Privacy Policy

Welcome to Conferras. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use and safeguard your information when you use our event networking app and website.

Company: TenSeven UG (haftungsbeschränkt)
Address: Im Bruch 8, 27339 Riede, Germany
Represented by: Tammo Elsner, Valentin Spörk
Email: hello (at) conferras.com
For any data protection inquiries, please contact us at the email address above.

Event organizers: account information (name, email, organization name), securely hashed password, subscription and payment status, event data (name, description, dates, locations, branding assets, agenda, speakers, sponsors) and aggregated usage statistics.

Event attendees: profile information (name, role, company, interests, optional photo and social links), connections, chat messages, 1:1 meeting requests, bookmarks and event activity. Push notification tokens if you enable notifications.

Website visitors: contact form submissions (name, email, message content) and standard server logs.

Contract fulfillment (Art. 6(1)(b)): Processing necessary to provide our service to organizers and attendees, including account management, event access and subscription handling.

Consent (Art. 6(1)(a)): For optional features such as push notifications, contact form submissions and marketing communication. You can withdraw consent at any time.

Legitimate interest (Art. 6(1)(f)): For aggregated analytics to improve our service, and to ensure security and prevent fraud.

Payment processing (Stripe): When you subscribe to a paid plan, your payment information is handled directly by Stripe. We do not store your credit card details. See Stripe's Privacy Policy.

Hosting & infrastructure: Our service is hosted on infrastructure in the European Union. Some managed services may transfer data to the United States under Standard Contractual Clauses (SCCs) approved by the European Commission.

Push notifications: If you enable push notifications, we use browser push services (Apple Push Notification Service, Firebase Cloud Messaging) to deliver messages to your device.

Necessary storage: We use browser storage (localStorage and sessionStorage) for essential functionality: authentication tokens to keep you logged in, event session state, PWA install and notification prompt preferences, and your cookie consent choice. These are always active and are not used for tracking.

Google Analytics (analytics consent): If you allow analytics, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how our website is used (pages visited, clicks, device and browser type, approximate location, referring website). IP addresses are shortened by Google. We also record anonymous page views and button clicks on our own servers, without cookies or personal identifiers. Legal basis: your consent (Art. 6(1)(a) GDPR).

Google Ads (marketing consent): If you allow marketing, we use Google Ads conversion measurement and remarketing by Google Ireland Limited to measure the success of our ads and show relevant ads. Google may set cookies and combine this data with your Google account if you are signed in. Legal basis: your consent (Art. 6(1)(a) GDPR).

We use Google Consent Mode v2. Until you decide, analytics and advertising storage are denied and Google receives only cookieless, anonymous signals. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Analytics data is kept for up to 14 months. See Google's Privacy Policy and Google Ad Settings.

Withdrawing consent: You can change or withdraw your choice at any time by clicking Cookie settings. Withdrawal does not affect processing carried out before.

• Organizer accounts: retained until you delete your account.
• Event data: retained until you delete the event or your account.
• Attendee profiles: retained for the duration of the event and for up to 12 months afterwards, unless you delete your profile earlier.
• Contact messages: retained for up to 2 years, then deleted.
• Push notification tokens: deleted when you disable notifications or uninstall the app.

• Right to Access (Art. 15) — request a copy of the data we hold about you.
• Right to Rectification (Art. 16) — update your personal information in your account settings.
• Right to Erasure (Art. 17) — delete your account and all associated data.
• Right to Data Portability (Art. 20) — export your data in a machine-readable format.
• Right to Object (Art. 21) — object to processing based on legitimate interest.
• Right to Withdraw Consent (Art. 7) — withdraw any previously granted consent at any time.

• All data is transmitted over encrypted HTTPS connections.
• Passwords are securely hashed using industry-standard algorithms.
• Database access is protected by row-level security policies.
• Regular security reviews and dependency updates.

Your data is stored on servers located in the European Union. Some third-party services (e.g. Stripe, push notification providers) may transfer data to the United States. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. As we are based in Bavaria, Germany, the competent authority is the Bavarian State Office for Data Protection Supervision.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this page. We encourage you to review this Privacy Policy periodically.

For any questions about this Privacy Policy, contact us at hello (at) conferras.com .