Privacy Policy

Last updated: 29 October 2026

1. Who we are and what this policy covers

Stageflow ("Stageflow", "we", "us") provides an event management platform at stageflow.eu: a back office for event organisers and a white-label platform for attendees (registration, programme, networking, live sessions and related features).

This policy explains how personal data is processed under the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Our role depends on the situation:

Stageflow as controller. We decide why and how we process data about visitors of our own website, organiser accounts and billing, support and contact requests, newsletters, and the security and analytics of our own services (sections 2 to 4).
Stageflow as processor. When an organiser uses Stageflow to run an event, the organiser decides why and how attendee, speaker and registrant data is used. The organiser is the controller, and Stageflow processes that data only on the organiser's documented instructions (section 5). Where the organiser is an agency acting for a client, the client is the controller, the agency is the processor and Stageflow is its sub-processor. The organiser's own privacy notice for the event explains that processing and prevails for it.

Contact for any privacy question: contact@stageflow.eu

2. Data we process as controller

Who	Data	Why	Legal basis (Art. 6 GDPR)
Visitors of our website	IP address, browser and device data, pages visited, referrer	Operate and secure the site; measure audience (see section 7)	Legitimate interests (security, service operation); consent for analytics cookies

| Organiser accounts (team members) | Name, email, password hash or sign-in provider ID (Google, GitHub), profile picture, team and role, activity logs | Create and run your account, provide the service, protect it against abuse | Contract (Art. 6(1)(b)); legitimate interests | | Customers | Billing name and address, subscription and invoice data (card details are handled by our payment providers, not by us) | Invoicing, payments, accounting | Contract; legal obligation (Art. 6(1)(c)) | | People who write to us | Name, email, message content | Answer questions and support requests | Legitimate interests; contract | | Newsletter and waiting-list subscribers | Email address, name | Send product news you asked for | Consent (Art. 6(1)(a)); withdraw any time | | Users of the platform | Session and security logs, error logs | Keep the service secure and working, prevent fraud | Legitimate interests |

If you do not provide the data needed to create an account or to pay, we cannot provide you the service.

We do not sell personal data. We do not make decisions about you based solely on automated processing that has legal or similarly significant effects.

3. Where the data comes from

Directly from you; from your sign-in provider if you use Google or GitHub (name, email, profile picture); from your browser (technical data); and, for event data, from the event organiser or from you when you register for an event.

4. Who receives data (sub-processors and other recipients)

We share data only with providers that help us run Stageflow, under written data-protection agreements, and only what they need:

Hosting and databases: cloud infrastructure providers that host the application and the database.
File storage: S3-compatible object storage for uploaded images, documents and generated PDFs (DigitalOcean Spaces, Frankfurt, Germany; Wasabi, Zürich, Switzerland).
Email delivery: transactional emails (account, registration, reminders) are sent through Resend or an SMTP relay. Newsletter and waiting-list emails use Brevo.
Payments: Stripe and Lemon Squeezy process subscription payments.
Video sessions: online sessions run on our own Jitsi server (jitsi.stageflow.eu). Audio, video, display names and chat messages are processed to run the session. Third-party analytics in Jitsi are disabled.
Analytics: our own Matomo installation (see section 7).
Support chat: a chat widget provided by Tawk.to is available on event platform pages (see section 7).
Authorities and advisers: where the law requires, or to establish, exercise or defend legal claims.

Event organisers receive the data of people who register for their event, as controllers (section 5). When you choose to appear in a participant list or to book a meeting, other participants of that event can see the data you agreed to share.

5. Event data: Stageflow as processor

For attendee, speaker and registrant data, the organiser is the controller. We act on their instructions, keep this data logically separated per event, apply the security measures in section 9, use only the sub-processors in section 4, and help organisers answer data-subject requests.

If you want to exercise your rights over event data, contact the organiser (their notice names the contact). If you write to us, we forward your request to the organiser without undue delay. We delete or return the event data at the end of the service, following the organiser's instructions, unless the law requires us to keep it.

6. International transfers

We favour providers in the European Union and Switzerland (which has an EU adequacy decision). Some providers (for example email delivery, support chat and payment providers) are or may be located outside the European Economic Area, notably in the United States. Such transfers rely on an EU adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the safeguards at contact@stageflow.eu.

7. Cookies and similar technologies

We use only the cookies needed to run the service unless you agree to more. You can change your choice at any time: on event platforms, use the "Open Cookie Settings" button on the event's Cookie Policy page (linked in the event footer). You can also delete cookies in your browser settings.

Essential cookies (always on): sign-in session, language, cookie-consent choice, selected team. They are required for the service and do not need consent.
Analytics cookies (only with your consent): we use Matomo, hosted on our own servers, to understand how the service is used. It sets the cookies _pk_id, _pk_ses, _pk_ref, _pk_cvar and _pk_hsr. Withdrawing consent stops the tracking script and removes these cookies.
If you decline analytics cookies, no analytics cookie is set. We may still count the page view without any cookie: the page address, title, referrer, browser user-agent and IP address are sent to our own Matomo server for aggregate statistics, based on our legitimate interest. You can object at any time at contact@stageflow.eu.
Support chat: on event platform pages, the Tawk.to chat widget is loaded. It can set its own cookies and receives your IP address, browser data and the messages you send. Do not put sensitive information in the chat.
Embedded content (for example YouTube live streams or Slido polls, where an organiser adds them): the provider can process your IP address and set cookies once the content is displayed.

8. How long we keep data

Account data: while your account is active, then deleted or anonymised after closure, except what we must keep by law.
Billing and accounting records: up to 10 years, as required by French commercial and tax law.
Support requests: for as long as needed to handle the request and a reasonable period after, in case of follow-up.
Newsletter data: until you unsubscribe.
Security and server logs: for a limited period needed for security and troubleshooting.
Analytics cookies: up to 13 months.
Event data (as processor): as set by the organiser, and deleted or returned at the end of the service.

9. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), password hashing, role-based access control, separation of data per event and team, restricted staff access, and contractual commitments from our sub-processors. No online service is completely secure. If a personal data breach is likely to put your rights at risk, we notify the competent authority and, where required, the people concerned and the controller.

10. Your rights

Under the GDPR you have the right to:

access your data and get a copy;
have inaccurate data rectified;
have your data erased in the cases provided by law;
restrict processing in the cases provided by law;
object to processing based on legitimate interests, on grounds relating to your situation, and at any time to direct marketing;
receive the data you provided in a structured, commonly used format (portability) where processing is based on consent or contract;
withdraw consent at any time, without affecting processing done before withdrawal.

To exercise these rights, write to contact@stageflow.eu. We may ask you to prove your identity. We answer within one month, which can be extended by two months for complex or numerous requests, and we tell you if so.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live, work, or where the alleged infringement took place. We would appreciate the chance to address your concern first.