Privacy policy

We collect only the data necessary to organise events, handle registration, communicate with you and provide our services:

• Identity and contact data: name, email address, phone (if provided), organisation, role.
• Registration data: participation mode (in person / remote), answers to event questions, dietary or accessibility needs (if you provide them).
• Account data (for organisers): login email, password hash, organisation membership, role on the platform.
• Payment data (for paid services): billing and subscription information. Card details are handled solely by our payment provider — we never see or store them.
• Technical and usage data: IP address, browser type, device, visit time, interaction logs — stored in pseudonymised form.

We do not intentionally collect special-category (sensitive) personal data and ask that you do not submit it in free-text fields.

Each processing purpose is grounded in one of the legal bases set out in the GDPR:

Marketing messages are sent only after a separate opt-in; you may withdraw consent at any time without affecting processing carried out before withdrawal.

We do not sell personal data. We disclose data only to trusted service providers (processors) acting on our instructions under signed data-processing agreements:

• Database, authentication and file storage — Supabase (database and files hosted in the EU region).
• Application build and hosting platform — Lovable (Sweden, EU).
• Payment processing — Stripe (card data is handled solely by Stripe under the PCI-DSS standard).
• Email and notification delivery — Resend (United States).
• AI features — Anthropic (United States). When an organiser uses text drafting, translation or tone-analysis, the relevant event content (including speaker biographies and the organiser's own writing samples) is sent to the Anthropic API for processing. Attendee registration data is not sent to these features.
• The event organiser — when you register for an event, your registration data is provided to the relevant organiser, who is an independent controller of that data.

This list is our sub-processor register. We update it before engaging a new provider; the date of the current version is shown at the top of this page.

We may also disclose data to competent authorities where required by law.

• Event registration data — up to 24 months after the event, then anonymised.
• Organiser account data — while the account is active, and up to 12 months after closure.
• Accounting and payment records — for the period required by law (typically 10 years).
• Technical logs — up to 12 months.
• Data processed on the basis of marketing consent — until consent is withdrawn.

How these periods are applied in practice: the platform has an anonymisation routine that strips names, email addresses, free-text answers and uploaded-file links from records of events that have ended, and deletes technical logs. Every run is written to an audit log. There is not yet an automatic daily schedule — the routine is started by the platform operator, so actual anonymisation may lag behind the period stated above. You do not have to wait for it: you may request erasure of your data at any time (see section 8) and we act on such a request without delay.

Under the GDPR you have the following rights regarding your personal data:

• to access the data we process;
• to have inaccurate data rectified;
• to have data erased (the “right to be forgotten”);
• to restrict processing;
• to receive your data in a structured, machine-readable format (portability);
• to object to processing based on legitimate interest;
• to withdraw any consent at any time.

To exercise your rights, contact privatumas@aeratus.app.

You also have the right to lodge a complaint with the supervisory authority — the State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, Vilnius, Lithuania, ada@ada.lt, vdai.lrv.lt.