collect personal information from children through our website. If you believe a child has sent us personal information, email contact@confispace.com and we'll delete it. Event organizers who invite minors to their events are responsible for obtaining any consent the law requires.

13. Event data in our products

When an organizer uses Confispace to run an event, the organizer (our customer) controls the personal information of their guests, attendees, speakers, sponsors and exhibitors, and decides how it is used. We process that information only on our customer's instructions and under our agreement with them, which includes data protection terms where the law requires them.

Our products are built to protect event data by default:

• Private to each event — attendee details are seen only by the people whose job needs them.
• Every client separate — one customer's events, guests and reports never mix with another's.
• Access by role — organizers, door staff, sponsors and clients each see only what their role allows; exhibitors see a visitor's phone number only if the organizer allows it.
• Every change recorded — an activity log shows who changed what, and when.
• Badges and codes that can't be reused — a reissued badge stops the old one working, and shared screenshots of contact codes expire.
• Data portability and deletion — organizers can export their event data, and correct or delete a guest's details whenever they ask.

If you attended an event that used Confispace, please contact the event's organizer with any questions or requests about your information. If you contact us, we'll pass your request to the organizer and help them respond.

14. Links to other websites and services

Our website may link to websites and services run by others, such as social networks and app stores. Their own privacy policies apply, and we encourage you to read them.

15. Changes to this policy

We may update this policy from time to time. We'll change the date at the top of this page, and if we make material changes we'll give more prominent notice — for example, on our website or by email to customers.

16. Contact us

For questions about this policy or to make a privacy request, email contact@confispace.com, or use the contact form on our homepage and choose "Just say hello". We read every message.

Confispace — designed and developed in California, USA.