Privacy policy

This policy sets out what we collect, why, who else sees it, how long we keep it and what you can do about it. It describes what the software actually does rather than what a policy of this kind usually says, so where the two differ, this follows the software.

This text has not been reviewed by a solicitor or a data-protection specialist. It is a plain description of how this service actually works, published because operating with nothing written down is worse than publishing an unreviewed statement. A reviewed version will replace it. Where a fact is genuinely undecided, this document says so in the place the fact would have gone rather than filling the space with a plausible sentence.

The cookie policy covers cookies and browser storage specifically, and the terms of service cover the service itself.

1. Who is responsible for your data

Conference2Go is the data controller for everything described here.

We serve people in the United Kingdom and across Europe, so UK GDPR and EU GDPR both apply, and this policy is written to satisfy the stricter reading of either.

Not settled yet. The legal entity behind Conference2Go is not named here, and neither is a dedicated data-protection address. Neither has been confirmed for publication and neither is invented on this page. Until they are, everything about your data goes through the contact page, which reaches a person and gives you a reference.

Not settled yet. Whether we are required to appoint a data protection officer, and whether we have appointed one, are not decided. Whether we need an EU representative under Article 27, and who it is, is likewise not decided. Both are questions for the specialist reviewing this document.

2. The short version

• Browsing takes nothing, unless you accept analytics or advertising measurement. Signed out, we set no cookie and record nothing about your visit — not the conferences you open, not what you search for. If you accept analytics, Google Analytics records the pages you visit; if you accept advertising measurement and arrived from one of our Google advertisements, we keep which one (clause 6). Both are off until you say yes.
• Signing in stores what you chose. Your account details and the things you asked for: saves, ticked dates, follows, saved searches.
• Behavioural analytics are off until you turn them on, on your account, and refusing changes nothing else about how the product works.
• Your search queries never leave our machines. The model that understands them runs inside our own search service.
• We do not sell personal data and we run no advertising pixel. The one third party's script that can run on these pages is Google Analytics, and only after you accept analytics.
• You can export everything and delete your account yourself, from your settings, without asking us.

3. What we collect, and why

While you are signed out

Nothing about your visit is written down, and this is enforced in the code rather than promised: the function that records behaviour cannot be called without a signed-in person, so an anonymous visit has nothing to record.

Two exceptions, and only if you choose them. If you accept analytics in the cookie banner, Google Analytics' tag runs in your browser and records the pages you visit here, without what you search for. If you accept advertising measurement and arrived from one of our Google advertisements, we keep a random identifier in a cookie in your browser and the advertisement's own reference from the link you followed — not the pages you read and not what you searched for. Clause 6 says what happens with each.

Two things are stored inside your own browser and sent nowhere: your answer to the cookie banner, and the conferences you have opened recently, as identifiers only. Both are listed in the cookie policy, and both are yours to clear.

If you fill in the contact form without an account, we keep what you sent us and the address you gave, so we can answer.

When you hold an account

• Your account. Name, email address, and whether it is verified. A password, stored only as an Argon2id hash we cannot reverse. Where you sign in with Google instead, the identifier Google gives us and the tokens that go with it.
• What you chose. Saved conferences, ticked dates and the lead times you set for them, followed series, saved searches with the search text as you typed it, your lists, your travel regions, your home country and city where you gave them, your timezone, your language and your theme.
• Your sessions. Every active sign-in is stored with the IP address and browser user-agent it was created from. Today that record is visible only to our own staff, on your account record, and there is no screen where you can see your own sessions or end one — we would rather say so than describe a control that does not exist. Sessions go when they expire, and every session everywhere is ended when you change your email address, when you delete your account, and — for all but the session you are using — when you change your password.
• A listing you submit. Your name and email address as the submitter, plus the details of the conference and the body running it.
• Messages you send us. Support tickets and their replies, with the address they came from.
• Email we send you. A log of the message: address, subject, template, which stream it went on and what the provider said. It is what support reads when somebody says an email never arrived.
• Records of decisions. Where anything changes state — a listing published, an account deleted, a claim approved, a permission refused — we write an entry naming who did it, what changed and when.

Behavioural analytics, only if you agree

If, and only if, you turn analytics on for your account, we record what you did on the site: which conference pages you opened and the field and country of each, what you searched for and how many results came back, how you arrived as a class such as "search engine" or "academic", the country the request came from, your browser's primary language, and whether the screen was a phone, a tablet or a desktop.

Three limits on that are worth stating because they are unusual:

• No IP address is stored. The address is read to derive a two-letter country code and discarded in the same expression. There is no column for one.
• Never the full referring address, only its class. A referrer routinely carries somebody else's search query in it.
• Never the full language header, only the primary tag such as de. The full header is one of the strongest browser-fingerprinting signals there is and the analysis needs none of that precision.

Separately from all of this we keep two counters against each listing — how many times its card was shown and how many times somebody acted on it. Those carry no identifier of any kind: no account, no session, no country. They exist because search ranking normalises engagement by impressions, and gating them on consent would make a listing's position depend on how many of its viewers happened to opt in.

What we never collect

We do not ask what kind of user you are. There is no "researcher or organizer" question, no role on your account and nothing that infers one, because whether somebody presents or attends changes per conference and per year.

We do not collect special category data. Do not send us any.

4. Why we are allowed to hold it

• To provide the service you asked for — your account, your saves, your reminders, your listings, and the emails that go with them. Performance of a contract.
• To run and protect the service — moderation, fraud and abuse prevention, rate limiting, security, and the audit log that lets us answer an appeal. Our legitimate interests, and we consider them to be interests you share, because they are what stops this directory filling with conferences that do not exist.
• To meet a legal obligation — invoices and the financial records around them.
• With your consent — analytics (Google Analytics, and our own behavioural counts while you are signed in), advertising measurement, and the digest email. All are off by default and any of them can be withdrawn at any time without affecting anything else.

5. Consent, and what it gates

Three switches, and they gate data rather than access:

• Analytics consent gates behavioural capture — Google Analytics on public pages, and our own counts while you are signed in. Without it, Google's tag is never loaded and no event is recorded about you. It changes nothing else.
• Marketing consent gates three things and nothing else: whether an organizer's access key can resolve your name and address, whether your contact details are included in an event sent to an organizer's own system, and marketing email other than the digest — product news, which we do not send at the moment. The digest is separate: you turn it on and off in your settings, and your answer to the banner never changes it.
• Advertising measurement gates the advertising identifier and everything under Advertising measurement in clause 6. Without it, nothing is kept about which advertisement brought you and nothing is sent to Google.

The product works completely for somebody who refuses everything. Search, browse, conference pages, saving, ticked dates, reminders, submitting a listing and managing one all behave identically. We checked that rather than asserting it: analytics consent decides one thing in the code, whether an event may be recorded at all, and marketing consent decides the three named above. Advertising measurement decides whether a conversion is recorded and reported, and nothing else. None of the three is read anywhere that grants or withholds access to a feature.

Refusing the cookie banner, and dismissing it without answering, are the same thing: capture stays off until somebody actively accepts.

You can change any of them at any time from your settings, and the answer to the banner from Cookie preferences in the footer of any public page.

Signed in, every answer you give on the banner is also kept on your account: what you chose, when, and which version of the banner's wording you saw. Withdrawing from Cookie preferences is kept too, with the time and what you turned off.

6. Who else sees it

Organizers see counts for their own listings, in aggregate, never an individual. Daily views, saves, clicks out to their own website, the countries requests came from and the kind of source that brought them. No name, no address, no account, and nothing about anybody's activity on a listing that is not theirs.

One thing about that is worth being exact about. Every figure we show, on our own screens and on an organizer's, suppresses any cell resting on fewer than 5 events, because an "aggregate" of three people is not an aggregate — and where a line is withheld the screen says so, so a suppressed country is never read as a country nobody came from. Version 1.0 of this policy recorded that the organizer's own screen did not yet apply that floor. It applies it now, in the same function that defines the threshold, which is why this version says something different. The figures carry no identifier of any kind, so the most any of them can tell an organizer is that somebody in a given country opened their listing, and nothing further.

There is one exception, and it is the thing marketing consent exists for. An organizer holding an access key can resolve the name and email address of a person who has ticked a date on one of that organizer's own conferences — and only where that person has given marketing consent. Without the consent the key gets an identifier and a sentence saying the details are not available. Without the ticked date on that organizer's own conference, it gets nothing at all.

We do not sell personal data, and we do not tell an organizer who looked at their listing.

Analytics

Who: Google, as our analytics provider.

What we share: a random identifier for this browser, the pages you visit on Conference2Go and what you do on them, the campaign that brought you if there was one, or the website that sent you, your device and browser, and an approximate location worked out from your network address. Where you create an account, we may tell Google that a sign-up happened and by which route — never who you are.

Why: to understand how the directory is used and what to improve.

On what basis: your consent, which you give or refuse in the cookie banner and can withdraw at any time.

We do not sell your data, and we do not send Google your name, your email address, or the conferences you have saved.

Advertising measurement

Who: Google, as our advertising provider.

What we share: that someone who arrived from one of our advertisements went on to create an account, submit a conference, or pay for a placement — with the time, the value, and the advertisement's own reference. Where an email address is needed to match a conversion, it is sent as an irreversible hash.

Why: to know which advertising is worth paying for.

On what basis: your consent, which you give or refuse in the cookie banner and can withdraw at any time.

We do not sell your data. We do not tell Google your name, which conferences you looked at, or anything you have saved.

Code on these pages

One third party's code can run on these pages: Google Analytics, and only once you accept analytics. It is given each page's address without anything you typed — no search words — and, of a page on another website that sent you, only that website's name, never the page's own address. There is no advertising pixel, no social widget, no font loaded from somebody else's server and no map tile service. The browser is instructed, by a content security policy the server sets on every response, that it may load scripts, styles, fonts and connections only from this site — and, while Google Analytics is switched on, from its own addresses — and images only from this site and our own image store. Nothing else could run here even if it were added by mistake.

Processors. We use service providers to run the platform: hosting, an email delivery provider, a payment provider for card payments, Google where you choose to sign in with a Google account, Google as our analytics provider where you accept analytics, and Google as our advertising provider where you accept advertising measurement. Search runs on our own infrastructure and is not a processor arrangement at all. Each provider acts on our instructions, and a written data processing agreement with each one is a condition of using it.

Not settled yet. The processor list, the countries the data is hosted and processed in, and the international transfer mechanism where a processor is outside the UK or the EEA, are all undecided — the hosting and email decisions have not been taken. This document will not name a provider we have not chosen or a safeguard we have not put in place. The specialist reviewing this will need those decisions first.

Outbound integrations. The platform can be configured to send events to an organizer's own system, with three levels of detail: an identifier only, a per-recipient pseudonym that is salted so two receivers cannot join their data, or full contact details. Full contact details are blocked outright until a data processing agreement is recorded against that endpoint, and then still degrade per person to an identifier for anybody without marketing consent.

Nothing in the product sends one of these events today. The function that fans an event out to subscribed endpoints has no caller anywhere in the code. We are saying so rather than describing the mechanism as though it were running.

7. Your search queries

The matching that understands "cancer" means oncology runs on our own servers, not through a hosted AI service. No query is sent to a third party, there is no API key, and there is no outbound call when you search. Google Analytics, where you accept it, is given the search page's address with the words removed, and that a search found nothing — never what was searched for.

We built it the harder way on purpose, and it was not a requirement anybody gave us: a search query can reveal what somebody is working on before they have published it, and for an academic that is genuinely sensitive.

It is protected structurally as well as by intention. The code that configures the search index refuses any configuration that would send a query to another host, and refuses at the point of the edit rather than after it ships. If we ever change this — a hosted model may one day rank better — this section changes with it, and it will be a decision taken with the privacy cost named rather than a default that arrives with a configuration change.

The same care applies to the artificial-intelligence features the platform is able to run, such as reading a conference's own website to pre-fill a listing. What any of them reads is listing text and the conference's own public website — never your account, your saves, your reminders or your searches, none of which is passed to a model by any code path here. None of those features is switched on today, and each has a manual alternative it falls back to, so the product does not depend on one being on.

8. Email

We send:

• Transactional email — password resets, address confirmations, the decision on a listing you submitted, an invoice. This is not marketing and it reaches you whatever your other preferences say.
• Notifications you asked for — reminders for the dates you ticked, and a notice when a series you follow announces a new edition.
• The field digest, only if you turned it on in your settings.

Every non-transactional email carries an unsubscribe link that works immediately and without logging in. The link does not contain your email address — not in plain text and not encoded — because an unsubscribe link travels through mail gateways, link scanners and proxy logs, and any of those would then hold it. It carries a random token instead, which reveals nothing and can be revoked.

Transactional email stops in two cases only: when you delete your account, and when your address hard-bounces. A dead address is dead, and continuing to mail it damages the delivery of every other stream.

9. Your rights

You can exercise the first three yourself, without asking us and without waiting.

• A copy of everything — a single download in your settings, as a JSON file, built when you ask for it with no copy kept. It covers your account, your saves, your ticked dates with the conference names and links, your follows, your recently viewed, your saved searches with the search text, your travel regions, your lists, listings you submitted and your organization memberships.
• Correction — your profile and preferences are editable, and your email address can be changed from your settings.
• Deletion — self-serve from your settings. Clause 10 sets out exactly what it does.
• Objection and withdrawal of consent — both switches, any time, from your settings or the footer.
• Restriction, and portability — the export above is the machine-readable copy portability asks for. For anything else, write to us.

We do not make automated decisions that produce a legal effect about you.

Ask through the contact page. We answer within one month, which is the limit the law sets, and we aim to be quicker than that.

One thing we do not do, said plainly: we do not email you when a copy of your data is downloaded. An export is the quietest way for somebody with a stolen session to take everything at once, and a notice at your address is what would make that visible. It is not built. We do send that notice when an email address is changed, to the old address, with a link to cancel the change.

10. What deletion actually does

Deletion is not reversible, so export first if you want a copy.

Removed outright: saved conferences, ticked dates, follows, recently viewed, your lists, your saved searches, your travel regions, any pending email change, every session, every access key, every outstanding password-reset or verification token, your password hash, any Google connection, any second-factor secret and recovery codes, and everything kept for advertising measurement — the browsers joined to your account, the advertisement references, and every conversion not yet sent.

Detached rather than deleted: behavioural analytics rows, where the link to you is removed and the row stays. They describe the catalogue rather than the person, and by then there is nothing tying one to an account.

What survives, and why each one has to:

• Your account row, as a tombstone. Name, image, home country and city are cleared, every preference is reset, and the email address is replaced with a value derived from the account's own random identifier — not from your address, which would be reversible. The row is not deleted because deleting it would cascade into listings that must stay published.
• Your email address, in a do-not-reuse list. It is held so that no future account can take it, and it holds nothing else. Reusing an address would let a new account inherit the old one's mail with no way to tell the two people apart.
• A suppression record against that address, so nothing further is ever sent to it, including transactional email.
• The audit log. Entries are kept and the address in them is replaced by the same derived value everywhere it appears, so "what did this person do" stays answerable while the address is gone. The log is what answers somebody else's appeal about a decision you were part of, and it is append-only by design.
• Invoices and the financial records around them. An issued invoice is never edited or deleted; a correction is a credit note referencing the original. This is a statutory record and it outlives the account.
• Listings you submitted. They stay published, because a listing is about a conference rather than about a person, and your name and address are removed from them.

Two things can stop a deletion, and the settings page names whichever applies: an unpaid invoice, and a listing that would be left with nobody able to correct it.

Support tickets are not currently erased or pseudonymised by deletion, so the address you wrote in from can survive on a ticket. We would rather record that here than describe an erasure that is more complete than the one the code performs. If you want a ticket removed as well, ask us and we will do it by hand.

Google Analytics holds no name or address to delete. Its records are tied to a random identifier in your browser, not to your account; withdrawing analytics deletes that identifier and stops them.

Deletion does not reach outside this platform today. The mechanism for telling an organizer's own system that somebody has been deleted exists and nothing fires it, as clause 6 says. If you have given your details to a conference organiser directly, or through an integration that was live at the time, ask them as well.

11. How long we keep things

• Your account — until you delete it, then as clause 10 describes.
• Behavioural analytics — raw events are deleted 400 days after they happen, by a job that runs nightly. Nothing takes their place: there is a table for daily totals with no identifier in it, and nothing writes to it yet.
• The email message log — 90 days, then deleted. The body of a message is cleared as soon as no further delivery attempt is owed, whatever its age, because a password-reset link inside a stored message is a credential.
• Sessions — until they expire, at 30 days idle, or you sign out.
• Google Analytics — Google keeps the record for the period set in our Analytics account, fourteen months; the identifier in your browser lasts thirteen months from your last visit, or until you withdraw.
• Advertising measurement — the advertisement reference 120 days; the browser identifier until 120 days after it was last seen (the cookie itself lasts ninety days from the last advertisement you followed); a conversion record 400 days. Withdrawing your consent deletes everything we keep for it at once; a conversion already reported to Google cannot be called back from here.
• Listings — indefinitely, including editions that have ended. They hold the links and the history that make a directory useful.
• Invoices and financial records — retained as long as the law requires, and they survive account deletion.

Not settled yet. Three retention periods are not decided and none of them is invented here: how long the audit log is kept — nothing deletes from it today and it is currently permanent; how long support tickets are kept — nothing deletes them either; and backup and server-log retention, which depend on hosting decisions that have not been taken. A retention schedule that has not been agreed is not published as though it had been.

12. Security

Passwords are hashed with Argon2id and never stored in a form we could read. Sessions expire. Cookies are httpOnly, restricted to this site, and marked secure in production. Every permission is checked on the server, per object, and every refusal is logged. Uploaded images have their metadata containers stripped before storage, so a location tag inside a photograph does not end up published. Staff accounts require a second authentication factor.

One thing that is asked for and is not built: we do not check a new password against lists of passwords known to have been breached. It is a real protection and it is not here yet.

Rate limits are keyed with a secret so that nothing identifying — an address, an email — is written into the rate-limit store in the clear.

No card details reach our servers. Card payments, where they are available, go directly to a payment provider.

13. Children

This service is aimed at researchers and conference organisers and is not directed at children. We do not knowingly hold data about anybody under 16. If you believe we do, tell us and we will remove it.

14. Complaints

If you are unhappy with how we have handled your data, tell us first through the contact page and we will answer in writing.

You can also complain to a supervisory authority. For the UK that is the Information Commissioner's Office.

Not settled yet. Which EU supervisory authority is our lead authority, and whether an Article 27 representative is required, are not decided. Meanwhile, if you are in the EU you may complain to the supervisory authority in the country you live in.

15. Changes to this policy

If this policy changes materially we will publish the new version, say so, and keep the earlier version readable. A version is never edited in place, and the version number and date are at the top of this page.