Privacy Policy

Last updated · 18 July 2026

1. Who we are

EventPilot is operated by EventPilot. This policy explains what personal data we collect, why, and the choices you have. It covers our marketing website and the EventPilot application. For attendee data collected through an organizer's registration forms, the organizer is the data controller and we act as their processor.

2. Data we collect

• Account data — name, work email, organization name, and role, when you create or are invited to an account.
• Attendee data — details submitted on registration forms (typically name, email, phone, and fields the organizer configures), check-in timestamps, and QR scan events.
• Billing data — plan, billing cycle, invoices, and payment status. Card and banking details are collected directly by our payment gateway and never stored on our servers.
• Usage data — server logs, device/browser information, and audit trails of administrative actions, used for security and troubleshooting.
• First-party analytics — we operate a self-hosted analytics system (not Google Analytics). For guests and signed-in users we may collect: page URL and title, referrer, UTM parameters, IP address, selected HTTP headers (for example User-Agent, Accept-Language, and CDN edge headers such as country or forwarding chain when present), approximate device/browser/OS, screen size, language, timezone, connection type, session identifiers, engagement time, scroll depth, and conversion goals (for example signup, registration, checkout, subscription, and CTA clicks). When the browser grants permission we may also store latitude, longitude, and location accuracy. Optional MaxMind GeoLite lookups may enrich country/city from IP when configured. First-party cookies identify returning browsers and short-lived sessions. When analytics consent is required on the marketing site, tracking waits until you Accept; choosing Essential only skips analytics. Super Admins use this data inside the product Insights console to understand product usage, funnels, and security-relevant traffic.
• Contact messages — what you send us through the contact form or by email.

3. How we use data

• To operate the Service: registrations, QR badge email delivery, check-in scanning, reports, and audit logs.
• To bill subscriptions and prevent fraud, via our payment gateway.
• To secure the platform: tenant isolation, access control, and audit logging of administrative actions.
• To respond to support and sales enquiries.
• To send service notices (renewals, incidents, material changes). Marketing email is sent only with consent and always has an unsubscribe.

We do not sell personal data, and we do not use attendee data for advertising.

4. Sharing

We share data only with service providers needed to run the platform — hosting, email delivery, and payment processing — under contracts limiting their use of it, and with authorities where the law requires. Attendee data is visible to the organizer whose event it belongs to; other tenants can never access it.

5. Retention

Account and event data is retained while your subscription is active. After termination you may request an export within 30 days, after which data is scheduled for deletion. Audit logs and invoices are kept as long as tax and security obligations require.

6. Security

Data is encrypted in transit, tenant data is logically isolated per organization, administrative actions are audit-logged, and access is role-restricted. No system is perfectly secure; we notify affected organizers of any breach as required by law.

7. Your rights

You may request access, correction, export, or deletion of your personal data by writing to hello@eventspilot.in. Attendees should direct requests to their event organizer first; we assist organizers in fulfilling them.

8. Cookies

The application uses strictly necessary cookies for sign-in sessions and CSRF protection. The marketing site stores a billing-cycle preference in your browser's local storage. We also set first-party analytics cookies (by default eventpilot_vid visitor, eventpilot_sid session, and optionally eventpilot_analytics consent) so we can measure visits, sessions, and conversion goals. We do not use third-party advertising cookies or sell analytics data.

9. Analytics retention

Analytics pageviews and conversion events are retained for a limited period (by default 90 days, configurable by operators) and then deleted. Super Admins may purge a visitor's analytics records on request. Platform audit logs and invoices may be kept longer where tax or security obligations require.

10. Changes and contact

We will post updates to this policy here and notify account owners of material changes. Contact for privacy matters: hello@eventspilot.in.