The Event Register — Privacy Policy
Effective date: November 2, 2026. These terms were approved for publication on October 31, 2026 and will be reviewed by qualified New York legal counsel. See the legal-review provision herein.
Operator: The Event Register. Contact: admin@the-event-register.com
1. What we collect
- Account data: name, email address, email-verification status, and profile information you provide (professional description, headline, location, portfolio links).
- Organization data: organization name, type, website (optional), contact details, team membership and roles.
- Listings: opportunity details you publish, including budgets or confidential-budget designations, and your role or title when posting for an organization.
- Applications: your answers, credentials, availability, portfolio links, and files you attach (PDF/images, up to 10 MB). [Launch note: file attachments are temporarily unavailable at launch while malware scanning is finalized — see Section 5.]
- Messages: questions and conversations tied to opportunities or applications, including misconduct reports.
- Feedback you send us: messages submitted through the platform feedback form, including the page you were on. If you agree to be contacted, your account is linked to the feedback; otherwise it is stored without your account attached.
- Payment metadata: subscription tier, status, and transaction references via Stripe. We never see or store your card number — Stripe handles all payment credentials.
- Operational records: audit logs of listing status changes and review decisions (reviewer, decision, timestamps), security logs, notification delivery records, and subscription-event records.
2. Usage analytics — what we actually collect
To understand how the marketplace is used and inform improvements, we record anonymous usage events: the type of event (page view, feature used, or friction encountered), which feature was involved, which side of the marketplace it relates to (visitor, poster, applicant, or both), and when it occurred.
These events contain no account identifiers, no IP addresses, no device identifiers, and no user-agent strings. They cannot be linked back to you. They are stored in our own database (not sent to any external analytics provider) and are readable only by platform administrators in aggregated form.
The Event Register may update its analytics practices as the platform develops, including the types of usage information collected and the technologies used to understand and improve the marketplace. We will update this Privacy Policy to describe material changes before implementing them and provide additional notice or obtain consent where required by applicable law. Any future collection of identifiable information or use of third-party analytics services will be disclosed accurately and will not be represented as anonymous.
3. How we use your information
To operate the marketplace: publish listings, route applications, deliver messages and notifications, process subscriptions and featured placements, confirm email ownership, review listings for compliance, moderate content, prevent fraud, handle deletion requests, and meet legal obligations. We do not sell your personal data.
4. Confidential budgets — how they are protected
Internal budget values for confidential-budget (BAQA) listings are stored separately and are visible only to authorized administrators. They are never exposed through public pages, search results, notifications, or client-side code. Qualified applicants receive a disclosure only through the platform's staged process, and each disclosure is logged. If access is withdrawn, revoked, or the listing closes, further access stops.
5. Attachments
Files you attach to applications are uploaded to private storage and held in quarantine until they pass a malware scan. Files that have not passed scanning cannot be downloaded by anyone — not by posters, not by other applicants, and not through shared links. Downloads of cleared files use short-lived signed links that expire after 60 seconds.
Files that fail scanning or cannot be scanned remain quarantined and inaccessible. If your file cannot be processed, we will tell you plainly and you may re-upload or contact admin@the-event-register.com.
[Launch note: attachment uploads are temporarily unavailable at launch while malware scanning is finalized. This section describes the system as it will operate once scanning is verified; no scanning claim is published until then.]
6. Who processes your data
- Supabase (PostgreSQL database, authentication, file storage) — US East region.
- Vercel (application hosting).
- Stripe (subscription and featured-placement payments).
- Resend (transactional emails: application alerts, status changes, subscription confirmations, reminders).
- Zoho (mailbox for platform correspondence, including deletion requests).
- Malware-scanning worker (scans quarantined attachments; dedicated infrastructure operated for The Event Register — deployed after launch; see Section 5).
Each processor handles data only as needed to provide its service, under its own terms. No external advertising or analytics provider receives your data.
7. Security
Access to private data is enforced at the database level (row-level security): applicants see only their own applications, posters see only applications to their opportunities, and administrators see only what moderation requires. Reviewer notes marked private are visible to staff only. Uploaded files are quarantined until they pass malware scanning (see Section 5), and downloads use short-lived signed links. Email confirmation is required before posting or applying. No method is 100% secure, but we apply industry-standard protections and test them before launch and after changes.
8. Retention and deletion
We keep your information only as long as needed for the purposes described in this policy, then delete or anonymize it according to the schedule below. We never automatically delete records before legally required minimum retention periods expire.
Retention schedule
| Category | Retention trigger | Duration | Action at end of period | |---|---|---|---| | Account and profile data | Account closure | 2 years | Delete | | Listings (including withdrawn) and applications | Listing closure (closed, expired, or withdrawn) | 2 years | Delete; anonymize residual engagement references | | Messages | Closure of the related listing | 2 years | Delete | | Feedback linked to an account (contact opt-in) | Account closure or withdrawal of contact consent | 2 years | Delete or anonymize | | Feedback not linked to an account | Submission | 2 years | Delete | | Usage analytics events (identifier-free) | Collection | 2 years | Delete (aggregated insights retained) | | Subscription and tax records | End of subscription or transaction | As required by applicable law [FOR COUNSEL REVIEW: confirm applicable minimum periods] | Delete once no longer legally required | | Security records (audit logs, BAQA disclosure logs) | Creation | As required by applicable law; minimum 2 years [FOR COUNSEL REVIEW: confirm minimum] | Delete once no longer legally required | | Records related to an active dispute | Resolution of the dispute | 2 years after resolution | Delete | | Records under legal hold | Release of the hold | Retained while the hold is active; schedule resumes on release | Delete per schedule once hold is released |
Where a record falls into more than one category, the longest applicable retention period controls.
Public anonymization vs. restricted legal records
When you delete your account, what the public sees is anonymized: your profile is removed, your listings are withdrawn, and authorship references are dissociated from your identity. Separately, The Event Register maintains restricted legal records — a minimal archive linking the deleted account's identifier to the listings posted, applications submitted, and payment records associated with it. These records are inaccessible to ordinary users, stored separately from active profile data, and available only to specifically authorized administrators for legitimate legal, security, or compliance purposes (including responding to lawful process and preserving evidence for disputes between marketplace participants). Access to these records is logged. We do not retain unnecessary personal information beyond what this section describes.
[PROPOSED FOR COUNSEL — evidence retention: in light of New York's generally six-year limitation period for contract claims, we propose retaining engagement-related evidence records (listings, applications, messages tied to engagements, audit logs, BAQA logs, and the deletion-evidence archive) for six years from listing closure or engagement completion, rather than the two-year default above. Ordinary account data remains on the two-year schedule. Counsel should confirm the appropriate periods and triggers.]
Records under legal hold
When litigation, a credible dispute, or lawful process requires preservation, relevant records are placed under legal hold and are not deleted or anonymized until the hold is released, regardless of the schedule above.
Requesting deletion
There is no self-service deletion at launch. To request deletion of your account and personal data, email admin@the-event-register.com from the email address on your account.
We handle deletion requests according to the following internal service targets. These are our own operating goals — not universal statutory deadlines, which vary by jurisdiction:
- We acknowledge your request within 3 business days of receipt.
- We verify that you own the account before acting (and, for organization data, that you are an organization owner).
- We complete eligible deletion — or explain which information we must lawfully retain and why — within 30 calendar days of receipt, where feasible and subject to applicable law.
- We confirm by email when processing is complete.
What we delete: your profile, applications, messages, linked feedback, notifications, and organization memberships, per the procedure above. Your listings are withdrawn from public view, not deleted — they are retained per the schedule above with your authorship anonymized, so that records of opportunities that were once public remain auditable. What we retain: only what we must — withdrawn listings (anonymized), subscription and tax records, security audit logs, BAQA disclosure logs, records subject to an active dispute or legal hold, and anything else required by law — each per the retention schedule above. We track every request: receipt date, identity-verification steps, applicable deadlines, completion date, and any exceptions.
9. Your rights
Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, or to object to certain processing. Email admin@the-event-register.com and we will respond within a reasonable time.
10. Minimum age
The Event Register is a professional B2B marketplace for adults. You must be at least 18 to hold an account.
11. Changes
We will post material changes here with a new effective date and, where appropriate, notify you by email. Continued use after the effective date constitutes acceptance.
Our privacy and data-retention practices are subject to ongoing review, including review by New York legal counsel. We may refine these practices to reflect applicable legal requirements, operational developments, and improvements in data protection. Material changes will be disclosed through an updated Privacy Policy, with additional notice or consent where required by law.
12. Contact
Privacy questions or requests: admin@the-event-register.com
Analytics verification notes (internal — not published)
Verified 2026-10-31 against implementation:
- Data model:
analytics_events(event_name, feature, side, occurred_at)— no identifier columns exist.CHECKconstraints limit values to the documented enums. Confirmed in migration 0010. - Collection paths:
lib/analytics.tstrackEvent()inserts only{event_name, feature, side}— no IP, UA, or user id is captured or sent. Update 2026-10-31: the helper is now wired viacomponents/TrackPageView.tsxon the opportunities board, listing detail, and dashboard home — the policy's present-tense wording is accurate as of this build. (Earlier finding that the helper was never called is resolved.) - Access: RLS — inserts open to anon/authenticated (rows carry no identity, nothing to protect); selects restricted to staff (
ter_is_staff()); no update/delete policies (append-only). - No third-party analytics: no PostHog/Segment/Amplitude/GA code in the codebase; no external recipient.
- Infrastructure logging: Vercel and Supabase transiently log IP addresses in standard operational logs, as with any hosted service. We do not store IPs in analytics or join them to usage events. This is disclosed in the launch assessment, not in the policy body, to avoid implying we track IPs.
- Feedback:
user_feedbacklinksprofile_idonly when the user opts into contact (contact_ok); otherwise stored unlinked. Matches the policy. - Terminology: "anonymous" is used only for the usage events, which genuinely contain no linkable identifiers. The future-changes paragraph commits to never representing identifiable collection as anonymous.
Questions about these terms? Contact us at admin@the-event-register.com.