Privacy Policy.

This Privacy Policy explains how Conference Hero (“Conference Hero,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you visit https://conferencehero.ai and use our platform, including the Conference Hero iOS app (collectively, the “Service”). Please read it carefully. By using the Service, you agree to the practices described below.

1. Information We Collect

a) Information you provide directly

• Newsletter. When you subscribe to our newsletter, we collect your email address. We use this solely to send you product updates, conference marketing tips, and industry insights. Customer account users get the newsletter too unless they turn it off in Profile, Email Notifications. For each newsletter we record whether it was delivered and opened and which links you clicked, so we can see what's useful.
• Account registration. When you create an account, we collect your email address and password, as well as additional information such as your name and company (passwords are stored as a hashed credential via Supabase Authentication).
• User-generated content. Conference Hero is a B2B work tool. Any conference data, lead records, tasks, budget items, or notes you enter into the platform are stored on your behalf and are treated as your data.

b) Information collected automatically

• Usage & analytics data. We use Google Analytics 4 (GA4) to understand how visitors interact with our website. GA4 collects information such as pages visited, time on site, referral source, device type, browser, and approximate geographic location (derived from IP address). Google may use this data in accordance with Google’s Privacy Policy. We have enabled IP anonymization in our GA4 configuration.
• Vercel Analytics & Speed Insights. Our hosting provider, Vercel, collects anonymized page view data and Core Web Vitals performance metrics. Vercel does not use cookies for these measurements and does not track individual users across sites. See Vercel’s Privacy Policy.
• Server logs. Our hosting provider Vercel automatically records standard server log data including IP address, browser type, operating system, referring URL, and timestamps. Log retention is managed by Vercel per their standard retention policy. See Vercel’s Privacy Policy.
• Cookies. See Section 5 below.
• iOS app. See Section 10 for what the app collects, including usage events and error reports.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Send transactional emails (account setup, password reset, billing receipts)
• Send product updates and marketing communications to newsletter subscribers (you can unsubscribe at any time via the link in each email)
• Analyze aggregate usage patterns to prioritize features
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable laws and legal process

We do not use your data to train AI or machine learning models, nor do we sell, rent, or trade your personal information to third parties for their own marketing purposes.

3. How We Share Your Information

We share data only with the service providers necessary to operate the Service, and only to the extent needed:

We may also disclose your information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect the rights, property, or safety of Conference Hero, our users, or the public.

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data becomes subject to a different privacy policy.

4. Data Retention

• Newsletter emails are retained until you unsubscribe or request deletion. After you unsubscribe we keep your address on a do-not-send list so you don't get the newsletter again.
• Account data is retained for the life of your account plus 30 days after deletion, to allow for recovery. After that window, it is permanently deleted.
• Server logs are retained per Vercel’s standard retention policy.
• Analytics data in GA4 is retained for 14 months (Google’s default minimum). Vercel Analytics data is retained per Vercel’s standard retention schedule.

5. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies. These are required for the Service to function (e.g., your authentication session cookie). They cannot be disabled without breaking the product.
• Analytics cookies. Google Analytics 4 uses first-party cookies (prefixed _ga) to distinguish users and sessions. These cookies persist for up to 2 years. You can opt out of GA4 tracking by installing the Google Analytics Opt-Out Browser Add-On.

Most browsers allow you to refuse or delete cookies. Doing so may affect some features of the Service but will not prevent you from using it.

6. Your Privacy Rights

All users

Regardless of where you live, you have the right to:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate data.
• Deletion. Request that we delete your personal data. We will honor deletion requests within 30 days, subject to legal retention obligations.
• Opt out of marketing. Use the unsubscribe link in any marketing email, or contact us at privacy [at] conferencehero.ai.

California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know. You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete. You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct. You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing. We do not sell or share your personal information with third parties for cross-context behavioral advertising. No opt-out is required.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.

To exercise your California rights, contact us at privacy [at] conferencehero.ai. We will verify your identity before processing requests and respond within 45 days (extendable by an additional 45 days with notice).

Other US state laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing. Contact us at privacy [at] conferencehero.ai to exercise these rights. We will respond consistent with the requirements of applicable state law.

7. HubSpot Integration

Conference Hero offers an optional integration with HubSpot CRM. If you connect your HubSpot account, lead data you enter into Conference Hero may be synced to your HubSpot instance. This data transfer occurs at your direction and under your control. The leads in Conference Hero belong to you; we do not access or use them for our own purposes. HubSpot’s use of that data is governed by HubSpot’s Privacy Policy.

8. Slack Integration

Conference Hero offers an optional integration with Slack. If you connect your Slack workspace, Conference Hero sends notifications (e.g., new leads, task updates, support alerts) to channels you designate. This data transfer occurs at your direction and under your control. We access only the Slack scopes required to post messages and list channels; we do not read your Slack message history. Slack’s use of that data is governed by Slack’s Privacy Policy.

9. Google and Microsoft Integrations (Email & Calendar)

Conference Hero offers optional integrations with Gmail and Google Calendar. Each user decides whether to connect their own Google account. We request only the permissions the feature they turn on needs, and we use information received from Google only to provide those features to that user and their workspace.

What we access and why

• Gmail (optional). We send the lead emails you write or approve (one-to-one emails, follow-ups, and campaign steps) from your Gmail address, so they appear in your Sent folder and replies come back to your inbox. We also read your Google account email address to show which mailbox is connected. Our Gmail access is send-only: we do not read, search, or store the messages in your mailbox.
• Google Calendar, personal calendar (optional). We read your free/busy times so your booking link and the meeting picker only offer open slots. We don’t read the details of your other events. We create, update, and cancel the meetings you schedule with leads, or that leads book through your booking link, on your calendar, which sends the invite to the lead. For those meetings only, we read the guest list, including each guest’s reply (accepted, declined, or maybe), so your team can see who has the invite and who is coming.
• Google Calendar, workspace calendar (optional, admins only). We create one separate Conference Hero calendar in the connecting admin’s Google account and keep the team’s meetings, booth shifts, and conference sessions in sync on it. This permission cannot see the admin’s other calendars or events.

How we store, use, and share it

• Google access tokens are encrypted before we store them.
• We store only what these features need: your connected Google email address, the IDs of the emails and calendar events we create, and each lead’s reply to the meeting invites we sent for you. It is stored with your workspace data and kept as described in Section 4.
• We do not sell Google user data, use it for advertising, or use it to develop, improve, or train AI or machine learning models, ours or anyone else’s. Our team does not read it unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.

Your controls

You can disconnect Gmail or Google Calendar at any time under Integrations in your dashboard. We then stop using that connection, delete the access tokens we stored for it, and ask Google to revoke Conference Hero’s access. The same happens to your Gmail and personal calendar connections when a workspace admin deactivates your account. If another of your Conference Hero connections still uses the same Google account (for example, Gmail and Google Calendar together), we skip the revoke step so that connection keeps working. You can remove Conference Hero’s access yourself at any time from your Google Account permissions page. To have us delete information we stored from these integrations, contact us at privacy [at] conferencehero.ai.

Conference Hero's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Outlook and Microsoft 365 (optional)

The same features are available for Microsoft accounts, through Microsoft Graph. Each user decides whether to connect their own Microsoft account, and we use what we receive only to provide these features to that user and their workspace.

• Outlook email. We send the lead emails you write or approve from your Outlook address (permission: send mail as you), so they appear in your Sent Items and replies come back to your inbox. We read your account email address to show which mailbox is connected. We do not read, search, or store the messages in your mailbox.
• Outlook calendar, personal calendar. We read the start and end times and free/busy status of events on your calendar so your booking link and the meeting picker only offer open slots. We create, update, and cancel the meetings you schedule with leads, or that leads book through your booking link, which sends the invite to the lead. For those meetings only, we read the guest list, including each guest’s reply. Microsoft’s calendar permission (read and write your calendars) is broader than what we use: we don’t read the titles, notes, or guests of your other events.
• Outlook calendar, workspace calendar (admins only). We create one separate Conference Hero calendar in the connecting admin’s Microsoft account and keep the team’s meetings, booth shifts, and conference sessions in sync on it. We read your calendar names only to find that calendar again, and write only to it.

Microsoft access tokens are encrypted before we store them. We store only your connected email address, the IDs of the calendar events we create, and each lead’s reply to the invites we sent for you. We do not sell this data, use it for advertising, or use it to train AI models. When you disconnect (or an admin deactivates your account) we stop using the connection and delete the stored tokens. You can also remove Conference Hero’s access from your Microsoft account (work or school accounts: My Apps, or ask your IT admin).

10. Conference Hero iOS App

The Conference Hero iOS app is for members of a Conference Hero workspace to capture leads, take notes, and keep track of their schedule at events. It uses the same account and workspace as the web app, and the rest of this policy applies to it too. This section covers what is specific to the app.

Account data

You sign in with your existing Conference Hero account; you can’t create an account in the app. The app uses your email address and password to sign you in, and shows your name and email address so you know which account is signed in.

Content you create

What you add in the app is stored with your workspace, on your behalf, like everything else in Conference Hero (see Section 1), and kept as described in Section 4.

• Leads. The leads you capture, including the contact details of the people you meet, such as their name, company, job title, email address, and phone number, and anything you note about them.
• Notes, comments, and photos. Your conference notes, the comments you add to leads, and the photos you attach to notes.
• Voice recordings. When you record a voice note, a comment, or a lead by voice, the recording is sent to our servers, and our transcription provider, Deepgram, turns it into text. We don’t store the recording, and Deepgram keeps it only as long as it takes to transcribe it. The text is kept as part of the note, comment, or lead you recorded it for. When you capture a lead by voice, the text also goes to Anthropic, which picks out the lead’s details for you to check.
• Business card photos. When you scan a business card, the photo is sent to Anthropic to read the contact details, and it is saved with the lead you create from it.

Usage events and error reports

The app records events about how it is used, such as app opens, screens viewed, and actions taken (for example, saving a lead or creating a meeting), with the app version and the time. When something goes wrong, it sends an error report with the part of the app that failed and the error code and message. Error reports don’t include lead details. Both are stored with your account and workspace, and we use them to see which features get used, find problems, and improve the app.

Data stored on your device

So you can keep working without a connection, the app saves leads, notes, photos, and recordings on your phone until they can be sent, then deletes them from the phone. It also keeps your sign-in session in the iOS Keychain. When you sign out, the app deletes all of this from your phone. If the app signs you out on its own, for example when your session has expired, it keeps anything not yet sent so you don’t lose it, and sends it after you sign back in. If someone else signs in on that phone instead, those items are deleted first. Face ID sign-in, below, is the one exception.

Face ID

You can turn on Face ID (or Touch ID) sign-in in the app’s Profile tab. iOS checks your face or fingerprint on the phone and only tells the app whether the check passed, so we never receive biometric data. To sign you in this way, the app saves your email address and password in the iOS Keychain, where iOS releases them only after a successful check. They stay on your phone until you turn Face ID sign-in off, even if you sign out.

No third-party tracking or advertising

The app has no ads and no third-party analytics, tracking, or crash-reporting tools. Usage events and error reports go only to Conference Hero. The app doesn’t use your location or Apple’s advertising identifier, and we don’t track you across other companies’ apps or websites.

11. Children’s Privacy

The Service is intended for business professionals and is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe we have inadvertently collected such information, please contact us at privacy [at] conferencehero.ai and we will delete it promptly.

12. Data Security

We implement industry-standard safeguards including encrypted data transmission (TLS), encrypted storage, access controls, and regular security reviews. Our database infrastructure is hosted on Supabase, which maintains SOC 2 compliance. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

13. International Users

Conference Hero is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer.

This policy is written to comply with US law. If you are in the European Economic Area (EEA), United Kingdom, or another jurisdiction with separate data protection requirements (such as GDPR), additional terms may apply. Please contact us to discuss your specific situation.

14. Links to Third-Party Sites

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will provide a more prominent notice (such as an email to registered users or a banner on the website) at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how we handle your data, please contact us:

We aim to respond to all privacy inquiries within 5 business days.