Privacy Policy

We take the protection of your personal data seriously. This policy explains what data we collect, how we use it, and your rights under GDPR.

Effective date: October 16, 2026

1. Data Controller

Trade Show PRO is operated by Berg & Berg Expo Software AB (Swedish company registration number 559571-5029), a limited company registered in Sweden.

Contact: hello@tradeshowpro.events

2. What Data We Collect

Account Information

Name, email address, and password (hashed) when you create an account. Your employer/company name and role within your organization.

Business Card Photos

Photos of business cards captured through the mobile app for AI-powered contact extraction. Photos are processed and then stored on our servers for reference.

Scanned Contact Data

Contact information extracted from business cards: name, company, title, email, phone number, and any notes added by your team.

Meeting Bookings by Visitors

When a visitor books a meeting with an exhibitor on a Trade Show PRO booking page, we store the details they enter: name, email address, company and title, and optionally a phone number and a message. The booking is added to the exhibitor's contacts. We do not store the visitor's IP address with the booking.

Material Shared With Visitors

Exhibitors upload files and links that they share with visitors after a conversation. For each share we store which material was shared, the exhibitor's note, the visitor's email address if the material was sent by email, and when the page and each file were opened. We do not store the visitor's IP address or browser with these opens.

Usage & Analytics

We collect basic usage data such as login timestamps, feature usage patterns, and device information to improve the service. We do not use third-party analytics or tracking tools. Our servers log each request, including IP address and browser, for security and troubleshooting. These logs are kept for 90 days.

3. How We Process Your Data

AI-Powered Card Scanning

When you scan a business card, the image is sent to Anthropic's Claude Vision AI API for text extraction. Anthropic processes the image to extract contact information and returns the structured data to us. According to Anthropic's data policy, API inputs and outputs are not used to train their models and are not stored beyond the processing request.

Transactional Email

We use Resend to deliver email: account emails such as password resets and invitations, confirmations with a calendar invite to visitors who book a meeting, and material emails sent to visitors on an exhibitor's behalf. Resend processes the email address and the content of the message to deliver it.

Visitor Data We Process for Exhibitors

Scanned contacts, meeting bookings and shared material concern the visitors an exhibitor meets. For this data the exhibitor (the company using Trade Show PRO) is the controller, and we process it on the exhibitor's behalf. The booking page and the material page name the exhibitor and link to the exhibitor's privacy policy when one has been provided. Visitors who want to exercise their rights should contact the exhibitor, and we help the exhibitor respond.

Spam Protection on Booking Pages

Booking pages use Cloudflare Turnstile to stop automated bookings. Turnstile receives the visitor's IP address and information about the browser for this check.

4. Legal Basis for Processing

Contract performance (GDPR Art. 6(1)(b)) — Processing necessary to provide the Trade Show PRO service you signed up for, including account management, data storage, and business card scanning.
Legitimate interest (GDPR Art. 6(1)(f)) — Basic usage analytics to maintain and improve service quality and security, and to prevent abuse.

5. Data Storage & Security

All data is stored on Hetzner servers located in Germany (EU). Data is encrypted in transit using TLS 1.3 and at rest on encrypted storage volumes.

Each company's data is strictly isolated through tenant-level access controls. No cross-company data access is possible.

6. Data Retention

Your data is kept for as long as your account is active. When you delete your account, all personal data is permanently removed from our systems. Business card photos and extracted contact data are deleted together with the account.

Links to shared material are valid for 180 days. When a link has been expired or revoked for 90 days, the record of when it was opened and the visitor's email address on it are deleted. Meeting bookings and visitor contacts are kept as long as the exhibitor keeps the event, and are deleted with it.

Encrypted backups may retain deleted data for up to 30 days before automatic purging.

7. Third-Party Processors

We share data with the following third-party processors, all of which are GDPR-compliant:

Anthropic (USA): AI processing of business card images. Data processed under Standard Contractual Clauses (SCCs) for EU–US transfers.
Resend (USA): Email delivery, including meeting confirmations and material emails to visitors. Processed under SCCs.
Cloudflare (USA): Network protection and delivery for our websites, and Turnstile spam protection on booking pages. Cloudflare sees the IP addresses of visitors to our websites. Transfers under the EU-U.S. Data Privacy Framework and Cloudflare's data processing addendum with SCCs.
Expo (USA): Delivery of push notifications to the mobile app through Apple and Google. A notification can include a visitor's name, for example when a meeting is booked or material is opened. Transfers under the EU-U.S. Data Privacy Framework.
Google (USA): Google Workspace provides our support inbox. Messages sent to support are stored there. Transfers under the EU-U.S. Data Privacy Framework and Google's data processing addendum with SCCs.
Hetzner (Germany): Infrastructure and data hosting. All data remains within the EU.

8. Your Rights

Under GDPR, you have the right to:

Access — Request a copy of your personal data
Rectification — Correct inaccurate personal data
Erasure — Request deletion of your personal data
Portability — Receive your data in a structured, machine-readable format
Restriction — Request limited processing of your data
Objection — Object to processing based on legitimate interest
Withdrawal — Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at hello@tradeshowpro.events. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

9. Cookies

We use only essential, session-based cookies for authentication (JWT tokens stored in memory/localStorage). We do not use tracking cookies, advertising cookies, or any third-party analytics cookies.

10. Children's Privacy

Trade Show PRO is a business tool and is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the app or email. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, contact us at:

hello@tradeshowpro.events