Introduction
Attend ("Attend," "Company," "we," "us," or "our") is a service operated by Kardoe Incorporated ("Kardoe"). We are committed to protecting the privacy and security of personal information of our Customers, Visitors, and Customer Data Subjects. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with the Attend services, applications, and website (collectively, the "Services"). By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
Definitions
Customer: An individual who is an employee, contractor, or representative of an organization that has entered into an agreement with us to access and use our Services, including those who self-register.
Visitor: An individual who interacts with our website or marketing communications to learn about our products and services, download resources, or attend events.
Customer Data Subject: An individual who interacts with our Customers through our Services, such as clients, members, attendees, or other business contacts of our Customers.
Personal Information: Any information relating to an identified or identifiable natural person.
Scope of This Privacy Policy
This Privacy Policy applies to:
- Customers: When you use our Services as a Customer.
- Visitors: When you visit our website or engage with our marketing activities.
- Customer Data Subjects: When you interact with our Services through one of our Customers.
1. Information We Collect
1.1 Information Collected from Customers
a. Personal Information You Provide
We may collect the following Personal Information from Customers:
- Contact Information: Name, email address, telephone or mobile number (including where you provide it to receive SMS notifications), job title, and organization.
- Account Information: Username, password, and security questions.
- Financial Information: Billing address, payment status, and reference identifiers from our payment processor, Stripe. Card details are entered directly with Stripe, and we do not receive or store card numbers.
- Communications: Correspondence you send to us, including feedback and support requests.
b. Information Collected Automatically
- Device Data: IP address, browser type, operating system, device identifiers.
- Usage Data: Pages viewed, features used, date and time of access.
- Push Notification Tokens: Device or browser push tokens used to deliver push notifications, where you have enabled them.
- Analytics Data: Information collected through PostHog, our product analytics provider, such as pages and screens viewed, features used, device and browser type, approximate location derived from IP address, performance measurements, and your account identifier, to help us understand and improve our Services. We do not send your name or email address to PostHog.
1.2 Information Collected from Visitors
a. Personal Information You Provide
We may collect the following Personal Information from Visitors:
- Contact Information: Name, email address, phone number.
- Marketing Preferences: Your preferences for receiving marketing communications.
- Event Registrations: Information provided when signing up for events or webinars.
- Communications: Messages or inquiries you send to us.
b. Information Collected Automatically
- Device Data: IP address, browser type, operating system.
- Usage Data: Browsing activities, pages viewed, referral URLs.
- Analytics Data: We use PostHog, which sets first-party cookies and similar browser storage and collects information such as pages viewed, referral URLs, clicks, device and browser type, and approximate location derived from IP address, to help us understand how visitors use our website and improve our Services. If you are in the EEA, the UK, or Switzerland, we only do this with your consent; elsewhere it is on by default and you can opt out (see Section 4.1(c)). If you decline or opt out, PostHog counts your visit without cookies or other browser storage.
- Session Recordings: PostHog records your visits to our website, including the pages you view, mouse movements, clicks, and scrolling, so we can see how the website is used and fix problems. Anything you type into forms is hidden from these recordings. As with analytics, in the EEA, the UK, and Switzerland we record only with your consent; elsewhere recording is on by default and you can opt out.
- Advertising Data: We use the Meta Pixel, provided by Meta Platforms, Inc., which sets cookies and sends Meta information about your visit, such as the pages you view, your IP address, and browser details. Meta may combine this with other information it holds about you, under its own privacy policy, to measure and target our ads on its platforms. In the EEA, the UK, and Switzerland we load the Meta Pixel only with your consent; elsewhere it is on by default and you can opt out.
1.3 Information Collected from Customer Data Subjects
As a data processor, we process Personal Information on behalf of our Customers. The types of information collected are determined by our Customers and may include:
- Contact Information: Name, email address, mobile or phone number.
- Event Participation: Registration details, preferences, survey responses.
- Identity Document Information: Where a Customer asks for it (for example, to book travel), passport, national ID, visa, or driver's license numbers and similar identifiers. This information is protected by our Secure Vault and is end-to-end encrypted, as described in Section 5.2.
- Interactions: Communications and interactions with our Customers through our Services.
- Notification Data: Push notification tokens and mobile numbers used to deliver push notifications and SMS messages you have requested or consented to receive.
- Usage and Analytics Data: When you use our apps or websites, we collect usage information through PostHog, such as screens viewed, features used, device type, and approximate location derived from IP address, linked to your account or event pass identifier. We do not send your name or email address to PostHog. Usage information never includes the content of what you or the organizer submit, such as messages or form answers. We collect it for our own purposes, as the controller, to operate, secure, support, and improve the Services, and not on behalf of our Customers or for advertising. Organizers do not receive it in a form that identifies you.
2. How We Use Your Information
2.1 For Customers
We use Customer information to:
- Provide Services: Deliver, maintain, and support our Services.
- Account Management: Authenticate and manage Customer accounts.
- Communication: Send administrative information and respond to inquiries.
- Notifications: Send push notifications and SMS text messages related to events, account activity, and updates you have requested or consented to receive.
- Billing: Process payments and manage subscriptions.
- Improve Services: Analyze usage, including through PostHog, to enhance our Services.
- Legal Compliance: Comply with legal obligations and enforce agreements.
2.2 For Visitors
Enhance User Experience: Personalize your experience on our Website.
- Communicate: Respond to inquiries and provide information you request.
- Marketing: Send promotional materials and updates with your consent.
- Analytics: Analyze usage patterns, including through PostHog, to improve our Website and marketing efforts.
- Security: Protect the integrity and security of our Website.
2.3 For Customer Data Subjects
As a data processor, we process Personal Information of Customer Data Subjects solely on behalf of our Customers, following their instructions and the terms of our agreements with them. This includes delivering push notifications and SMS messages on behalf of, and as instructed by, our Customers. The exception is the usage information described in Section 1.3, which we use as described there.
3. How We Share Your Information
3.1 Service Providers
We may share your information with third-party vendors who perform services on our behalf, such as Hosting Providers, Payment Processors, Customer Support Services, Analytics Services (PostHog), Advertising Partners (Meta, for website visitors who have not opted out, or who consented where consent is required), Push Notification Services, and SMS/Text Messaging Providers. Mobile information, SMS opt-in data, and SMS consent are excluded from this general sharing and are handled as described in Section 3.7.
3.2 Affiliates
We may share information with our affiliates for purposes consistent with this Privacy Policy. We do not share mobile information, SMS opt-in data, or SMS consent with affiliates for marketing, promotional, or other purposes.
3.3 Legal Obligations
We may disclose your information to:
- Comply with Laws: Respond to legal processes or regulatory requests.
- Protect Rights: Enforce our terms and protect our operations.
3.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity.
3.5 With Your Consent
We may disclose your information for any other purpose with your explicit consent.
3.6 Secure Vault Data
Information stored in the Secure Vault is end-to-end encrypted, and we do not hold the keys needed to decrypt it. We therefore cannot read, use, share, or disclose its contents, including to our service providers, affiliates, or in response to legal process. Only people the Customer has granted vault access can decrypt it. See Section 5.2.
3.7 Mobile / SMS Opt-In Data
No mobile information, SMS opt-in data, or SMS consent will be shared with third parties or affiliates for marketing or promotional purposes. Other than sharing with aggregators, carriers, and providers of the text messaging service strictly as necessary to deliver SMS messages you requested or consented to receive, we do not sell, rent, trade, transfer, or otherwise share mobile opt-in data with third parties or affiliates. All categories of information sharing described above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates for their own marketing, promotional, lead generation, or analytics purposes. You may opt out at any time by replying STOP.
4. Your Rights and Choices
4.1 For Customers and Visitors
a. Access and Update
You may access, correct, or update your Personal Information by logging into your account or contacting us.
b. Opt-Out of Marketing Communications
You may unsubscribe from marketing emails by following the instructions in those emails or contacting us at legal@attend.vip.
c. Cookies and Similar Technologies
You can control the use of cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website. If you are in the European Economic Area, the United Kingdom, or Switzerland, our website asks for your consent before setting analytics and advertising cookies, recording your session, or loading the Meta Pixel. Elsewhere, these are on by default and you can opt out. We work out which applies from the approximate location of your connection; if we cannot tell, we ask for consent. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and keep these off. You can change your choice at any time using the "Cookie settings" or "Your privacy choices" link at the bottom of our website. If you decline, opt out, or withdraw consent, we stop recording, remove the cookies we set, and count your visits without cookies. You can also contact us at legal@attend.vip to ask us to delete analytics data associated with you. We do not use the analytics data collected in our apps for advertising.
d. Push Notifications
You can enable or disable push notifications at any time through your device or browser settings.
e. SMS / Text Messages
You may opt out of SMS text messages at any time by replying STOP to any message. Message and data rates may apply.
4.2 For Customer Data Subjects
As a data processor, we cannot directly fulfill requests from Customer Data Subjects. To exercise your rights, please contact the Customer (data controller) with whom you interacted. For your Attend account, or for usage information we collect for our own purposes, contact us directly at legal@attend.vip.
5. Data Security
5.1 Our Approach
We implement appropriate technical and organizational measures to protect your Personal Information against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit and at rest, separation of each Customer's data, role-based access controls, and audit logging, and end-to-end encryption for information stored in the Secure Vault. Our Security page describes these measures in more detail.
5.2 Secure Vault (End-to-End Encrypted Data)
Attend includes a Secure Vault for the most sensitive information an event may need, such as passport, national ID, visa, and driver's license numbers. Information placed in the Secure Vault is handled as follows:
- Encrypted on your device: The value is encrypted in your browser or app before it is sent to us. Our servers accept only encrypted values for Secure Vault fields and refuse unencrypted ones.
- We cannot read it: We store only the encrypted value and encrypted copies of the keys. We do not have, and cannot obtain, the keys or passphrases needed to decrypt it, so no Attend employee, service provider, or system can view the contents.
- The Customer controls access: The Customer's organization administrators decide which of their staff may access the vault. Each authorized staff member sets a personal vault passphrase that never leaves their device, and may also unlock the vault with a passkey on their own device (such as Face ID, Touch ID, Windows Hello or a security key); either way, every reveal is re-confirmed with a fresh, single-use challenge. Administrators can revoke access at any time.
- Decryption happens on the reader's device: When an authorized staff member reveals a value, it is decrypted in their own browser or app. The unencrypted value is never sent back to our servers.
- Information we can see: To operate the vault, we can see limited information that is not encrypted: the type of document (for example, "passport"), any label the Customer adds, which event and attendee the item relates to, when it was created or changed, and which staff members have vault access and when they request to reveal an item.
- Loss of access: Because we cannot decrypt vault contents, we cannot recover them if a Customer loses every administrator's vault passphrase and passkeys and its recovery code. In that case the information may be permanently unreadable.
- Retention: Customers decide how long Secure Vault information is kept and can delete it at any time. Retention is otherwise handled as described in Section 7.
The Customer is the data controller for Secure Vault information. If an authorized staff member copies or exports a revealed value outside Attend, it is no longer protected by the Secure Vault. To access, correct, or delete identity document information you provided for an event, contact the organization that requested it.
6. International Data Transfers
We are based in the United States, and we and our service providers process information in the United States and other countries, which may not have the same data protection laws as your country of residence.
When we transfer personal information that we control from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss adaptations where relevant) or, where the recipient is certified, on the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework. For example, our analytics provider, PostHog, is certified under these frameworks and has also agreed to the Standard Contractual Clauses with us. You can ask us for more information about these safeguards at legal@attend.vip.
When we process information on behalf of a Customer, transfers are governed by our Data Processing Addendum with that Customer.
7. Data Retention
We keep personal information only for as long as we need it for the purposes described in this Privacy Policy, unless the law requires us to keep it longer. In particular:
- Attend account information: For as long as your account exists. When you delete your account, we erase your sign-in credentials and sessions, anonymize the account, and delete the usage information linked to it. Single-use sign-in codes expire within hours.
- Usage and analytics information: Up to 12 months from collection.
- Website session recordings: Up to 30 days from collection.
- Billing and transaction records: For as long as tax and accounting laws require, generally seven years.
- Communications and support requests: Up to three years after our last interaction with you.
- Marketing contacts: Until you unsubscribe or ask us to delete your information, or after three years without any interaction.
- Security and audit logs: For as long as reasonably needed to keep the Services secure and meet our legal obligations.
- Information we process for Customers: For as long as the Customer decides, and as described in our Data Processing Addendum after the Customer's agreement with us ends.
8. Children's Privacy
Our Services are not intended for individuals under the age of 16. We do not knowingly collect Personal Information from children under 16. If we become aware of such collection, we will take steps to delete the information promptly.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date and posting the new policy on our website. Your continued use of the Services after such changes constitutes your acceptance of the new Privacy Policy.
10. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
- Address: Kardoe Incorporated, 55 Water Street, Floor 3, Brooklyn, NY 11201
- Email: legal@attend.vip
- Phone: +1 646 846 4484
11. California Privacy Rights
If you are a California resident, you have specific rights regarding your Personal Information under the California Consumer Privacy Act ("CCPA").
11.1 Your Rights
- Right to Know: Request information about the categories and specific pieces of Personal Information we have collected about you.
- Right to Delete: Request deletion of your Personal Information.
- Right to Correct: Request that we correct inaccurate Personal Information.
- Right to Opt Out of Sale or Sharing: Opt out of the "sharing" of your Personal Information for cross-context behavioral advertising (see Section 11.4).
- Right to Non-Discrimination: Exercise your rights without discrimination.
11.2 Exercising Your Rights
To exercise your rights, please contact us at legal@attend.vip. We may need to verify your identity before processing your request.
11.3 Information We Collect
We collect the following categories of Personal Information:
- Identifiers: Name, contact details, IP address.
- Commercial Information: Records of transactions.
- Internet Activity: Browsing history, interactions with our Services, analytics data and session recordings collected through PostHog, and, unless you opt out, website activity collected through the Meta Pixel.
- Professional Information: Job title, employer.
11.4 Your Privacy Choices (Do Not Sell or Share)
We do not sell your Personal Information for money. Unless you opt out, Meta receives information about your visit to our website through the Meta Pixel, which may be considered "sharing" for cross-context behavioral advertising under California law. You can opt out at any time by selecting "Your privacy choices" at the bottom of our website and choosing "Decline". We also treat a Global Privacy Control signal from your browser as a valid request to opt out of sale and sharing. Opting out on our website applies to that browser; to opt out across devices, or if you have questions, contact us at legal@attend.vip.
12. Additional U.S. State Privacy Rights
Residents of certain U.S. states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, have rights over their personal data under their state's privacy law. We extend the rights below to all U.S. residents, whether or not their state's law applies to us.
12.1 Your Rights
- Access and portability: Confirm whether we process your personal data, and get a copy of it in a portable format.
- Correction: Correct inaccurate personal data.
- Deletion: Delete personal data you provided to us or that we obtained about you.
- Opt out of targeted advertising and sale: We do not sell personal data for money. Unless you opt out, the Meta Pixel on our website shares information about your visit with Meta for advertising, which some state laws treat as targeted advertising. You can opt out as described in Section 11.4.
- Opt out of profiling: We do not use personal data for profiling that produces legal or similarly significant effects.
12.2 Universal Opt-Out Signals
We treat a Global Privacy Control signal from your browser as a valid request to opt out of targeted advertising and the sale or sharing of your personal data on our website.
12.3 Sensitive Data
Some information processed through our Services, such as dietary, allergy, and accessibility needs, or passport and identity numbers, may be sensitive data. Who is responsible for it depends on where it is kept:
- Event data: When you answer an organizer's form (for example, "Any dietary requirements?"), your answer belongs to that event. The organizer is the controller and decides how it is used. We process it on the organizer's behalf, only to provide the Services the organizer requested. Requests about this data are best directed to the organizer, as described in Section 4.2.
- Your device profile: You can choose to save some of these answers on your own device so they are filled in for you at future events. This is off by default and you choose it for each answer. The saved answers are stored only in your device's secure storage; we do not keep a copy on our servers, so we cannot read them and an organizer cannot see them unless you share an answer with that organizer's event. You can change or delete what is saved at any time in the app, and it is removed from the device when you sign out or delete your account. Answers you already shared with an event stay with that event's organizer.
- Secure Vault: Passport, national ID, visa, and driver's license numbers stored in the Secure Vault are encrypted on your device and we cannot read them, as described in Section 5.2.
We process sensitive data only to provide the Services you or the event organizer requested. We do not sell it or use it for targeted advertising.
12.4 Exercising Your Rights
To make a request, contact us at legal@attend.vip. We may need to verify your identity, and you may use an authorized agent where your state's law allows. We will respond within 45 days, which we may extend by a further 45 days where reasonably necessary, and we will tell you if we do. If you attended an event organized by one of our Customers, your request about event data may be best handled by that organizer, as described in Section 4.2; we will help route it.
12.5 Appeals
If we decline to take action on your request, you can appeal by replying to our decision or emailing legal@attend.vip with the subject line "Privacy Request Appeal". We will respond to your appeal within the time your state's law requires, usually 45 or 60 days, and explain our decision in writing. If we deny your appeal, you may contact your state's Attorney General.
13. Additional Information for People in the EEA, UK, and Switzerland
13.1 Who is responsible for your information
Kardoe Incorporated, 55 Water Street, Floor 3, Brooklyn, NY 11201, United States, is the controller of the personal information described in this Privacy Policy, including your Attend account, usage and analytics information, website information, and communications with us. For information about an event, such as a guest list, registration, or form responses, the organization running the event is the controller and we process it on its behalf, as described in Section 2.3.
13.2 Our legal bases
- Performance of a contract: To create and operate your account, sign you in, provide the Services to Customers and their users, and manage billing.
- Legitimate interests: To keep the Services and our users secure and prevent fraud and abuse; to understand how our apps are used so we can operate, fix, and improve them; to respond to inquiries; to market our Services to business contacts; and to establish, exercise, or defend legal claims. We have balanced these interests against your rights, and you can object to this processing at any time.
- Consent: For analytics and advertising cookies, session recordings, and the Meta Pixel on our website; for push notifications and SMS messages; and for marketing emails where the law requires consent. You can withdraw consent at any time, without affecting processing that happened before.
- Legal obligation: To keep tax and accounting records and to respond to lawful requests from authorities.
13.3 Your rights
You have the right to access your personal information, correct it, delete it, restrict or object to its processing (including processing based on our legitimate interests and direct marketing), receive it in a portable format, and withdraw any consent you have given. To exercise these rights, contact us at legal@attend.vip. We will respond within one month, and we may need to verify your identity first. For information about an event, contact the organization running it; we will help it respond.
13.4 Complaints
If you have concerns about how we handle your personal information, please contact us first. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed. In the UK, this is the Information Commissioner's Office, and in Switzerland, the Federal Data Protection and Information Commissioner.
13.5 International transfers
See Section 6 for how we protect personal information transferred outside the EEA, UK, and Switzerland.