Privacy Policy

This Privacy Policy explains what information Convova (“we”) collects, how we use it, and the choices you have, when you use Convova (the “Service”). It applies to attendees, to the people who run hosts and events, and to anyone who buys a ticket.

• Account information that you provide, such as your name, email address, and optional profile details (title, organization, bio, avatar, phone, and social or web links).
• Event participation data, such as the tickets you hold and who sent them to you, your check-in records, the sessions you save or like, the questions you ask the organizers, and the connections you make with other attendees.
• Purchase data. When you buy a ticket, we record the order: what was bought, the amount, the email you used, and the addresses of the receipt and invoice that Stripe issues. The card itself is entered on Stripe's pages and never reaches us. When a host pays Convova, the card is saved at Stripe and we keep only a reference to it.
• Host information, if you run a host: its name, address, logo, description, website, its members, and the identifier of the Stripe account it connects. Stripe collects the identity and bank details that payouts require; we do not see them.
• Content you submit, including, if you run events, the attendee information you invite or import and the event content you publish.
• Technical information, such as basic server logs, a session cookie that keeps you signed in, and page-view counts with no personal identifiers.

We use this information to run the Service: to authenticate you and keep you signed in; to deliver your pass and tickets and enable check-in; to process orders and fees and send receipts; to power scheduling, questions, and networking; to send transactional messages such as tickets, invitations, sign-in codes, and announcements; to prevent abuse, such as coupon guessing and card testing; and to improve the Service.

When you take part in an event, the host and the event's members can see what they need to run it: your profile details, every ticket you hold for the event and its state, your check-in records, your orders for that event, and the questions you send them. This sharing is a core part of how events work on the Service. The host is responsible for how it uses that information.

Networking is driven by your actions. When you connect with another attendee, for example by scanning their badge, you share your profile information with that person. Your name, title, and organization are printed on your badge. Aggregate signals, such as the number of likes on a session, may be visible to others, but who liked a session is not.

A published event has a public page: its name, dates, place, description, schedule, speakers and other contributors, sponsors and exhibitors, and the host's name, which links to the host's own public page. Hosts choose what to publish there, and anything published can be read and indexed by anyone. Tickets, attendees, orders, and check-ins are never public.

We rely on third parties to run the Service, and they process information on our behalf under their own confidentiality and security obligations: cloud hosting and our database provider; an email-delivery provider; Stripe for every payment, receipt, invoice, and payout; Cloudflare Turnstile, which checks that a sign-in is not automated; and a privacy-preserving analytics service that counts page views without cookies or personal identifiers.

We keep your information for as long as your account or the relevant event is active, and as needed to run the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Order and fee records are kept for as long as tax and accounting rules require. When information is no longer needed, we delete or anonymize it.

We use reasonable technical and organizational measures to protect your information, including hashed passwords, encrypted transport, an httpOnly session cookie, and signed links for claiming tickets. Card details never touch our systems. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We set one strictly necessary cookie, to keep you signed in. We do not use cookies for advertising or tracking. Stripe's checkout and account pages and Cloudflare Turnstile set their own cookies while you are on them, under their own policies.

You can review and update your profile, and change your email address or password, from your settings. Your tickets and orders are in the app. You may request deletion of your account by contacting us; order records that we must keep for accounting are retained. Depending on where you live, you may have additional rights regarding your personal information; contact us to exercise them. For information a host holds about you, the host is the controller and you may also contact the host directly.

The Service is not directed to children, and we do not knowingly collect personal information from children under the age required by your jurisdiction. If you believe a child has provided us information, please contact us.

We may update this Privacy Policy from time to time. When we do, we will revise the date above, and, if the changes are material, take reasonable steps to notify you.

Questions about this policy? Email us at [email protected].