Privacy Policy

Intrface Inc.
Effective date: September 12, 2026
Last updated: September 12, 2026

Intrface Inc. ("Intrface," "we," "us," or "our") provides technology and services that connect real-world events, activations, products, and experiences with digital participation, networking, rewards, and measurement. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information, and the choices and rights available to individuals.

Privacy questions and requests: privacy@intrface.app

1. Scope of this Policy

This Policy applies to personal information handled in connection with our websites that link to it, including our partner website; attendee-facing applications and account services; partner dashboards and administrative tools; staff-operated check-in and point-of-interaction applications; connected wristbands, badges, tags, and products; event and activation services; and related sales, support, and business communications. Together, these are the "Services."

It covers website visitors, prospective customers, customer representatives, account holders, event staff, attendees, and other participants. A person may interact with the Services without creating an account, including when an organizer imports a registration record or assigns a connected wristband.

In this Policy, "personal information" includes "personal data" and similar terms under applicable law. It means information that identifies, relates to, describes, or can reasonably be associated with an identifiable individual. Information does not cease to be personal information merely because a name or email address has been replaced with an identifier.

An event-specific, product-specific, or collection-point notice may provide additional details. Such notices supplement this Policy. Neither this Policy nor an agreement with a customer limits rights that cannot lawfully be waived. Employment and recruitment information is outside this Policy's scope and may be addressed separately.

This Policy is a notice, not blanket consent. Visiting a website, accepting general event terms, or receiving a wristband does not, by itself, constitute consent to every use described here. Where a particular activity requires consent, we or the relevant organizer must obtain that consent separately in an appropriate form.

2. Our role and the role of event organizers

An event organizer, brand, agency, venue, or other organization that engages Intrface is referred to as a "Customer." Sponsors and exhibitors may also receive Services or information associated with particular features or activities.

Intrface's own processing. We determine the purposes and means of processing for activities such as managing our websites and business relationships, administering Intrface accounts, securing the Services, and carrying out our own permitted product analytics, communications, and service development. For these activities, we act as a controller or equivalent responsible organization under applicable law.

Processing on a Customer's behalf. For Customer-directed activities, such as importing an event's guest list, recording attendance, operating an activation, or producing a Customer's report, the Customer may be the controller and Intrface its processor or service provider. Our handling of that information is also governed by the applicable services agreement, lawful instructions, and any data processing terms. This Policy does not authorize us to disregard those restrictions.

The role of each organization depends on the particular activity, not solely on the label used in a contract. A Customer or sponsor using information for its own marketing is responsible for that use and its own privacy disclosures. Where Intrface uses information for a separate purpose that it determines, Intrface is responsible for establishing the necessary lawful basis and providing the relevant notice.

Customer-provided attendee information is not automatically available for Intrface's independent marketing or profiling across unrelated events. Any such use requires an appropriate legal basis, compatibility with the original collection, and additional notice or consent where required.

For questions about a particular event's registration requirements, selected tracking features, sponsors, or onsite alternatives, contact the organizer. You may also contact Intrface, and we will handle or coordinate your request according to our role. We do not require you to determine the correct legal classification before raising a concern.

3. Personal information we collect

The information involved depends on the Services used, the event configuration, information supplied by Customers, and your choices. We do not collect every category from every person.

We do not require government identification numbers, medical records, biometric identifiers, or similar highly sensitive information for ordinary attendee accounts. Please do not submit such information through profiles or general support messages.

Some otherwise ordinary information can be sensitive in context. For example, attendance at a particular event may reveal an interest in a sensitive subject, and a sufficiently specific location observation may constitute sensitive personal information. Where sensitive processing requires additional consent, restrictions, or safeguards, those requirements apply even if the information was generated through a wristband rather than entered in a form.

4. Where information comes from

We receive personal information directly from you when you create an account, edit a profile, contact us, participate in an experience, or exercise a choice. We also receive it from Customers and their authorized registration, ticketing, or other integrations; staff who assign credentials or operate event features; and other participants when an interaction involves you.

Information is also generated through the Services, connected items, and configured readers. A record may initially be associated with a browser or tag identifier and later be linked to an account when you sign in, claim an item, or have a credential assigned to you.

When you choose a third-party sign-in option, such as Google or Apple, we receive the account information authorized through that provider, which may include an email address, provider identifier, and available profile information. We do not receive your password for that third-party account through the sign-in process.

We may receive relevant business contact information from referrals, business correspondence, and publicly available professional sources for legitimate business development, subject to applicable privacy and marketing rules. Public availability does not give us unrestricted permission to use an individual's information.

5. How we use personal information

Providing and administering the Services. We use information to establish and authenticate accounts; manage customer and staff access; associate credentials and connected items with participants; deliver selected event features; record participation; maintain progress; support networking; and administer rewards and fulfillment.

Reporting and event measurement. We use relevant records to produce individual-level and aggregate dashboards, reports, and exports; assess participation, attendance, activity performance, repeat engagement, and event patterns; and provide the reporting purchased by an organizer, sponsor, or exhibitor, subject to the limits in Section 7.

Persistent accounts and personalization. Where these features are offered and lawfully enabled, we connect activity to your continuing Intrface account, maintain achievements and connected products, recommend experiences, and personalize content using your preferences and participation. Cross-event processing is subject to applicable notices, legal bases, Customer restrictions, and your choices. Participation in one event does not grant every other organizer access to your history.

Communications and marketing. We respond to inquiries, provide support, send operational and security messages, and deliver requested event updates. We may also send permitted promotional communications or help Customers deliver their communications as explained in Section 9.

Improvement, analytics, and research. We analyze reliability, usability, engagement, and performance to improve the Services and develop features. We also study event and activation patterns over time. Identifiable analysis remains subject to the restrictions in this Policy. Section 11 explains our separate use of anonymous or properly de-identified information.

Security and integrity. We use information to troubleshoot, maintain system integrity, prevent unauthorized access, investigate misuse, verify legitimate participation, and reduce duplicate or fraudulent claims.

Business administration and legal purposes. We use relevant information to manage billing and contracts, maintain required records, handle disputes and privacy requests, comply with lawful obligations, and establish or defend legal claims.

For a materially different purpose, we will provide additional information and obtain consent or establish another permitted legal basis before proceeding, as applicable. The existence of a technically available feature does not itself authorize its use on every event dataset.

6. NFC, QR, RFID, and location-related features

Active interactions

When you tap a connected item, scan a QR code, check into a session, or interact with a station, the Services may record the item or station involved, the associated event or activity, the time, and any account or browser identifier associated with the interaction. These records can establish participation and contribute to progress, rewards, networking, or Customer reporting.

A connected product or item can also support interactions after an event. Any ongoing collection remains subject to the applicable account, feature, and collection notices; an event wristband is not authorization for undisclosed tracking in unrelated settings.

Passive RFID observations

Some deployments use radio-frequency identification (RFID) readers to detect a compatible wristband or badge within configured areas without requiring a tap, scan, app download, or active phone connection. A reader may record a tag identifier, reader or zone identifier, and timestamp. When a credential is associated with a registration or account, observations may become identifiable attendance or presence records.

Repeated observations may support estimates of zone attendance, repeat visits, movement between monitored areas, or dwell time. They are observations of a credential, not conclusive proof of who wore it or how long a person remained in a location. By themselves, deployed RFID readers do not provide a continuous GPS trail of your phone or a complete record of movement between monitored zones.

Device location is a separate permission

An enabled location-related app feature may request your browser's or device's location permission. Some features record only that a permission was granted or a related task was completed, rather than retaining coordinates. The applicable feature notice should explain any coordinate collection and its purpose.

Turning off phone location, Bluetooth, or NFC, closing the app, or declining cookies does not necessarily stop a separate RFID reader from detecting a wristband. Removing an app shortcut or signing out also does not, by itself, communicate an event-tracking choice.

Notice and choice at the event

The organizer manages onsite tracking choices. Relevant collection information should be presented through registration and event notices and, as appropriate, signage and staff explanations before the tracking begins. Important or unexpected uses must not depend solely on fine print. Where express consent is required, a general notice and an opportunity to opt out are not substitutes for that consent.

To decline optional tracking, ask the organizer or registration staff how to receive a non-tracked credential or use the alternative appropriate to that deployment. The method may involve replacing a credential, changing its assignment, or applying an appropriate collection restriction. Ask for confirmation that your choice has been implemented. Contact privacy@intrface.app if you need assistance or cannot obtain a clear answer onsite.

Declining optional tracking may prevent features that genuinely depend on it, such as automatic attendance credit or activity-based rewards. It does not authorize withholding unrelated services or penalizing the exercise of a protected privacy right. Any necessary attendance or access-control collection and available alternatives should be explained separately.

7. When we disclose personal information

Event organizers and other Customers

An organizer may receive both aggregate and identifiable information associated with its event through dashboards, reports, or exports. Depending on the purchased Services and lawful event configuration, this may include names, email addresses, relevant profile information, registration details, attendance, zone observations, participation, networking activity, points, and redemptions.

Organizer access is event- and purpose-specific. It does not automatically include a person's complete history across unrelated Customers, account authentication secrets, or unrelated private information.

Sponsors and exhibitors

Sponsors and exhibitors may purchase packages that include access to information associated with their agreed sponsored features, booths, sessions, or activations. This can include identifiable information, such as names, email addresses, relevant profile fields, and participation or attendance associated with those features. It is not necessarily limited to anonymous metrics.

Access is limited to the relevant package and permitted purposes, and remains subject to event notices, individual choices, applicable law, and contractual restrictions. Paying for a package does not override an attendee's privacy rights or supply consent on their behalf. The relevant notice should identify recipients with the specificity required by law and explain whether follow-up marketing is involved.

Paid access and legal definitions of sale

Intrface does not offer attendee mailing lists for unrelated third-party purchase outside its Customer and event-service relationships. However, the paid access described above may constitute a "sale" of personal information under laws that define that term broadly. Calling a recipient a client or sponsor does not, by itself, remove that possibility.

Where a disclosure constitutes a regulated sale, sharing, or targeted-advertising activity, the applicable notice, choice, consent, and other requirements apply. You can request an opt-out at privacy@intrface.app. Section 20 provides additional information for U.S. residents. Restrictions imposed by a distribution platform also continue to apply; this Policy does not authorize a disclosure that those rules prohibit.

Service providers

We disclose information to providers that support hosting, storage, infrastructure, communications, authentication, scheduling, payment processing, and other necessary business or service functions, to the extent those providers are used. Our core application hosting uses IONOS infrastructure. Provider access must be appropriate to its function and subject to applicable contractual, confidentiality, security, and legal requirements. A provider is not authorized to use Customer-directed information for unrelated independent purposes merely because it supports the Services.

Other permitted disclosures

We may disclose relevant information to professional advisers, such as legal and accounting advisers; in response to a valid legal requirement or lawful process; where reasonably necessary and legally permitted to protect rights, safety, or the integrity of the Services; or in connection with a proposed or completed merger, financing, reorganization, or transfer of business assets, subject to appropriate safeguards and applicable restrictions.

We may also disclose information at your direction, with valid consent, or as otherwise specifically permitted by law. Public and participant-facing features are described in Section 8.

A recipient acting for its own purposes is responsible for its subsequent use. Intrface remains responsible for disclosures it makes and for responsibilities imposed on it by law; referring to a recipient's policy does not waive those obligations.

8. Profiles, networking, leaderboards, and shared displays

The Services include features intended to make selected information visible to others. Depending on the feature, your display name, username, profile image, biography, social or website links, badges, points, ranking, or participation may appear on profile pages, leaderboards, event screens, or a staff-operated display when you interact with a station.

Person-to-person taps or profile interactions may create records involving both participants and reveal the profile information made available through that feature. Information you deliberately make public can be copied or retained by others and, depending on its availability, may be accessible beyond the event audience.

Do not place information in a public profile that you do not wish others to see. Use available editing or visibility options, or contact us for assistance. Your sign-in email is not made a public profile field merely because it is used for authentication; it may still be disclosed to authorized event recipients as described in Section 7, or become visible if you include it in public content yourself.

9. Email, push notifications, and other communications

We distinguish communications needed to operate an account or requested service from promotional communications. Operational messages may include authentication, security, support, billing, and material service updates.

Promotional messages may include Intrface news, suggested experiences, offers, and ongoing event or brand engagement. We send or facilitate these messages only with the consent or other permission required for the recipient, channel, and circumstances. Importing a registration list or granting a device permission does not automatically establish permission for every sender or marketing purpose.

You can unsubscribe through the method provided in a promotional message or contact privacy@intrface.app. You can disable browser or device push notifications through the relevant settings and use in-service subscription options where available. We process unsubscribe requests within applicable legal deadlines. An opt-out from promotional messages does not necessarily stop necessary non-promotional communications.

Where an organizer, sponsor, or exhibitor communicates independently, its notice and unsubscribe process also apply. We will assist with requests relating to information we disclosed where required. A Customer's purchase of access to your email address does not, on its own, establish permission to send you marketing.

10. Cookies, local storage, and similar technologies

The Services use cookies and browser storage for functions such as authentication, session continuity, remembering preferences and permission status, and recognizing repeat interactions. Technical information may also be generated when the Services or externally hosted resources are requested.

In the attendee application, authentication cookies are configured for a duration of up to 14 days, and a first-party client-identifier cookie used to recognize repeat interactions is configured for up to 180 days. These periods concern browser-cookie lifetimes, not a promise that all related server records are deleted when a cookie expires. Cookies may be issued again during subsequent use. Some local-storage values remain until cleared by the application or browser, or by you.

The technologies used can differ between the marketing website, attendee application, and other Services. Providers of optional sign-in, scheduling, embedded content, or similar features may receive technical information or set their own technologies when those features load or are used. The applicable collection notice and provider information should explain those activities.

Where consent is required for a technology or purpose, it must not be activated before that consent. Where an exemption permits use without consent, any associated information and objection requirements still apply. This Policy does not itself grant permission for optional advertising or tracking technologies.

You can clear or restrict cookies and local storage through your browser. Doing so may sign you out, remove stored preferences, or disrupt features. Browser controls do not delete server-side account information, and an RFID credential is not a browser cookie. Section 20 addresses legally recognized opt-out preference signals.

11. De-identified information and long-term research

We may create and use aggregate, anonymous, or de-identified information to study participation patterns, compare event performance, improve the Services, develop benchmarks, and prepare research, reports, case studies, and other business insights. Properly non-identifying information may be retained for long-term analysis after identifiable source records or accounts have been deleted, subject to applicable law and contractual restrictions.

We treat information as outside the scope of personal-information protections only when it meets the relevant legal standard. Removing a name, hashing an email, or keeping a stable user, browser, or wristband identifier does not necessarily meet that standard. Information that can reasonably be linked back to a person remains protected under this Policy.

When relying on de-identification, we take reasonable measures to prevent association with an individual, maintain and use the information in that form, and do not attempt to re-identify individuals except for legally permitted testing or verification of the protection. Where required, recipients must be contractually bound to equivalent restrictions.

Public reports and benchmarks must not expose identifiable individual records merely because they are presented as statistics. Small groups, unusual activity patterns, and combinations of data can require additional aggregation or suppression.

12. Potential future advertising features

Intrface may introduce advertising features in the future. Before introducing materially new advertising-related processing, we will provide the relevant disclosures and implement the choices, permissions, and safeguards required for that processing. This paragraph is not advance consent to an undisclosed advertising network or a new use of existing personal information.

Our contemplated model would use contextual information, non-identifying statistics, or appropriately controlled audience groupings without giving advertisers access to underlying identifiable attendee records merely because they purchase advertising. Separately purchased event-service access is governed by Section 7 and cannot be relabeled to avoid applicable restrictions.

Information used to assign an identifiable account or device to an audience, or to deliver an advertisement to that account or device, can still be personal information even when advertisers receive only aggregate reporting. In that situation, the applicable restrictions on profiling, targeted advertising, sale, sharing, consent, and opt-outs continue to apply.

13. Automated features and profiling

Automated rules help record task completion, calculate points and rankings, administer rewards, detect duplicate activity, generate analytics, and, where offered, recommend content or experiences. Those functions may involve profiling when they evaluate a person's participation, preferences, or interests.

These event-engagement features are not intended to make employment, credit, insurance, or other similarly significant decisions about individuals. Where applicable law gives you rights relating to an automated decision, including an explanation, an opportunity to contest it, or human review, contact privacy@intrface.app. Any future feature involving regulated decision-making requires an appropriate additional assessment, notice, and safeguards before use.

14. How long we retain information

We retain personal information for no longer than reasonably necessary for the specific purposes for which it is lawfully processed, taking account of the Services provided, the nature and sensitivity of the information, individual requests, Customer instructions, and applicable legal requirements.

There is no single retention period that applies to every category or deployment. We assess continuing need using these criteria. More specific periods may be established by an event notice, a Customer agreement, or applicable law. You may contact us for information about the criteria or period relevant to your records.

A legal hold or other lawful requirement may require limited retention beyond the ordinary period. Such retention is limited to the relevant purpose. This Policy does not retrospectively cancel an earlier applicable retention commitment.

15. Account deletion and associated information

You may request deletion by emailing privacy@intrface.app. Our team reviews and carries out requests; deletion is not necessarily instantaneous or self-service. We may need proportionate information to verify that the request concerns you. You do not need to create an account to make a request.

Subject to applicable law and justified exceptions, deleting an account includes removing the profile and associated personal information from active systems, or irreversibly anonymizing records that can lawfully be retained in that form. De-identification must also address relevant identifiers and links, not only the visible profile. We may retain limited information necessary for legal compliance, security, fraud prevention, disputes, or honoring privacy choices, where permitted, and will explain a relevant exception when responding to a request.

Deleted information may remain temporarily in backup or recovery copies until removed or overwritten through the relevant process. During that period it is not to be used for ordinary business purposes. Where a backup is restored, applicable deletion restrictions must be reapplied. We will handle backup retention consistently with applicable requirements rather than treating backups as an indefinite exception.

Account deletion does not automatically erase information independently held by an organizer, sponsor, exhibitor, another participant, or another controller. We will communicate requests to relevant recipients and assist the responsible Customer where required. You may also need to contact an independent recipient directly. This does not excuse Intrface from its own deletion obligations.

16. Security and access

We use administrative and technical measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss. These include account authentication, encrypted web communications, and restrictions on administrative access appropriate to the Services.

Intrface's direct administrative access to production personal information is limited to authorized core team members operating from the United States or Canada. Outside contractors do not receive that direct access. This is distinct from a Customer's authorized dashboard access and from the limited processing necessary for an infrastructure or other service provider to perform its function.

No system, transmission, or storage method can be guaranteed completely secure. You should protect your account credentials, use appropriate device safeguards, and notify us of suspected unauthorized access. Connected credentials and profile links should also be handled with care where they provide access to information or event features.

Where a personal-information incident occurs, we will assess it and provide notifications to affected Customers, individuals, or authorities when required by applicable law or binding contractual obligations. This Policy is not a representation that Intrface holds a particular security certification.

17. International processing

Intrface is a United States company, and its authorized team operates in the United States and Canada. We use IONOS infrastructure for core application hosting. Provider processing locations depend on the relevant service and hosting configuration; the team's location is not, by itself, a representation of data residency.

Your information may be processed outside the jurisdiction where you live, including in the United States and Canada and in locations used by relevant service providers. Foreign privacy laws may differ from those in your jurisdiction, and courts, law enforcement, or other public authorities may be entitled to access information under the laws applicable to them.

Where applicable law restricts an international transfer, the transfer requires a valid mechanism before it occurs. Depending on the circumstances, this may be an applicable adequacy decision or recognition, approved contractual safeguards, or another legally available mechanism. For restricted UK transfers, this may include a properly completed UK International Data Transfer Agreement or UK Addendum; for restricted EEA transfers, this may include applicable European Commission Standard Contractual Clauses. Required assessments and supplementary protections must also be completed.

These mechanisms are not created merely by mentioning them in this Policy. Contact privacy@intrface.app for information about the locations and safeguards relevant to your information, or to request a copy of applicable safeguards subject to appropriate redactions.

18. Your choices and how to exercise privacy rights

Depending on the law applicable to you and the processing, your rights may include confirmation of processing; access to personal information and information about its use and recipients; correction; deletion; portability; withdrawal of consent; objection or restriction; and opt-outs from covered sale, sharing, targeted advertising, or specified profiling. Some laws also provide rights to information about particular third-party recipients or to limit certain uses of sensitive information.

Send requests to privacy@intrface.app. Describe the right or choice you wish to exercise and provide enough information to locate the relevant records, such as the account email and event name. You do not need to use a prescribed subject line, give up another right, or create a new account. Please do not send passwords or unnecessary identification documents.

We use proportionate verification for requests that could disclose, change, or delete personal information. Verification requirements differ for opt-out requests; we do not require identity verification where the applicable law prohibits it. An authorized representative may act for you subject to appropriate evidence of authority and any permitted verification.

We respond within the period required by applicable law. Access requests under Canadian federal private-sector privacy law generally have a 30-day response period; UK and EEA requests generally have a one-month period; and many U.S. state access, correction, or deletion requests generally have a 45-day period. Different periods, permitted extensions, and specific rules may apply. We will explain any permitted extension or refusal as required.

Requests are ordinarily handled without charge. We will impose a fee or decline a request only where permitted by law, and explain the reason and available recourse. If we process the relevant information for a Customer, we may refer or forward the request to that Customer and assist it rather than independently overriding its lawful instructions.

You may challenge our response by replying to the privacy contact and asking for review. Where a law provides a formal appeal right, we will handle the appeal within its applicable requirements and explain available complaint routes. You may also complain to the relevant privacy regulator or state attorney general.

We do not unlawfully discriminate or retaliate against individuals for exercising privacy rights. Some requested features may be unavailable without information genuinely necessary to provide them; we will distinguish that necessity from optional marketing or tracking.

19. Additional information for Canadian residents

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial privacy law applies, Intrface is accountable for personal information under its control, including applicable obligations when a provider processes it on our behalf.

Our privacy lead receives questions and requests through privacy@intrface.app. You may request access, challenge accuracy, withdraw consent subject to applicable limitations, and raise concerns about our practices. We will explain relevant consequences of withdrawing consent, including whether a particular requested feature can continue without the information.

Consent must be meaningful and appropriate to the sensitivity and reasonable expectations involved. Optional marketing, unexpected disclosures, and sensitive processing may require express consent. Commercial electronic messages are also subject to applicable anti-spam requirements; a privacy notice alone is not permission to send them.

You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority. Where provincial law provides additional rights or requirements, including relevant Quebec requirements, those protections apply in addition to this Policy. We will provide an explanation of the rights applicable to your request.

20. Additional information for U.S. residents

This section applies to the extent a U.S. state privacy law covers Intrface and the relevant processing. Statutory coverage depends on factors such as the activities, data, and applicable thresholds; including this section is not a claim that every state law applies identically to every use of the Services.

Categories, purposes, and recipients

For California disclosure purposes, the categories described in Section 3 correspond to identifiers and contact information; customer-record information; commercial information; internet or electronic activity; geolocation information; visual or other submitted content; professional information when supplied; and inferences. Depending on context, authentication information and sufficiently specific location information can also fall within sensitive-personal-information categories.

These categories describe our collection and disclosure practices, including during the preceding twelve months where the relevant Services were used. The sources are described in Section 4, purposes in Section 5, retention criteria in Section 14, and recipient categories in Sections 7 and 8.

Paid organizer, sponsor, or exhibitor access can involve identifiers and contact information, relevant profile or professional information, event-related commercial and activity records, attendance or zone information, and engagement inferences. The actual categories disclosed depend on the relevant event, package, permissions, and applicable restrictions. Authentication secrets are not included in those reporting packages.

Sale, sharing, and targeted-advertising choices

The fact that Intrface does not operate an unrelated attendee-list marketplace does not mean that every paid event disclosure falls outside legal definitions of sale. Where those definitions apply, you may exercise the applicable opt-out through privacy@intrface.app. You may use that same contact for a request described as "Do Not Sell or Share My Personal Information" or "Your Privacy Choices."

Under California law, "sharing" has a specific meaning relating to cross-context behavioral advertising; it is not identical to every disclosure to another organization. Future advertising features are addressed in Section 12 and require a separate assessment before introduction.

Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, that signal constitutes a request to opt out of the covered processing. Such rights are not limited to the manual email channel. A browser signal may not, by itself, identify a separate offline event registration or wristband; additional event-specific requests can be directed to the organizer or Intrface. Any legally required association with an identified account also applies. Ordinary legacy "Do Not Track" settings are distinct from legally recognized opt-out preference signals.

We do not knowingly make personal information about individuals under 16 available through paid sponsor or exhibitor access or use it for cross-context behavioral advertising. Where sensitive-information processing requires opt-in consent or a right to limit use, those requirements apply. Optional collection of precise location must be assessed separately from ordinary account administration.

Other rights and rewards

Applicable state rights may include access, deletion, correction, portability, information about recipients, limits on certain sensitive-information uses, and an appeal of a denied request. Section 18 explains how to submit requests, authorized-agent requests, and appeals. California residents may also contact us about applicable rights concerning disclosure for third parties' direct marketing.

Some experiences provide points, prizes, discounts, or other benefits. Participation mechanics do not waive privacy rights. If a program constitutes a regulated financial incentive or price or service difference related to personal information, a separate notice must explain its material terms, the relevant information and value assessment, and how to join or withdraw before participation.

21. Additional information for the United Kingdom and EEA

Where UK or EEA data protection law applies, we must identify a lawful basis for our own processing. For account or service features you request under a contract with Intrface, the basis may be performance of that contract. A Customer's contract with Intrface is not automatically a contract with each attendee.

For business administration, responding to professional inquiries, protecting the Services, and proportionate service analytics, we may rely on legitimate interests after the required necessity and balancing assessment. The interests are administering and improving our business and Services, supporting Customers, and preventing misuse, subject to individuals' rights and reasonable expectations.

We rely on consent where required for optional marketing, tracking technologies, sensitive activities, or other processing. We rely on legal obligation for processing necessary to meet an applicable legal duty. Special-category information requires an additional applicable condition, not merely a general legitimate interest. For Customer-directed processing, the Customer is responsible for its lawful basis and Intrface processes within its authorized role.

You may object at any time to processing for direct marketing, including related profiling. You may also object to processing based on legitimate interests, subject to the applicable legal test. Contact privacy@intrface.app to exercise these rights. Withdrawal of consent does not make earlier lawful processing unlawful.

Other applicable rights, including access, correction, erasure, portability, restriction, and relevant automated-decision safeguards, are explained in Section 18. You may complain to the UK Information Commissioner's Office or the competent EEA supervisory authority, including where you live, work, or believe an infringement occurred. Where a local representative or other designated contact is legally required, the relevant contact information must be provided with the applicable regional or deployment notice.

22. Children and younger participants

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Customers must not knowingly submit under-13 registrations or assign identifiable tracked credentials to children under 13 through an ordinary deployment without a separately assessed and lawfully supported arrangement. This Policy does not establish such an arrangement.

Where local law requires a higher age for independent consent, parental authorization, or additional protection for younger participants, those requirements apply. Customer administrative accounts are intended for authorized adults. Section 20 addresses restrictions on paid sponsor access and advertising involving younger individuals.

A parent, guardian, or other person who believes a child has provided information inappropriately should contact privacy@intrface.app. We will investigate and take the steps required by applicable law, including removing information where appropriate.

23. Third-party websites, services, and event activities

The Services may link to or integrate with registration platforms, payment or sign-in providers, social platforms, scheduling services, and other third-party services. Their independent processing is governed by their own notices and applicable law. An organizer may also conduct photography, video recording, surveys, or other activities independently of Intrface; those activities are not automatically governed by this Policy.

A link, integration, or shared event does not mean that Intrface controls every activity of another organization. Equally, using a third-party service does not remove Intrface's responsibility for processing it directs or disclosures it makes.

24. Changes to this Policy

We may update this Policy to reflect changes in the Services, practices, or applicable requirements. The revised version will show an updated date. For material changes, we will provide additional notice through an appropriate channel, such as the Services or account communications, and obtain fresh consent where required before the changed processing begins.

An update does not retrospectively authorize incompatible uses of previously collected information, cancel binding earlier commitments, or override an existing opt-out. Where an earlier notice or consent limits a dataset, we must address that limitation lawfully rather than relying only on publication of a revised policy.

25. Contact us

For privacy questions, complaints, access or correction requests, account deletion, consent withdrawal, or other privacy choices:

Intrface Inc.
Attention: Privacy Lead
Email: privacy@intrface.app
1810 East Sahara Avenue, STE 75073
Las Vegas, NV 89104
United States