Privacy Policy

Orana Software Inc. (Wyoming, USA), trading as My Connect Buddy ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard information when you use our platform at myconnectbuddy.com and any associated services (the "Service").

By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

Information you provide directly

• Account details — name, email address, organization name and contact details for organizers and vendors
• Billing information — processed and stored by Stripe; we do not store card details
• Event content — event names, descriptions, images, vendor lists, pricing and settings you create
• Attendee and vendor data — names, emails, phone numbers, business details and any other fields captured when people register for or participate in your events
• Communications — emails, support requests and demo bookings you send us

Information collected automatically

• Usage data — pages visited, features used, time spent, clicks and interactions
• Device and browser information — IP address, browser type, operating system
• Redemption location — when an attendee redeems a perk at a booth, the device may provide approximate GPS coordinates so organizers can see where and when it happened. This is best-effort and skipped whenever the device or the person declines it
• Log data — server logs including access times, error reports and referring URLs

Information from third parties

• Logto identity data — when you sign in, we receive your authenticated user identifier and email from Logto (our identity provider)
• Stripe payment events — webhook events confirming charges, subscription changes and refunds relating to your events
• Imported lists — when an organizer adds a vendor or visitor, we store the details they provide

2. How We Use Your Information

We use the information we collect to:

• Provide, operate and maintain the Service
• Process payments and manage subscriptions and event fees via Stripe
• Record event participation — ticket purchases, booth redemptions and attendee connections
• Produce the real-time reporting and analytics organizers rely on
• Send transactional email (confirmations, reminders, sign-in links) via our email provider
• Respond to your requests and provide support
• Detect, prevent and address fraud, abuse and security issues
• Comply with legal obligations

3. Attendee Data and Sharing With Vendors

This is central to how Connect works, so we call it out plainly.

When an attendee registers for a 3-way event, the organizer's registration form may ask whether the attendee consents to share their contact details with the vendors whose booths they visit. A vendor can only ever access an attendee's contact details when that attendee has explicitly opted in. Attendees who do not opt in are never included in any vendor lead list — a vendor sees only an anonymous count of visits, never the underlying people.

Consent is per-attendee and can be withdrawn. Organizers are responsible for the accuracy of the consent language on their registration forms and for their own lawful basis to run the event.

4. How We Share Information

• Stripe — payment processing and Connect payouts. Organizers are the merchant of record for their own events; funds flow to their connected Stripe account
• Vendors — only the consent-gated attendee details described in Section 3, and only when unlocked by that vendor
• Service providers — identity (Logto), email delivery, cloud hosting (Microsoft Azure), and analytics, each bound to process data only on our instructions
• Legal — where required by law, or to protect rights, safety and property
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy

We do not sell personal information.

5. Cookies

Our marketing site uses only essential cookies needed to serve the pages. The application uses cookies and similar technologies to keep you signed in and to remember your preferences. You can control cookies through your browser settings; disabling essential cookies may break sign-in.

6. Data Retention

We keep personal information for as long as your account is active or as needed to provide the Service, then for the period required to meet legal, tax and accounting obligations. Organizers can export their event data at any time. When an account is closed, we delete or anonymise personal data within a reasonable period, except where retention is legally required.

7. Your Rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, and to withdraw consent. Attendees should direct requests to the organizer who collected their data (the data controller for their event); we will assist that organizer as a processor. To exercise rights in data we control directly, contact us at the address below.

8. Security

We use industry-standard measures — encryption in transit, access controls and reputable infrastructure providers — to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. International Transfers

We are based in the United States and our providers may process data in the US and other countries. Where required, we rely on appropriate safeguards for international transfers.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date, and where appropriate we will notify you.