Expo

Privacy Policy

This Privacy Policy explains what data we collect, why, and what we do with it.

1. What we collect

From visitors (attendees)

• Display name you type at the entry screen (shown above your avatar to other attendees)
• Anonymous walk path in the 3D hall (x/z position broadcast at 10Hz, retained for analytics + replay)
• Chat messages you send (visible to all attendees in real time; persisted in event log)
• Lead-form submissions you send to exhibitors (your name, email, message — passed to the booth owner)
• Standard server logs (IP address, user agent, request paths) for security + debugging

From exhibitors

• Company name, description, color choices, contact email
• 3D models (.glb) and screen images you upload
• Payment metadata from Stripe (last 4 digits of card, customer email; full card numbers never reach our servers)
• Admin email if you have admin access to the dashboard

From advertisers

• Advertiser name and click-through URL
• Ad creative (image) you upload
• Payment metadata from Stripe

2. How we use it

• To render the 3D hall and deliver real-time multiplayer presence
• To deliver leads from visitors to exhibitors
• To process payments via Stripe and email purchase confirmations
• To compute exhibitor analytics (booth visits, demo opens, lead counts)
• To send infrequent administrative emails (purchase confirmation, expiry reminders)

We do not sell personal data, run third-party advertising trackers on our pages, or share visitor lists with anyone other than the exhibitor whose booth you specifically contacted.

3. Cookies

We use one cookie: expo_admin, set only after admin sign-in. It's HttpOnly, Secure, SameSite=Lax, and contains a signed timestamp (not your password or any personal data). Browsers also use standard localStorage to remember your display name between visits — clear it via your browser's storage settings.

4. Third parties we share data with

• Stripe for payment processing — sees billing details only at checkout time
• Cloudflare as our CDN and DDoS protection — sees IP + standard log data
• LiveKit (if voice chat is enabled) — sees a randomly-generated room identifier and your audio stream during active sessions; no recording
• The exhibitor whose booth you contacted — receives the contents of your lead-capture form

5. Retention

• Walk-path event data: 90 days, then aggregated and discarded
• Chat messages: 365 days
• Lead submissions: retained indefinitely for the exhibitor, unless you request deletion
• Payment records: 7 years (US tax law)
• Uploaded 3D models and images: while your booth is active, plus 30 days

6. Your rights

You can request:

• A copy of all personal data we hold on you
• Correction of inaccurate data
• Deletion ("right to be forgotten") — we'll remove what we legally can within 30 days
• Withdrawal of consent for any optional data use

Email [email protected] with your request. We may ask you to verify your identity before processing.

7. Children

The Expo is intended for medical professionals and business buyers. We do not knowingly collect information from anyone under 18. If we discover such data, we'll delete it immediately.

8. International users

The Expo is hosted in the United States. If you access from outside the US, you consent to your data being processed in the US. We comply with the EU GDPR on request for EU residents — see section 6 for how to exercise your rights.

9. Security

We use TLS 1.3 for all traffic, signed session cookies, HMAC-secured magic links for admin access, and PostgreSQL on a private network. Despite our efforts, no system is perfectly secure; if we discover a breach affecting your data, we'll notify you within 72 hours.

10. Changes

We may revise this policy. Material changes are announced via the email on file at least 14 days in advance.

11. Contact

[email protected] for privacy questions, [email protected] for everything else.