Privacy policy

Two roles

EventOS by Spry is built so that the organizer — the organization running the event — is the data controller for the people who register. Spryis the processor: we host what they collect and run the tools they use. This page describes both sides. Where an event has published its own privacy notice, that notice is the one that answers how they use your details, and it appears on that event's public forms beside this policy.

What Spry does as a processor

We host the application and the database it writes to. When an organizer sends mail through EventOS, the configured driver is Resend. When they send SMS, the configured driver is Pindo. Files — invitation artwork, form uploads, and the ciphertext of identity documents — are stored in Vercel Blob. Errors are reported to Sentry so a failure in production leaves a trace; the signed-in admin surface attaches a user id to those reports and nothing else about the person.

We do not decide who is accredited, what extra questions an event asks, or how long an organizer keeps a record. Those decisions are theirs.

What the organizer does as a controller

The organizer decides who is accredited and on what access level. They can add extra questions to a guest record and to the public form. They choose which optional consents the form offers — photography and filming, sharing with named partners, and special-category data such as health, dietary and access needs. They set how long each category of data is kept after the event, including guest records, message history, check-in logs and accreditation documents. They decide whether an access level requires identity documents for vetting.

Their own notice, not this one, is the authority for those choices. This page exists so you can see what the platform is capable of holding.

Your rights

You can ask to see what is held about you, and you can ask for it to be erased. The route is to ask the organizer. EventOSimplements both: a subject-access export that assembles one person's record and leaves other people out of it, and an erasure that removes the copies of your identity that live on the guest, on a registration, and on a nomination. Some operational rows are kept without your name — a check-in count through a door, or a name written into an incident log while an event was going wrong — and the organizer is supposed to tell you when that happens.

The organizer's own team produces the response. Write to them, not to this address, unless you cannot reach them.

Identity documents

When an organizer asks for a passport, a national ID, a visa or a letter of accreditation, the file is encrypted before it is stored. The bytes in the blob store are ciphertext; deleting the row destroys the key, so the file becomes unreadable rather than merely unreferenced. Those documents are kept only as long as the organizer's retention policy for accreditation documents says. A deployment that has not been given an encryption key cannot accept a document at all.