Privacy Policy

Optional X connection

Connecting X requests profile/post access, posting, photo uploads, reading and sending direct messages, and offline renewal (users.read, tweet.read, tweet.write, media.write, dm.read, dm.write, offline.access). DM permission includes private conversations. Access and refresh tokens are encrypted and private to you in the selected workspace. Refresh tokens renew short-lived access without repeated sign-in; revoked or failed grants require reconnection. Manual post/photo publishing requires an explicit preview and Publish action. Text-only DMs require their own exact preview and explicit Send action. Replies and general paid reads remain blocked. An explicitly selected Person may use the separately budgeted exact-username lookup. We do not fetch your profile, posts, replies or inbox, buy credits or enable automatic recharge. Drafts remain private in EventMatch until an explicit Publish action; only explicitly selected same-user event photos are attached to a draft. Publishing sends only reviewed text and selected photos to X and stores an encrypted publication identifier. Unknown outcomes are not automatically retried. Authorization is not verified account identity and never identifies People. Disconnecting erases local credentials and cancels pending attempts; revoke remote access separately in X’s connected-app settings.

Where permitted by our approved X use case, EventMatch reuses encrypted, verified public numeric X account IDs across authorized users through its internal shared identity index. Saved IDs have no timed cache expiry; handles and verification dates are historical observations, not live identity or inbox checks. Changed or conflicting profiles require review. Your tokens, drafts, message receipts and sender-specific results are not shared. Message-status filters show only your own saved attempts for the selected workspace and X connection. Applicable correction and removal requirements still apply.

Optional LinkedIn connection

If you choose Connect LinkedIn, EventMatch requests your basic LinkedIn profile and permission to publish on your behalf. It stores your account identifier, display name, and access token encrypted, together with the authorization expiry and consent record. This connection belongs only to you in the selected workspace; it is not shared with other members or used to identify People in an attendee directory. We do not request your email, connections list, or private messages.

Connecting alone does not publish anything. From an event’s My work → Follow-up page, you may write a post and select up to four of your own event photos. Only after you review the exact text, selected photos, connected account and audience and choose Publish does EventMatch send that content to LinkedIn. Photos use the existing normalized, metadata-stripped images. Private notes, transcripts, audio and unselected photos are not included. EventMatch does not send invitations or private messages.

You can disconnect in Settings to remove the stored LinkedIn credentials and account details, cancel pending authorization attempts and stop queued posts. It cannot recall a post already being sent or delete posts already on LinkedIn. Private draft text and provider receipts are encrypted and retained with your event until the event, your user or the workspace is deleted. Removing a photo prevents new uploads of that photo but cannot recall a copy already sent to LinkedIn. You can also revoke the application in LinkedIn's permitted services settings. Expired or revoked access requires authorization again; EventMatch does not assume access can be refreshed automatically.

What EventMatch processes

EventMatch processes professional-event information you authorize, including event schedules and visible attendee-directory information. If you use EventMatch Camera, EventMatch also processes the photos you choose to capture or upload, their capture time, requested camera direction, and conservative event-assignment status. If you record audio in the EventMatch iPhone app, Event Mode retains private audio parts and encrypted transcript segments linked to the selected event. You may also explicitly import one audio file and select its event. Imported recordings remain private to you; importing does not start transcription or AI report processing.

Event Mode recording is started and stopped explicitly in the iPhone app. The ChatGPT companion cannot start, stop, or access its live microphone. EventMatch no longer connects to Omi or accepts its realtime callbacks. The retirement release deletes historical Omi imports and derived records from the active database.

Camera uploads are decoded only as JPEG, PNG, WebP, or HEIC, resized to bounded dimensions, and re-encoded as JPEG. Original EXIF and other source metadata are not retained. Ordinary capture, event assignment, Photo AI, and MCP do not use face recognition. EventMatch does not infer sensitive traits from photos.

Photo AI Review is disabled until you explicitly enable it. When enabled, supported iPhones analyze visible text, QR URLs, badge-like rectangles, and face regions locally, and EventMatch sends each normalized private photo to its configured multimodal AI for a separate badge reading. EventMatch encrypts the device, server, and reconciled observations. Face regions are used only to support manual review: faces are never identified or compared with profile photos. Suggested People and badge details require your confirmation.

Optional biometric face matching is unavailable by default and requires separate organization approval from an owner or administrator and separate consent from the current user. Earlier face-matching permission and Photo AI Review permission do not apply. When the deployment, organization, and user controls are active, EventMatch sends approved photos of visible attendees from your organization and selected event to Amazon Rekognition. EventMatch creates encrypted face-reference data that stays separated by organization and event. Amazon Web Services acts as a subprocessor. After you grant the separate consent, automatic review is enabled by default as a distinct setting for at most 10 new photos per event and only when fewer than 500 active visible attendees are present. You may turn that setting off without withdrawing consent. Later photos, larger events, and older photos require an explicit action. Your private photo is analyzed only for the requested comparison and is never stored as an attendee reference. Encrypted EventMatch records connect provider-generated face identifiers to existing People. Face references are removed when approval ends, the source photo changes, the related Person or event is deleted, organization approval is withdrawn, or the event retention period expires. Processing older photos requires another explicit event-scoped request. Results are review candidates only: insufficient confidence returns no match, multiple candidates always require review, and every photo-to-Person link requires your explicit confirmation. The feature does not create or merge People, change identity records, or infer demographics, emotion, health, ethnicity, religion, or any other protected or sensitive attribute.

Why the data is used

The data is used to help you remember professional-event conversations, deterministically match people in conversations to the authorized attendee directory, review commitments, and prepare follow-up drafts. EventMatch never sends those drafts automatically. Uploaded audio file dates are retained as file metadata, not proof of recording time or event attendance. You select the event yourself. Name alone is never treated as a confirmed identity match.

Exa Deep Research

When Deep Research is enabled and you explicitly request it for one person, EventMatch sends Exa only a directly provided public professional profile URL or the person's exact name and company. Exa acts as a subprocessor for that request. EventMatch does not send the event name, ICP, private notes, private audio, photos, provider payloads, hidden contact information, or information about other people. EventMatch stores only normalized professional facts and their public citations, not the raw Exa response or full search query.

The integration remains disabled until EventMatch has reviewed the applicable Exa data-processing terms, retention configuration, and subprocessor requirements. Deep Research never contacts a person or searches for hidden email addresses or phone numbers.

OpenAI processing

When you explicitly request transcription or an event report, EventMatch sends the selected private audio file, or bounded audio chunks prepared from it, to OpenAI to create text. EventMatch may also send bounded transcript text and allowlisted event context to OpenAI to extract speaker-labeled event sections, structured professional topics, identities supported by direct transcript evidence, and explicit commitments or actions. OpenAI is a subprocesser for these features. AI does not perform voice biometrics, infer sensitive traits, change deterministic identity confidence, or receive hidden contact information. If OpenAI is unavailable, completed results remain available for review.

If you connect the EventMatch plugin to ChatGPT or Codex, OpenAI can request only the organization-scoped EventMatch records covered by the read scopes you approve. The plugin may return professional-event details, authorized visible attendee records, event-match scores and evidence, attendee-provided professional profile URLs, existing unsent outreach drafts, prospecting plans, safe job status, and technical record identifiers needed to continue a requested lookup. It does not return private transcripts, photos, hidden contact information, provider payloads, or credentials. Information returned to ChatGPT is then processed under the terms and privacy choices of your OpenAI account.

When ChatGPT successfully completes a new OAuth connection to the published EventMatch MCP, EventMatch retains the first confirmed time and the associated EventMatch user, organization, and OAuth client for private connection counts and duplicate prevention. This is not a count of plugin installations. Private operations receive a notification without the user's email or organization name. OAuth codes and tokens are not included in this connection history or notification.

After one-time read and private-write approval when connecting, the EventMatch companion may start or end your Event Mode, import photos you deliberately attach or select, record your confirmed encounter notes, and save explicitly scanned LinkedIn connections. If you enable photo saving for an event in a conversation, subsequent supplied event photos may be imported even when you ask for an explanation; an explicit instruction not to save an image overrides that behavior. It cannot observe other chats or monitor your camera roll.

Photo imports may retain your supplied explanation and a separately labeled, unverified ChatGPT interpretation, encrypted and private to you. Temporary download capabilities expire within one hour and are erased after processing or by maintenance. The companion returns import outcomes, photo identifiers and authenticated application links, not downloadable photo bytes, raw audio or transcripts. It cannot start or stop recording on the iPhone. Existing read-only connections are not upgraded without fresh personal authorization.

If an organization owner or administrator connects the private EventMatch app, the same connection can read the approved information above and request EventMatch to start Luma event synchronization, attendee-directory synchronization, or analysis jobs after confirmation. EventMatch records the requesting user, target record, and safe job identifier for audit purposes. The app cannot send outreach, register for events, expose browser controls, or access the excluded data above.

Luma connection choices

When the internal Luma Session Companion canary is available, you may explicitly transfer your existing Chrome Luma session instead of signing in inside the EventMatch browser. The extension reads only bounded first-party luma.com cookies and exact-origin local storage after your separate confirmation, encrypts the data locally, and sends only the encrypted envelope to EventMatch. EventMatch decrypts it only for the in-memory import into a new organization-isolated browser profile and verifies that the session persists after restart before replacing an existing profile.

Failed candidates and temporary keys, capabilities, and envelopes are cleared. The promoted server-browser profile remains credential-equivalent private account data until you disconnect or replace the Luma connection. EventMatch never asks the extension for your password, history, clipboard, another origin, IndexedDB, or hidden account information.

Cookies and product analytics

EventMatch uses essential session and CSRF cookies to keep sign-in and authenticated requests secure. It also stores safe browser preferences, including theme and cookie choices, on your device. Essential storage cannot be disabled through the preference center because the product cannot operate securely without it.

With your permission, EventMatch uses Google Analytics 4 to understand aggregate product usage, such as page categories, device and browser types, approximate region, and referral source. Analytics does not load until you choose to allow it on this browser.

EventMatch does not send Google Analytics attendee names, people names, event-match scores, transcripts, photos, search parameters, invitation or reset tokens, or internal record identifiers. Dynamic page addresses are reduced to generic route categories. Advertising signals and ad personalization are disabled.

See the Cookie Policy for the current categories and controls.

Retention, disconnect, and deletion

Omi imports are no longer collected. The retirement release deletes prior imports, derived data, local connection credentials, and related jobs from the active database. Existing backups follow the separate backup-retention schedule. Revoke any remaining authorization in Omi separately; EventMatch cannot revoke it remotely.

Captured photos are retained until you delete the photo or your user or organization is deleted. Deletion removes the normalized image and thumbnail, encrypted Photo AI observations, review suggestions, and encounter-draft photo link. Disabling Photo AI Review stops future external photo analysis but does not delete completed results; delete the corresponding photo to remove them.

EventMatch does not retain face templates or embeddings. Encrypted biometric run candidates and evidence expire within 30 days. Withdrawing biometric consent or deleting the photo, user membership, user, or organization will delete associated unconfirmed biometric artifacts. Biometric reference images and URLs, scores, candidates, evidence, and results are excluded from logs, analytics, notifications, MCP, Django Admin, audit metadata, and background-job payloads or results. A photo-to-Person tag you explicitly confirmed is an ordinary private tag and remains until you remove it or delete the photo.

Event Mode and previously uploaded audio are retained until you delete the recording or your user or organization is deleted. A transcript, speaker segments, and event report created from uploaded audio are encrypted and retained with that recording until the same deletion. Deletion removes the private audio object, transcript, derived report, and event suggestions. Recording, assignment, and transcription are separate actions. Event Mode audio capture starts only after an explicit action in the EventMatch iPhone app.

You can revoke a ChatGPT or Codex connection in Settings. Revocation invalidates its EventMatch access and refresh tokens immediately, but it does not delete content already present in your OpenAI conversations. Delete that content through the applicable OpenAI product controls.

Revoking a public ChatGPT connection does not erase its first-connection history, so a reconnect is not counted twice. This minimal history is deleted when the associated EventMatch user, organization, or OAuth client is deleted. Operational notification records expire after 30 days.

Access and security

Transcript-dependent records belong to the EventMatch user who imported them and are not visible to other members of the same organization. Business records are organization-scoped, and cross-organization access is rejected without revealing whether the record exists. EventMatch uses session authentication, CSRF protection, encrypted secret storage, rate limits, bounded payloads, and redacted operational logs.

In EventMatch, captured photos are visible only to the user who captured them, even when other users belong to the same organization. Photo files are delivered through authenticated, non-cacheable responses.

Uploaded audio files are visible only to the user who imported them, even when other users belong to the same organization. Playback uses the same authenticated, non-cacheable delivery boundary.

Recording consent and contact

You are responsible for giving notices and obtaining any consent required before recording or processing a conversation. Laws differ by location and the people involved.

Questions or deletion requests can be sent to info@eventmatch.ai.