Privacy Policy

1. Who we are

The Trade Show Companion website and product are operated by Sandstone Systems F.Z.E, a Free Zone Establishment registered in the Ajman Free Zone, United Arab Emirates, under Licence and Registration No. 55415. For data you send us through this website, for the operation of the free trial and for the accounts of paying customers (billing account, admin and billing contacts, invoices, payments and acceptance records, see section 7) we are the data controller. For CRM content that customers and trial users capture about third parties (for example scanned business cards), and for the user accounts and change log of a workspace, the customer is the controller and we process that data on their behalf under the Data Processing Agreement. You can reach us at [email protected]. This policy applies to everyone who visits the website, uses the free trial or works in a paid workspace, wherever in the world you are; where your local law gives you specific rights, for example under the UAE Personal Data Protection Law or the EU and UK GDPR, this policy is written to respect them.

2. What we collect

Website visits. Standard technical server logs (IP address, time of request) for security and operation, and anonymous usage statistics for the website: which pages are visited and for how long, roughly where visitors come from, and which links are clicked. For these statistics we use Cloudflare Web Analytics. It sets no cookies, stores no IP addresses and builds no personal profile; the numbers are aggregate.

Trial signup. Company name, your name, business email address, optionally your company website, the trade fair you attend, your IP address, and a record of your acceptance of the Terms of Service (version and timestamp). A six-digit code is sent to your email address to verify it; login links are sent to the same address.

Company research (trial). If you provide your company website, we look up publicly available information about your company (for example what you sell and your industry) through an AI research provider to preconfigure your workspace. The input to that lookup is your company name and website address.

Using the trial. The CRM content you and your team create: leads, contacts, companies, notes, reminders, scanned business cards, voice notes and their AI-generated transcriptions and extractions. This content is processed to provide the product.

Usage activity. When you work in a cloud workspace we record, per person, the time of your last activity, whether you used the web app or the mobile app, and the country you connected from. We use this to operate the service, for example to schedule maintenance when nobody is working. We do not store your IP address for this, and each new record replaces the previous one, so no history is kept.

Demo requests. Name, email, company and your message.

Campaign links. If you open a fair-specific signup link, we record anonymous funnel events (which step of the signup was reached) keyed by a hashed session identifier. No IP address and no personal profile is stored with these events.

3. Cookies

The website itself sets no tracking cookies. Website usage statistics are collected without cookies (section 2). The product (signup and trial) uses strictly necessary session cookies for login, security (CSRF) and the signup flow. There is no advertising or cross-site tracking.

4. Why we use it, and our legal basis

We use signup and trial data to provide the trial you requested (performance of a contract; GDPR Article 6(1)(b) where it applies), to verify your email and secure the service (legitimate interest; Article 6(1)(f)), to enforce the one-trial-per-company rule (legitimate interest), and to respond to demo requests you send us (steps at your request). Under the UAE PDPL we rely on the equivalent grounds. We do not use your data for advertising and we do not carry out automated decision-making with legal effect. AI features process the content you submit to them solely to produce the requested output; our AI providers do not use this content to train their models.

5. Who we share it with

We use a small number of service providers to run the website and the product:

• Hosting: Contabo GmbH (Germany).
• Network and security: Cloudflare, Inc. (global network) delivers the marketing website and sits in front of the product as reverse proxy, firewall and bot protection. Connections to the product are encrypted up to Cloudflare and again from Cloudflare to our servers. Cloudflare also provides the website's anonymous, cookieless usage statistics (section 2).
• Email delivery: Resend (transactional email such as verification codes and login links).
• Push notifications: Google (Firebase Cloud Messaging) delivers notifications to the mobile app; on iPhones they are passed on to Apple's push notification service.
• Payments: Stripe, Inc. and its affiliates (payments and invoicing for paid subscriptions, see section 7). Stripe does not receive your CRM content.
• AI processing: requests to AI features are sent to the respective model providers (currently OpenAI, Anthropic and Perplexity) strictly to produce the requested output.

We do not sell personal data. We may also disclose data where we are required to by law.

6. Connected calendar accounts (Google and Microsoft)

If you choose to connect your Google Calendar or Microsoft Outlook calendar, we access your calendar through the Google Calendar API and the Microsoft Graph API using OAuth. We request read and write access to your calendar (Google scope calendar.events; Microsoft Calendars.ReadWrite).

We use this access solely to sync your meetings, demos and follow-ups into your own workspace, to show them alongside the relevant leads, and, only where you ask us to, to create or update events. Access tokens are stored encrypted and are used only for this purpose. You can disconnect a calendar at any time in the app, which removes the linked calendar data. Events you mark as Private in Google or Outlook are never shared with your team.

We do not sell this data, we do not use it for advertising, and we do not use it to train AI models.

Trade Show Companion's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Paying customers

This section applies when your company buys a paid plan. For this data we are the data controller. CRM content you store in your workspace is a different matter: there you are the controller and we process it on your behalf under the Data Processing Agreement.

What we collect. The billing contact (name and email address), your company name and billing address, your tax identification number where you give us one, the plan and number of seats, and our invoices and payment records.

Card payments through Stripe. Payments are processed by Stripe, Inc. and its affiliates as an independent provider. You enter your card details on Stripe's own payment pages, and Stripe processes them under its own privacy policy. We never see or store your full card number. We receive only the card brand, the last four digits and the expiry date, together with the status of each payment. Stripe also sends you receipts and payment emails on our behalf.

Why we use it. To set up and bill your subscription, send invoices, collect payment, handle failed payments and meet our tax and accounting duties (performance of a contract and legal obligation; GDPR Article 6(1)(b) and (c) where it applies).

Acceptance records. When someone accepts the Terms of Service or the Data Processing Agreement for your company, we keep a record as evidence: the version accepted, the time, the IP address and the person who accepted. Admins can see these records in the product. We keep them as long as the agreement exists and for as long afterwards as we may need them to prove what was agreed (legitimate interest; Article 6(1)(f)).

8. International transfers

We are established in the UAE and our servers are in the EU; some providers above are located elsewhere, for example in the United States. Where personal data is transferred across borders we limit it to what is necessary and rely on appropriate safeguards. You can ask us for more detail at [email protected].

9. How long we keep it

• Trial CRM data: for the trial (one month from signup and, where applicable, the fair window from one month before until two weeks after the fair, including a pause in between), the read-only period (14 days) and a dormant period of up to 6 months. Then the workspace database is permanently deleted. Files uploaded to the workspace, such as attachments and photos of business cards, are not yet deleted automatically at that point; we delete them on request to [email protected].
• Signup registry: the email address you signed up with and its domain, the company name, the trade fair you confirmed and the record of your terms acceptance (version, time and IP address) are retained permanently as proof of acceptance and to enforce the one-trial-per-company rule.
• Billing records: invoices, payment records and the data on them (billing contact, company details, tax identification number) for the periods that tax and accounting law require us to keep them, then deleted.
• Acceptance records: version, time, IP address and person for each accepted agreement, kept as evidence for as long as the agreement exists and for as long afterwards as needed to prove what was agreed.
• Usage activity: only the most recent record per person, deleted together with the workspace.
• Demo requests: as long as needed to handle your request.
• Server logs: short rotation for security and operations.
• Anonymous funnel events: retained in aggregate; they contain no personal data.

10. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict or object to our use of your personal data, and to receive it in a portable form or withdraw a consent you have given. To exercise any of these, email [email protected]. If you believe we have mishandled your data, you can lodge a complaint with your local data protection authority; in the UAE, that is the UAE Data Office.

11. Changes

We may update this policy as the product evolves. The current version is always available at tradeshowcompanion.com/privacy/.