IForeventsLegal
Privacy Policy
What IForevents collects, why, for how long, and your rights
Last updated:
Overview
IForevents (operated by Innovafour) is an analytics platform. We process two kinds of personal data: data about you as a user of our website and dashboard (account data), and data our customers send about their users through the SDKs and APIs (Customer Data). For account data we are the controller. For Customer Data our customer is the controller and we are the processor under the Data Processing Agreement. This policy covers both and explains how to exercise your rights.
Information We Collect
Account data (controller): name, work email, password hash (never the password), organization name and plan, team memberships and roles, sign-in provider identifiers when you use Google or GitHub, billing status from our payment processor (never full card numbers), support correspondence, and the IP address and browser of security-relevant actions (sign-up, sign-in, key rotation) kept in the audit log.
Usage data: server logs of requests to the dashboard and APIs (path, status, timing, client address), Turnstile bot-protection signals on the signup form, and product analytics about how the dashboard is used only if you accept analytics cookies.
Customer Data (processor): the events, identities and properties our customers choose to send. Customers decide what they collect; we ask them to avoid personal data they do not need, and the platform masks common personal fields in exports and MCP responses.
How We Use Your Data
To provide, secure and bill the Service (contract); to send transactional email such as verification codes, invitations, quota and payment notices (contract); to prevent abuse and enforce rate limits (legitimate interest); to meet legal obligations such as tax records; and, with your consent, to remember cookie preferences and measure dashboard usage. We do not sell personal data and we do not use Customer Data for advertising or to train models.
Data Retention by Category
| Category | Retention |
|---|---|
| Account and organization data | while the account exists, then deleted within 30 days of closure (billing records kept as long as tax law requires) |
| Event data (Customer Data) | per plan: 90 days (Free), 365 days (Pro), 730 days (Scale and Enterprise), then removed by the retention job; customers can delete a subject's data at any time |
| Audit log (security actions) | retained for the life of the organization for accountability, then deleted with it |
| Server logs | rotated automatically, kept no longer than 30 days |
| Backups | 30 days rolling; deleted data leaves the backups when they rotate |
| Support email | 24 months |
GDPR Data Subject Rights
If you are in the EU/EEA, the UK or another jurisdiction with similar rights, you may ask us for: access to your personal data; rectification of inaccurate data (most account fields can be edited in the dashboard); erasure ("right to be forgotten"); restriction of processing; portability in a machine-readable format; objection to processing based on legitimate interest; and to withdraw consent at any time for consent-based processing (cookie preferences can be changed in the banner). You also have the right to lodge a complaint with your supervisory authority.
For Customer Data, contact the customer (the organization that collected your data); we help them respond, and the platform gives them export and erasure endpoints for any user identifier.
Response Timeframe
We answer requests within 30 days, extendable once by 60 days for complex requests with notice. We may ask you to verify your identity first. Requests: [email protected].
Third-Party Services
We share personal data only with processors that help us run the Service: Paddle (payments, merchant of record), Resend (transactional email), Cloudflare (DNS, proxy and Turnstile bot protection), Google and GitHub (sign-in, only if you use them), and our hosting provider. The current list with locations is in the DPA. Each processor is bound by a data processing contract.
Security Measures
TLS 1.2+ for every connection, backups on access-controlled storage, bcrypt-hashed passwords and hashed API credentials, tenant isolation enforced on every request, role-based access, audit logging, rate limits, secrets in a vault with rotation, and a documented incident response. Details for customers: iforevents.com/docs and the Security section of the DPA.
International Data Transfers
Data is stored in the region shown on your organization's settings (currently US). When data leaves the EU/EEA or the UK we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) with our processors.
Children's Privacy
The Service is for businesses and not directed at children under 16. We do not knowingly collect their data; if you believe a child has provided personal data, contact us and we will delete it.
Contact and Updates
Controller: Innovafour, [email protected]. We update this policy when our processing changes; the date at the top tells you the current version and material changes are announced to organization owners by email.
Opt-Out Preferences
Transactional emails (verification, security, billing) cannot be disabled while you hold an account. Product and launch announcements carry an unsubscribe link. Analytics cookies are off until you accept them and can be rejected in the banner at any time.