Privacy Policy

1. Overview

Nalo Social is a product of Nalo Seed (naloseed.com). This policy explains what data we collect, how we use it, who we share it with, and your rights. Questions? Email grow@naloseed.com.

Nalo Social is a platform sold to event organizers. This makes Nalo Social a data processor for organizer-controlled attendee data. The organizer is the data controller for their attendees, and they determine what data is collected at their events.

2. Data We Collect

Organizer accounts

When you sign up as an organizer, we collect your email address via Supabase Auth (magic link). We store your organization name, plan tier, and billing contact information if you subscribe to a paid plan through Stripe.

Attendee data

At check-in, we collect the minimum data the organizer has configured for their event. This typically includes name, email address, and optionally phone number, company, title, a short bio, LinkedIn URL, and profile fields like specialty, what you are looking for, and what you bring to the room.

Attendees control exactly what is shared with others. The share toggles on the attendee profile page let each person opt out of sharing their email, phone, or LinkedIn with other attendees. Recaps only include the details each person chose to share.

Connections and interactions

When two attendees scan each other's badges, a connection record is created for both. This record includes the connection timestamp and any notes taken.

Device identifiers and cookies

We set a small number of cookies to make the service work. See our Cookie Policy for the full list.

Usage data

We use Vercel Web Analytics to collect anonymized, aggregate usage data (page views, country, device type). No personal identifiers are stored.

3. How We Use Data

• Run events: power self check-in, badge printing, and scan-to-connect.
• Send recaps: deliver next-morning recap emails with the connections each attendee made.
• Send SMS: if an organizer enables SMS and an attendee opts in at check-in, we send check-in confirmation and optional follow-up messages via Twilio.
• Billing: manage subscriptions and invoices through Stripe.
• Improve the service: analyze aggregate usage to fix bugs and ship features.
• Support: respond to organizer and attendee inquiries.

We do not sell personal data. We do not use attendee data for advertising or profiling outside the event context.

4. Processors and Subprocessors

We share data with the following service providers to operate Nalo Social:

Each subprocessor is bound by a data processing agreement. We do not permit them to use your data for their own purposes.

5. Organizer Responsibilities

If you are an organizer using Nalo Social at your event, you are the data controller for your attendees. You are responsible for:

• Having a lawful basis to collect attendee data (e.g., consent or legitimate interest).
• Informing attendees that Nalo Social processes their check-in data.
• Obtaining explicit opt-in before enabling SMS messages (required by TCPA and similar laws).
• Honoring attendee data subject requests promptly.

Contact us at grow@naloseed.com to request deletion of event data after your event concludes.

6. What Gets Shared in Recaps

Recap emails only include the contact details each attendee opted to share. The share toggles on the /me profile page let attendees control whether their email, phone number, and LinkedIn are visible to connections. No attendee data is shared beyond what they explicitly consented to.

7. Data Retention

• Organizer accounts: retained while the account is active and for 90 days after cancellation.
• Attendee event data: retained for the duration of the organizer's subscription. Organizers can request deletion at any time.
• Email and SMS logs: retained for 90 days for deliverability debugging.
• Anonymized analytics: retained indefinitely.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, or to object to certain processing. To exercise your rights, email grow@naloseed.com. We will respond within 30 days.

Attendees: your data is controlled by the organizer of the event you attended. Contact them directly, or contact us and we will help route the request.

9. Security

All data is encrypted in transit (TLS) and at rest. Database access is governed by row-level security policies so each organization sees only its own data. Service-role credentials are never exposed to browsers.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the effective date at the top and, for material changes, notify organizers by email. Continued use after changes means you accept the updated policy.

11. Contact

Nalo Seed / Nalo Social
grow@naloseed.com
naloseed.com