eBrainGo Privacy Policy

Effective date

Effective date: July 2026 · Last updated: July 24, 2026

eBrainGo is an event companion app for conferences and trade shows: the programme, speakers, venue maps, networking chat, a social feed, surveys, travel logistics, badge scanning and the "Alia" event assistant. It is provided by eBrain Technology Group GmbH ("eBrainGo", "we", "us") to the attendees, exhibitors and staff of events run by our customers, the event organisers.

This policy explains what personal data we handle when you use the eBrainGo mobile app, the organiser web console and the website ebraingo.com (together, the "Service"), why we handle it, who receives it, how long we keep it and what rights you have.

1. Who we are and how to contact us

• Provider — eBrain Technology Group GmbH, Gesellschaft mit beschränkter Haftung (GmbH / Limited Liability Company), HRB 271443 B (Registered at the Local Court / Amtsgericht Charlottenburg, Berlin)
• Registered address — Wilmersdorfer Straße 138-140, 10585 Berlin, Germany
• Privacy contact — info@ebraingo.com (monitored mailbox; this is also the "Email support" address inside the app)

2. Roles: organisers, exhibitors and eBrainGo

eBrainGo is a multi-tenant platform. Each organiser’s data is kept in its own database schema and its own storage bucket.

• Event organisers are our customers. They create events, upload the participant list (including your email address, which is how you become eligible to sign in), agendas, speakers, logistics such as hotel and transfer details, content, surveys and announcements. For that event data the organiser is the data controller and eBrainGo processes it on the organiser’s behalf under a data processing agreement.
• eBrainGo is the data controller for your account and profile, login and security data, push registrations and notification preferences, support requests, moderation records, privacy requests and organiser billing.
• Exhibitors who scan attendee badges at their booth are independent controllers of the lead records they collect (section 3.5).
• Each organiser may show you its own privacy notice when you open its event in the app. That notice covers the data the organiser holds about you as a participant and is separate from this policy.

Questions about data an organiser holds about you (your registration, ticket, hotel booking, survey answers, badge scans) should go to the organiser first; we will forward requests we receive to the organiser where needed.

3. The data we handle

3.1 Account and profile

You can only sign in if an organiser has enrolled your email address. When you first sign in you confirm your email with a one-time code and set your name and password. Your account holds:

• first and last name, email address, password (stored only as a salted hash);
• optionally: profile photo, job title, company, country, biography, interests;
• last-login time, the events you are enrolled in and your role in each (attendee, exhibitor, front-desk staff).

Your name, photo, title, company and country are visible to other participants of the same event in the attendee directory, in chat and on the feed.

3.2 Event data provided by the organiser

Organisers upload participant records that may contain your email, external ticketing identifiers, ticket and account-holder details, and any further fields the organiser defines. They may also record your hotel, arrival and departure details, transfer pickups, remarks such as breakfast preferences, agenda invitations and check-in or check-out scans made by front-desk staff. The organiser decides which of this data exists; we display it to you and use it to run the event (QR badge, check-in, personal schedule, reminders).

3.3 Content you create

• Chat: private and group messages, photos, videos, documents and voice notes you send, reactions, replies, pinned messages, read receipts, typing and online status, chat requests and mute settings.
• Social feed: posts, photos, GIFs and videos, comments, replies, likes, @-mentions and posts you share into a chat.
• Surveys: your answers, which the organiser can see.
• Alia assistant: the questions you type or dictate, and the answers generated from your event’s data (section 6).
• Support requests: the name, email and message you send through the contact form. These are emailed to the organiser’s support mailbox (or to ours) and are not stored in our database.

3.4 Device, technical and security data

• Push registration: a device push token (Apple APNs or Google FCM) and the Firebase installation identifier, so that we can deliver notifications.
• Notification preferences: for each category (interactions, chat, event updates, agenda updates, travel and logistics, reminders, announcements) whether push and in-app delivery are on. These are stored on our servers so your choice applies on every device you use, and a copy is kept on the device.
• Audit and security logs: who did what and when (for example a login, a profile change, a check-in), which may include your IP address and the request path. Passwords and tokens are never written to logs.
• Moderation records: posts you report or hide, users you block, and reports made about you.
• Session tokens and one-time codes used for login, password reset and invitations.
• Our hosting provider and email provider keep their own access and delivery logs.

3.5 Lead capture (exhibitor feature)

Exhibitors can scan an attendee’s badge or enter a contact manually to record a sales lead: name, company, address, phone, email, a hot/warm/cold rating, notes, custom fields the organiser defines, and whether the attendee agreed to be contacted. The exhibitor is the controller of these records and is responsible for asking for your consent at the booth. Where an organiser uses badges issued by the third-party service ExpoLeads, the app sends the scanned badge code to ExpoLeads to decode it and receives your contact details from them. Lead records are kept until the exhibitor or organiser deletes them and are not removed when you delete your account — contact the exhibitor or organiser directly.

3.6 Location

If you ask Alia for directions to the venue, the app asks for permission to use your precise location once and shows a route preview rendered by Google Maps inside the app. Your coordinates are used on your device and by Google to draw the route; they are never sent to or stored on our servers. You can decline the permission and still use every other feature. This feature only exists in app versions where the map service is enabled.

3.7 Camera, microphone, photos and calendar

• Camera is used to scan badges and QR codes and to take a profile photo or a picture for a post or chat. Codes are read on the device.
• Microphone is used to record voice notes for chat and to dictate to Alia. Dictation is transcribed by your phone’s speech service (Apple or Google, under their terms); only the text you then send reaches us.
• Photo library access is used only when you choose a photo or video to upload.
• Calendar: "Add to calendar" writes agenda sessions into your phone’s calendar and remembers which ones you saved, on the device only. We do not read or collect your calendar.

3.8 Organiser billing

Organisers pay for their subscription on the web through Stripe. Billing contacts and invoices are handled by Stripe and our organiser console; the mobile app contains no payments and collects no financial data from attendees.

3.9 What we do not collect

We do not use analytics, crash-reporting or advertising SDKs. We do not collect an advertising identifier, your contacts or address book, health data, biometric data, browsing history, background location or a search history (search terms are only used to answer the request). We do not sell personal data and do not share it for advertising.

4. Why we use your data and on what legal basis

We do not make decisions about you by automated means that have legal or similarly significant effects. Alia generates answers; it does not decide anything about you.

5. Notifications and your preferences

Notifications are part of the Service and are used only for event-related information: new messages, comments and mentions, changes to sessions you follow, travel and logistics updates, reminders, and organiser announcements. Organisers are contractually limited to operational, event-related announcements — we do not send marketing notifications.

You control notifications in two places:

• In the app, under Notification preferences, you can turn push and in-app delivery on or off per category, including organiser announcements. Your choices are saved to your account and apply on every device.
• In your phone settings, you can revoke the notification permission altogether.

Push notifications for chat include a preview of the message so it can be shown on your lock screen; the preview travels through Apple’s or Google’s push service.

6. The Alia assistant

Alia answers questions about your event (programme, speakers, rooms, Wi-Fi, hotel and transfer details, contacts, your schedule) and can add sessions to your schedule when you confirm. To generate answers, your question and the relevant event data are sent to our AI provider, IONOS AI Model Hub in Germany, which processes them on our behalf against IONOS AI Model Hub terms. Conversations are stored with your account so you can continue them, and a copy is cached on your device. Answers are generated by a language model and can be wrong — check times, rooms and travel details in the programme.

7. Who receives your data

Service providers (processors) act on our instructions under data processing agreements:

Independent services you interact with directly, under their own privacy terms:

• Google Maps (in-app route preview): your location and the venue address are sent from your device to Google to draw the route (section 3.6).
• ExpoLeads: when an exhibitor scans an ExpoLeads badge, the scanned badge code is sent from the exhibitor’s device to ExpoLeads, which returns the attendee’s contact details (section 3.5).
• Apple and Google operating-system services: speech recognition for dictation, calendar, push transport, and the app stores.
• Google reCAPTCHA protects the contact form on our website (not the app).
• Stripe processes organiser subscription payments on the web.

Organisers, exhibitors and other participants

• The organiser of an event sees the participant data it uploaded, your survey answers, your check-ins and reports made in its event, and can moderate the event’s feed and chat.
• Exhibitors see the leads they captured, including any lead about you.
• Other participants of the same event see your profile, your posts and comments, and the messages you send them or the groups you are in.

Legal and business reasons. We may disclose data where the law requires it, to protect the rights and safety of users or the public, to enforce our terms, or to a successor if our business is transferred (we would tell you beforehand). We do not sell personal data.

8. International transfers

Our servers and database are in the European Union. Some providers listed in section 7 (Google, Apple, ExpoLeads) may process data outside the EU/EEA or the UK. Where the GDPR or UK GDPR applies, such transfers rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with additional safeguards where needed. You can ask info@ebraingo.com for details of the safeguards used.

9. How long we keep your data

Retention periods are maximums; data may be deleted earlier. Backups are overwritten on a rolling basis, with a maximum retention period of 30 days.

10. Security

All traffic between the app and our servers uses TLS; the app refuses unencrypted connections. Passwords are stored only as salted hashes. Each organiser’s data is isolated in its own database schema and storage bucket, files are served through short-lived signed links, access is limited by role, and privileged actions are logged. No system is perfectly secure; keep your phone locked and your password private, and tell us about any suspected misuse. Sign-in tokens are stored on your device and are removed when you sign out.

11. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, to withdraw consent, and to complain to a supervisory authority. How to exercise them with eBrainGo:

• Access and portability — email info@ebraingo.com from your account address. We prepare a machine-readable (JSON) export of your account data — profile, memberships, messages you sent, posts, comments, survey answers, Alia conversations, leads you captured — and send you a download link within one month. The link works for a limited time.
• Correction — edit your profile in the app. Your email address and data provided by an organiser (registration, logistics) can be corrected through the organiser or by contacting us.
• Deletion — delete your account in the app or by email (section 12).
• Restriction and objection — email us; we respond within one month.
• Withdrawing consent — turn off location, camera, microphone or notification permissions in your phone settings, or change notification categories in the app, at any time. This does not affect processing that already happened.
• Complaints — you can lodge a complaint with your local supervisory authority; for Berlin, Germany, this is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI): https://www.datenschutz-berlin.de/. We would appreciate the chance to address your concern first.

We may ask you to confirm a request from the email address on your account. Requests are free of charge unless they are manifestly unfounded or excessive. Requests about data an organiser holds about you are forwarded to the organiser where we act as its processor.

12. Deleting your account

You can delete your account at any time in the app: Account screen (Menu → Account & Privacy for attendees; the person icon in the home header for exhibitors and front-desk staff) → Delete account → confirm. You are signed out on all devices immediately, and your account, profile, photo, memberships, posts, comments, likes, chat memberships, push registrations, preferences and export files are deleted in the background — usually within minutes and never later than 30 days. Your participant records are anonymised. Messages you sent remain visible to the other participants under the name "Deleted User". Data held by organisers and exhibitors (including badge-scan leads about you) is not affected. Full details, including how to request deletion without the app: https://ebraingo.com/delete-account.

13. Data stored on your phone

To work offline and start quickly, the app keeps on your device: your sign-in tokens, your profile, cached event content, your notification preferences, which agenda sessions you saved to your calendar, which organiser privacy notices you accepted, your Alia conversations and — for exhibitors — leads captured while offline until they sync. Signing out removes your sign-in tokens and profile; deleting your account or uninstalling the app removes everything. The app never stores your location.

14. Children

The Service is intended for adults attending professional events and is not directed to anyone under 18. Organisers must not enrol children, and we do not knowingly collect data from them. If you believe a child has an account, contact info@ebraingo.com and we will delete it.

15. Changes to this policy

We will post any changes on this page with a new effective date and version number and, for material changes, notify you in the app or by email before they take effect. Previous versions are available on request.

16. Contact

eBrain Technology Group GmbH, Wilmersdorfer Straße 138-140, 10585 Berlin, Germany · info@ebraingo.com