Privacy Policy

WELCOME is a personal-networking profile service: one persistent profile with a reusable QR, event context and contacts under your control. For questions about privacy or data protection, contact nberezniker@gmail.com (subject: “WELCOME privacy”).

• Profile data you enter: display name, headline, company, short bio, languages, offer/need tags, and a random public slug that forms your public card URL.
• Contact fields (e.g. whatsapp, phone, telegram username, website, LinkedIn URL). They are encrypted at rest (AES-256-GCM, per-value IV). Your login email is never stored in plaintext — only a keyed hash used for lookup.
• Event data: memberships, directory visibility and matching preferences, attendance markers.
• Introductions: mutual introduction state between two attendees and each side’s decision on which (if any) fields to reveal. Contact values are released to the other side only after BOTH parties accept.
• Consent records: every grant and withdrawal, with purpose, scope, policy version and timestamp.
• Organizer imports: guest lists uploaded by event organizers (name, email and provided columns), stored encrypted/quarantined until a guest claims their record.
• Security records: audit trail of security-relevant actions; the actor is pseudonymized after account deletion.

• Providing the profile and public card — performance of a contract (the terms you accept by using the service).
• Event participation: joining, directory, recommendations — performance of a contract; you control directory visibility and matching per event.
• Introductions and revealing contact fields to another attendee — consent, given separately for each purpose and revocable at any time.
• Service messages through a linked Telegram channel — consent; the channel binding is created only through a two-sided confirmation flow, and /stop suppresses all queued sends immediately.
• Organizer marketing messages — consent, always scoped to a specific organizer event.
• Security, abuse prevention and audit — legitimate interest in keeping the service and its users safe (rate limiting, hashed credentials, audit trail).

The service sets exactly two first-party cookies and uses no third-party scripts or trackers: welcome_session (strictly necessary, HttpOnly, keeps you signed in) and welcome_locale (your interface language preference).

• Sessions: 30-day sliding TTL; expired sessions are deleted automatically.
• Login codes (OTP): stored only as hashes; deleted after 1 day.
• Link challenges (channel binding / invites): deleted 30 days after expiry.
• Message queue records (inbox/outbox): deleted 90 days after creation; the message text is stripped from delivered jobs earlier.
• Imported guest registrations that were never claimed: deleted 30 days after the event ends.
• Account deletion: deletion signs you out immediately and disables your public card at once; user data (profile, contacts, sessions, channel bindings) is physically purged after a 7-day grace window. Registrations uploaded by organizers remain the organizer’s data; consent records are kept (with a pseudonymized reference) as a legal record of what was permitted.

You can exercise the following directly in the app, without writing to us:

• Access / portability — “Export my data” produces a machine-readable JSON file with your profile, decrypted contacts, consents, memberships, introductions (with your own consent record), notes, blocks and reports.
• Rectification — edit your profile and contacts at any time.
• Erasure — “Delete account” in the Privacy section (typed confirmation required).
• Withdrawal of consent — purpose toggles in the Privacy section; withdrawing stops and suppresses future sends. In Telegram, /stop revokes the channel and clears the queue.

You may also contact us at nberezniker@gmail.com to exercise rights, lodge a complaint or ask questions. If you are in the EU/EEA, you can complain to your local data protection authority.

• Vercel Inc. — application hosting and edge network (deployment region: EU, Frankfurt).
• Neon — managed PostgreSQL database (region: EU, Frankfurt).
• Telegram — messaging channel, engaged only if YOU link your Telegram account; used to deliver notifications you consented to.

Subprocessors are kept to this minimum; the list may change with the product, and this section will be updated accordingly. Data is stored in the EU; support access may involve transfers protected by standard contractual clauses.

Contacts are encrypted at rest; login codes and session tokens are stored only as hashes; sensitive comparisons are constant-time; every mutating endpoint is guarded (same-origin checks, rate limits, object-level authorization). Vulnerabilities can be reported privately — see the repository’s SECURITY.md.

The policy is versioned; material changes will be announced in the app before they take effect. The current version applies to the P0 build described above.