Version 26-10-2026
Privacy notice
The short version
- We keep the minimum: your name, email, profile picture, preferences and saved events.
- Your email, name, notes and employer watch list are encrypted field by field. Admins see masked values.
- No advertising, no analytics trackers, no selling or sharing for marketing. Only strictly necessary cookies.
- You can download or delete everything from Settings → Privacy at any time.
- Our AI runs on our own server using open-source models. Your personal data is never sent to it.
- Nothing is ever posted to LinkedIn unless you write or approve the text and tick to confirm.
- You must be 18 or over to use Concourse.
Who is responsible
Concourse is operated by its owner as a private, invite-only service. The operator is the data controller (under India's DPDP Act, the “data fiduciary”). For any privacy question or request, use Report a problem and choose “Privacy request”, or use the self-service tools in Settings.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email, name, profile picture (from Google, LinkedIn or the email link) | Your account and sign-in | Contract | Until you delete the account, or 24 months of inactivity |
| Age and terms confirmation | Keeping under-18s out; record of acceptance | Legal obligation | As above |
| Preferences, followed categories, keywords, employer watch list | Ranking events for you | Contract | As above |
| Saved events, the days you plan to attend, and private notes | Your watchlist | Contract | As above |
| LinkedIn posting permission and member id (only if you connect it) | Posting what you confirm, as you | Consent | Until you turn it off or it expires |
| Email digest and alert choices, browser push subscription | Sending the alerts you asked for | Consent | Until you switch them off |
| Security records (sessions, two-factor for admins, audit log) | Keeping accounts safe; accountability | Legitimate interest | Sessions until expiry; audit log 12 months |
We don’t collect special-category data (health, religion, ethnicity, biometrics, political views, criminal records), government ID numbers or payment details. If any appears in content we collect from public event pages, it is removed before storage.
Event information about other people
Events come from public venue, organiser and news pages, newsletters we subscribe to, and links you share. We store facts about the event, our own short summary and a link back. We keep only role-based business contacts (such as an info@ address or a venue switchboard), encrypted. Personal mobile numbers and personal emails found on those pages are removed before storage.
Where your data is stored
Personal data is stored with Microsoft Azure in the UAE North (Dubai) region, where the web app and the collection jobs also run. It stays in the UAE. Each provider is bound by a data processing agreement.
| Provider | Role |
|---|---|
| Microsoft Azure (UAE North (Dubai)) | Stores account and event data; runs the web app and the collection jobs |
| GitHub | Stores the app’s software images (no personal data) |
| Google, LinkedIn | Sign-in, only if you choose them |
| Google (Gmail SMTP) | Sends sign-in links and digests |
How we protect it
- Encryption in transit (TLS) and at rest, plus AES-256-GCM encryption of each personal field.
- Emails are looked up through a keyed hash, so the plain address is never stored.
- Database access is locked down by row-level security; admins see masked values and every unmask is logged with a reason.
- Two-factor authentication is required for every admin.
Your rights
You can access, download, correct and delete your data, withdraw consent for alerts, and object to processing. Most of this is instant in Settings. Anything else, ask through Report a problem; we reply within 30 days. There is no automated decision with legal or similarly significant effect on you.
Jurisdiction-specific information
UAE (Federal Decree-Law 45 of 2021, PDPL)
You have the rights to information, access, correction, erasure, restriction, objection and portability under the PDPL. You may complain to the UAE Data Office.
DIFC (Data Protection Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021)
Where these regimes apply, you have equivalent rights and may complain to the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection. AI processing is described in our AI notice, in line with DIFC Regulation 10.
European Union (GDPR)
If the GDPR applies to you, you may complain to your local supervisory authority. Breaches likely to risk your rights are reported within 72 hours.
India (DPDP Act 2023 and Rules 2025)
You may access a summary of your data, correct or erase it, nominate another person to exercise your rights, and raise a grievance through Report a problem. If unresolved, you may approach the Data Protection Board of India. Concourse is not available to anyone under 18.
Changes
If we change this notice in a way that matters, we’ll tell you in the app before it takes effect.