Privacy Policy

Three kinds of people appear in the platform, and this policy covers all of them.

• Your attendees. The people you invite to an event. They never create an account with us.
• Your staff. Administrators and hosts who sign in to run the event.
• Visitors to this website. Covered in section 12, and the short answer is that we collect nothing.

In data protection terms you are the controller and we are the processor. That is not a formality, it decides who gets to make which call.

• The attendee list is yours. You gather it and you decide who is on it
• We handle it to run your event, on your instructions, and for nothing else
• You decide how long it is kept. You can erase an attendee yourself, and we delete the rest when you ask
• If an attendee asks us directly to delete their data, we point them at you, because it is not our decision to make on your behalf

What we do not collect. Attendee records never hold an IP address, a device fingerprint, browsing history or an exact location. The place we keep is approximate, to the city, never an address or coordinates. We have no visibility of anything an attendee does outside your event.

Attendee data reaches us in one of four ways, and only these four:

• Your own registration system posts it to the endpoint we give you
• Your administrator adds or imports it in the organiser panel
• The event page itself, while an attendee uses it: when they came and left, the device and browser it runs on, and roughly where they are, worked out from the address their connection comes from, which we never keep
• The attendee, through their private link: what they type into a form you send them, and the documents they hand in

We never buy lists, and we never obtain data about your attendees from anybody but you and the attendee’s own visit.

Six things. This is the complete list, not an illustrative one.

• Sending the invitation and reminder emails you have written, and telling an attendee when a document they handed in was not accepted
• Letting an attendee into your event through their private link
• Showing your hosts who is in the room while a session runs
• Producing your attendance reports and exports, including what people watched on and roughly where they were, and what they told you on forms
• Checking the documents attendees hand in against the rule you wrote, writing down what they show, and answering your staff’s questions about them, with an AI model
• Running the campaigns you design: waiting, sending the emails you have written, setting fields, and asking an AI model about an attendee’s documents

There is no secondary use, and no use that benefits us rather than you.

How documents are read. An AI model decides whether a document meets your rule. It runs for us inside Amazon Web Services, in the United States, and is not trained on what it is sent. When it reads a document, it sees the document, your rule and the attendee’s name, and nothing else about them. It has no way to act on anything. The attendee is told only what is wrong or missing. Your staff see every decision and its reason, so a person can always check one. If you do not want it, ask and we turn it off for your whole organisation.

How campaigns use it. When one of your campaigns asks the model about an attendee, it also sees the fields you hold about them: what your registration system sent, what they told you on forms, and what was found before. They are given to it as records, not as instructions. Its answer can decide which way your campaign goes for that person, such as which email they get next, and no person checks it first. Your staff see every answer and every step in the attendee’s campaign log, and can stop a campaign for anyone.

Running live video needs infrastructure we do not own. These are the only companies that can ever touch your data. Each acts on our instructions, under contract, and none of them receives it for their own purposes.

The Zoom row is worth reading twice. When you deliver a session through Zoom, the registration is created in your Zoom account using your credentials. Those attendees become registrants in a tenant you already control, under the agreement you already hold with Zoom. If you never enable Zoom delivery, no attendee data reaches Zoom at all.

We will tell you before adding a sub-processor, so you have the chance to object.

• We never sell or rent your data, to anyone, at any price
• We never share it for advertising, profiling or audience building
• We never use it to train machine learning models, ours or anybody else’s
• We never let one client’s data reach another. Every record carries the organisation it belongs to and every query is scoped to a single one
• We never read your event content for our own purposes. Sessions are not recorded by the platform unless you turn recording on yourself

We are a Canadian company and your data is stored in the United States. That is a deliberate disclosure, not a detail.

While it is in the United States it is subject to United States law, including lawful access requests by American authorities, in the same way data held in Canada is subject to Canadian law. No jurisdiction can be contracted away, and a provider telling you otherwise is overselling.

Your data is held under the same protections wherever it sits, and our agreements with sub-processors require the same of them.

If you need data kept in Canada, or in any particular region, raise it before you sign. Some public bodies and health organisations have residency rules they cannot waive. This is an infrastructure decision rather than a setting, so it is a conversation to have early.

Operational logs record that a request happened, not what your attendees did. They keep the IP address each request came from, for security and to fix faults, and expire with the log. When your contract ends, tell us and we will remove what is left.

• Encrypted in transit with TLS, and encrypted at rest in the database and in storage
• Attendees have no account and no password. They get a private link to a single event, so there is no credential to steal
• Your staff sign in through Amazon Cognito. We never see, handle or store their passwords
• Credentials and API keys are held in AWS Secrets Manager, never in our code
• File storage is private with all public access blocked, and the database is not reachable from the internet
• We will tell you without delay if a breach affects your data, so you can meet your own notification obligations

If you are an attendee and want your data seen, corrected or deleted, contact the organisation that invited you. They hold the relationship and the decision. We cannot identify you to them, and we will not act on their data without their instruction.

If you are a client, most of this is in your own hands: the organiser panel exports attendee records, and erases an attendee for good, with their documents and answers. For anything else it does not cover, including a request you have received and need help answering, email contact@parallaxevents.com. We respond within 30 days, which is the limit PIPEDA sets.

The platform is sold to organisations for professional events and is not directed at children. We do not knowingly collect data about anyone under 16. If you intend to run events for a younger audience, raise it with us first so the right safeguards and agreements are in place.

Somebody is accountable by name. Canadian privacy law requires an organisation to put one person in charge of it rather than leaving it to everyone in general. Ours is reachable at contact@parallaxevents.com, and a request marked for the Privacy Officer reaches them.

As a company in British Columbia we are subject to Canada’s PIPEDA and British Columbia’s PIPA. Where your own organisation is bound by something else, GDPR, HIPAA, FERPA or a sector rule of your own, tell us during procurement so it can be written into the agreement rather than discovered later.

If we get it wrong, complain. Come to us first and we will answer. If our answer does not satisfy you, you can take it to a regulator without our permission and without going through us:

• The Office of the Privacy Commissioner of Canada
• The Office of the Information and Privacy Commissioner for British Columbia
• Your own country’s data protection authority, if you are outside Canada

These agreements are governed by the laws of British Columbia and the federal laws of Canada that apply there.

This is version 1.3, effective 8 November 2026. The version and date at the top of this page always say which one you are reading.

We will tell clients before a change that materially affects how their data is handled, rather than quietly republishing the page.

Privacy questions, security questionnaires and compliance reviews all go to the same place:

contact@parallaxevents.com

If your compliance team needs a data processing agreement, a security questionnaire completed, or answers specific to your jurisdiction, ask and we will work through it with you.