Privacy Notice

Apoorv Kohli, C20 Shakti Nagar Extension, Delhi-110052, India, operates ExAi. For the Attendee / Individual attendee product, account administration, service security and beta operations, this operator is the data controller. For organizer-owned events, the organizer normally controls registration and event data and ExAi acts as its processor. For exhibitor booth interactions, the identified exhibitor normally controls lead and follow-up data and ExAi acts as its processor. Contact apoorv@sessionguide.live.

Depending on the journey, we process account details; organization and event roles; professional profile information; event plans, notes, tasks and saved items; booth form answers and interaction activity; meeting details; support communications; consent and legal-acceptance records; uploaded content; AI prompts, outputs and evidence; security information such as IP address, user agent and timestamps; and information returned by email-verification or public-source enrichment services. The beta does not intentionally collect payment data.

We process data to provide requested accounts, workspaces, events, booths, meetings and AI features; secure and troubleshoot the service; honor consent choices; respond to privacy requests; and comply with law. Depending on context, the basis is performance of the beta terms, consent, the organizer or exhibitor controller's documented lawful basis, legal obligation, or legitimate interests in operating and securing a limited beta. Consent is used for exhibitor contact sharing, profile sharing and AI personalization where the product asks for it.

Organizer / Attendee data belongs to the organizer-controlled event journey. Exhibitor / Attendee data belongs to the specific booth and exhibitor journey. Attendee / Individual attendee workspaces are private to the individual. ExAi does not merge these journeys merely because the same person uses more than one.

When separately accepted, ExAi may use a name, work email, company, professional context, form answers and event activity to find relevant public professional information and generate recommendations or lead intelligence. AI output is probabilistic and must be reviewed by a person. More detail appears in the AI Data Policy.

Data may be processed by Supabase for authentication, database and storage; Resend only to deliver authentication messages; Clearout for email verification; and Google Gemini for configured AI generation and embeddings. Organizers and exhibitors receive only data within their authorized journey and consent scope. We may also disclose data when legally required or to protect the service and its users.

The service is operated from India and processors may handle data in other countries, including the United States and European Economic Area. Where GDPR transfer restrictions apply, the responsible controller must use an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and make applicable safeguards available on request.

Pending invitation and verification data is removed after seven days. Visitor access sessions expire after 24 hours and expired session records are purged. Event-intelligence identity and enrichment sessions are retained for up to 90 days. Lead submissions are retained for up to 365 days. Security audit records are retained for up to 365 days. Consent receipts and completed privacy-request records are retained for up to three years. Individual attendee workspaces remain until the account is deleted or the user clears them. Unsynced offline captures remain on the local device for no more than seven days and are removed immediately after successful sync.

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability and may withdraw consent without affecting earlier lawful processing. Account holders can export or erase account data in Settings. Anyone, including booth visitors without an account, can use the privacy request form. You may also complain to the competent data-protection authority in your country.

ExAi uses tenant isolation, authorization checks, encrypted transport, signed file access, restricted production demo routes, request throttling, security headers and audit records. No system is completely secure. Confirmed personal-data incidents will be assessed and notified when applicable law requires it.

ExAi is only for people aged 18 or older. Material changes receive a new effective date and, when needed, renewed in-product acknowledgement.