EventLead privacy policy
Version of 15 November 2026.
1. Who we are
Quantum Liquid LLC, a company governed by the laws of Wyoming, 30 N Gould St, Ste R, Sheridan, WY 82801, United States of America, operates the EventLead service ("EventLead" or "the Service"). Contact for any question about personal data: hello@eventlead.io.
EventLead helps a business (the "Customer", also called the organiser) prepare an event to which it invites its own customers and contacts. In EventLead, the organiser brings together the guest lists of its groups or agencies, approves each guest, sends the invitations and tracks the registrations. EventLead does not buy data about people and does not sell any data.
This policy applies with regard to the Swiss Federal Act on Data Protection (Swiss FADP, revFADP), the General Data Protection Regulation (GDPR) for persons located in the European Union, the EEA or the United Kingdom (UK GDPR), and US state privacy laws, in particular the California Consumer Privacy Act as amended by the CPRA (CCPA).
2. Two different roles
EventLead processes data in two roles, and this policy distinguishes between them throughout.
| Data | Role of Quantum Liquid LLC | Who decides |
|---|---|---|
| Customer accounts (people who sign in to EventLead, subscriptions, settings, Service emails) | Controller | Quantum Liquid LLC |
| Event guests (identity, contact details, approval, invitations, registration replies) | Processor ("service provider" within the meaning of the CCPA) | The Customer, as controller |
For the guests of an event, the organiser is the controller. It is the organiser who chooses the people to invite, enters their data or has its groups enter it, writes the invitations and decides whether they are sent. EventLead acts on its instructions, under the terms and conditions. An invited person may contact the organiser or EventLead, which will forward the request to the organiser.
3. Customer data (EventLead as controller)
3.1 Account
EventLead does not manage passwords. Sign-in goes through the Lead account, the identity service shared by the Lead applications, which is managed in ERPlead (erplead.io). EventLead keeps the Lead account identifier, the email address, the name, the language, the organisation, the role, the plan and the associated rights, and the open sessions.
3.2 Subscription
For a Pro or Pro+ subscription, EventLead keeps the Stripe customer and subscription reference, the plan, its status and its dates. Card data remains with Stripe.
3.3 Sending settings
When the organiser chooses to send the invitations from its own mailbox, EventLead keeps the address of the outgoing mail server, the port, the username and the password of that mailbox. The password is encrypted in the database.
3.4 Service emails
Account emails and notices addressed to the organiser, for example the notice that precedes the deletion of an event, are sent by Resend. EventLead keeps a sending log with a fingerprint of the address, never the address itself, in order to cap sending and to take a bounce into account.
3.5 eventlead.io website
The eventlead.io website uses neither third-party analytics nor advertising cookies. To limit abuse, a fingerprint (HMAC) of the network identifier is kept for two days at most. The IP address itself is never recorded.
4. Guest data (EventLead as processor)
4.1 What the organiser records
For each guest, the organiser or one of its groups enters the first name, the last name, the company, the email address, the telephone number, the language, the expected category and, if desired, an internal note. This data comes from line-by-line entry or from an Excel or CSV file uploaded by the organiser or by a group. EventLead also keeps the group that proposed the guest, the guest's approval status and a change log, which shows who did what without copying the guest's data.
4.2 Who sees this data
Members of the Customer's organisation who sign in to EventLead see all the guests of their events. A group accesses, through a private link, only the guests it has proposed itself, and the person in charge of approval sees the guests of all groups. When two groups propose the same person, each group only learns that its guest has already been proposed by another group, without learning that group's name.
4.3 Invitations
EventLead prepares the invitations and the organiser sends them with one click. Depending on its choice, they are sent from its own mailbox, through the outgoing mail server it has specified, or from eventlead.io by Resend, with its address for replies. The content of each message is kept as it was sent, with its status (draft, sent, failed, bounced).
4.4 Registration
Each guest receives a personal link to their registration page. EventLead records there their reply (attending or not attending), their category, their answers to the questions asked by the organiser, the language and the date of the reply. The organiser chooses these questions and makes sure to ask only for what is useful for the event. After their first reply, the guest receives a confirmation by email.
4.5 What EventLead does not do
- Use guest data for its own purposes or for advertising.
- Sell or share guest data, within the meaning of the CCPA.
- Show a guest to another guest, or the guests of one Customer to another Customer.
- Write guest data to its technical logs.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service to Customers, collecting subscription payments | Performance of the contract (GDPR Art. 6(1)(b)) |
| Service emails (account, notices to the organiser) | Performance of the contract (Art. 6(1)(b)) |
| Limiting abuse, security | Legitimate interest (Art. 6(1)(f)) |
| Management of the guests, invitations and registrations of an event | Processing on behalf of the Customer (Art. 28 GDPR, Art. 9 revFADP). The Customer chooses its legal basis, generally its legitimate interest in inviting its customers and business contacts. |
6. Retention periods
- Event data (guests, messages, replies): up to 12 months after the date of the event, after which it is deleted. The organiser is notified by email 30 days beforehand. This setting is enabled by default for each event, and an organiser who disables it then decides the retention period itself.
- The organiser may delete at any time a guest, with their reply and messages, or an entire event with all its data.
- Account data: while the Service is used. It is deleted 30 days after all access ends, or earlier on request.
- Sessions: 12 hours.
- Fingerprints used against abuse: two days at most.
7. Processors
| Processor | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the application | Frankfurt region (Germany) |
| Neon (Databricks, Inc.) | Database | AWS eu-central-1 (Frankfurt) |
| Resend | Service emails, and invitations when the organiser chooses to send from eventlead.io | European Union and United States |
| Stripe Payments Europe | Subscription payments | Ireland and United States |
When the organiser sends the invitations from its own mailbox, the messages go through its email provider, which it has chosen itself and which is not a processor of EventLead.
8. Transfers abroad
The data is hosted in Frankfurt (European Union). Quantum Liquid LLC is established in the United States, and some processors may process data outside Switzerland and the EU/EEA. These transfers rely on the safeguards provided for by the revFADP and the GDPR, in particular the European Commission's Standard Contractual Clauses, with the Swiss addendum, and the Data Privacy Framework where the recipient is certified under it.
9. Your rights
Anyone can request access to their data, its rectification, its erasure, the restriction of processing and its portability, and object to processing based on legitimate interest. California residents also have the right to know what data is processed, to have it deleted or corrected, and not to be discriminated against for exercising these rights. EventLead does not sell or share personal data.
- You are invited to an event: contact the organiser who invited you. EventLead allows the organiser to export all the data concerning you and to remove you from the event. You can also write to hello@eventlead.io, and we will forward your request to the organiser and help it respond.
- You use EventLead with an account: write to hello@eventlead.io.
A complaint may be lodged with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), with the supervisory authority of the place of residence in the European Union, or with the California Privacy Protection Agency.
10. Cookies
On eventlead.io, only necessary cookies are used (session, language, currency, Lead account sign-in). Pages opened through a private link or a personal registration link set no tracking cookies.
11. Security
Encryption in transit (TLS), database encrypted at rest, access limited to the people who need it, secrets separated by use. Private links and personal links rely on a random token of which only the fingerprint is kept in the database. They can be revoked, and their pages are neither indexed nor cached. A data breach affecting a Customer's data is notified to that Customer without undue delay.
12. Changes
Any material change is announced on the website and, for Customers, by email or in the application before it takes effect.