Privacy policy

Preliminary version, subject to legal review before launch.

This Privacy Policy is effective from 9 October 2026. It explains what personal data StandSense collects through its website and platform, why we use it, who we share it with, how long we keep it and what rights you have.

1. Who we are

StandSense is a B2B software platform for trade-show exhibitors and live-marketing agencies, operated by StandSense from Barcelona, Spain. You can contact us about privacy, including to exercise your rights, at privacy@standsense.eu.

This policy follows the EU General Data Protection Regulation (GDPR) as its baseline. It also covers the rights of people in Brazil under the Lei Geral de Proteção de Dados (LGPD).

2. Our role: controller or processor

StandSense has two different roles, depending on the data:

Controller. We decide how and why data is used for account data, billing data, usage and security logs, and contact-form and newsletter submissions. This policy applies in full to that data.
Processor. For customer content, meaning the floor plans and event data that a customer organisation uploads or enters, we act on behalf of that customer. The customer is the controller and decides what is uploaded. If you have questions about personal data inside customer content, please contact the organisation that uses StandSense. We will help it respond.

3. What data we collect

Account data: name, work email, company and role.
Organisation data: the organisation you belong to, your team membership and permissions.
Customer content: uploaded floor plans and the event data you enter, such as the briefing, objectives, budget ranges, team size and post-event results.
Usage and security logs: sign-in events, actions in the platform, IP address, browser and device information, and error records.
Website analytics (with your consent): page views, button and form interactions, approximate location derived from IP, browser and device information, and (via Microsoft Clarity) anonymised session recordings and heatmaps. These are collected only if you accept analytics cookies.
Contact and newsletter data: name, email, company and the message you send us.
Billing data: plan, invoices and payment status. Card details are collected and handled by Stripe only; we never see or store full card numbers.

We do not ask for special categories of personal data, and we ask customers not to upload them.

4. Why we use your data and on what legal basis

To provide the service, create and manage accounts, run the analysis you ask for and support you. Legal basis: performance of a contract.
To process payments and keep accounting records. Legal basis: performance of a contract and compliance with legal obligations.
To keep the platform secure, prevent abuse and fix errors, using usage and security logs. Legal basis: our legitimate interest in protecting the service and our customers.
To answer enquiries sent through the contact form. Legal basis: steps taken at your request before a contract, or our legitimate interest in replying.
To send our newsletter. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link or by writing to us.
To send transactional emails, such as sign-in messages, invitations and billing notices. Legal basis: performance of a contract.
To improve our models, using post-event results only in anonymised or aggregated form and only where the customer's contract opts in.
To understand and improve the website, using analytics tools only with your consent, which you can withdraw at any time from Cookie preferences.

Customer content is confidential. We use it only to provide the service to the customer that uploaded it. We do not sell personal data and we do not use it for advertising.

5. Artificial intelligence

The platform uses Amazon Textract to read text from floor-plan images, and Amazon Bedrock, running Anthropic Claude models, to analyse plans and generate booth strategies. Under the applicable AWS terms, customer data sent to these services is not used to train the models. AI outputs are recommendations and do not produce decisions with legal or similarly significant effects on individuals.

We use trusted service providers that process data on our instructions and under data processing agreements:

Amazon Web Services: hosting and infrastructure, including Amazon Cognito for authentication, Amazon S3 for file storage, Amazon Textract for reading text from images, Amazon Bedrock for AI analysis and Amazon SES for transactional email.
Stripe: payment processing and subscription billing.
Google (Google Analytics 4): website analytics, only if you accept analytics cookies.
Microsoft (Clarity): session recordings and heatmaps, only if you accept analytics cookies.

We may also disclose data where required by law, to protect our rights or the safety of users, or as part of a business transaction such as a merger, subject to appropriate confidentiality safeguards. When a customer creates a public share link, the shared plan is visible to anyone with the link until it expires or is revoked.

7. Where your data is stored

Platform data is hosted by Amazon Web Services in the European Union, in the eu-west-1 region (Ireland) or the eu-south-2 region (Spain). Some providers, such as Stripe, may process data outside the European Economic Area. In those cases we rely on appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

8. How long we keep data

Account data: for as long as the account is active, and afterwards for as long as legal obligations require, for example for tax and accounting.
Uploaded files and event data: until the customer deletes them or closes the account. They are then removed from active systems within a reasonable period, normally 30 days. Backups expire on their own cycle.
Contact and newsletter data: until you unsubscribe or the enquiry is closed.
Billing records: for the period required by tax and accounting law.
Security logs: for a limited period needed to protect the service.

9. Security

We protect data with measures appropriate to the risk, including encryption in transit and at rest, access controls based on organisation and role, managed authentication and logging. No system is completely secure, but we work to prevent unauthorised access and will notify customers and authorities of personal data breaches as required by law.

If the GDPR applies to you, you have the right to:

access your personal data and receive a copy;
correct inaccurate or incomplete data;
request deletion of your data;
restrict or object to certain processing, including processing based on legitimate interest;
receive your data in a portable format;
withdraw consent at any time, without affecting earlier processing.

To exercise these rights, write to privacy@standsense.eu. We will reply within one month, which can be extended where the law allows. You also have the right to complain to a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD); you can also contact the authority in your own country.

11. Your rights under the LGPD (Brazil)

If you are in Brazil, the LGPD gives you the right to:

confirmation that we process your data, and access to it;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
portability of your data to another provider;
deletion of data processed on the basis of consent;
information about the entities with which we share data;
information about the possibility of refusing consent and its consequences;
withdrawal of consent;
review of decisions taken solely on the basis of automated processing.

To exercise these rights, or to reach the person responsible for data protection matters (encarregado), write to privacy@standsense.eu. You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

12. Cookies

We use a small number of cookies to keep you signed in, protect forms, remember your language and store your cookie choices. Our Cookie Policy describes them in detail.

13. Children

StandSense is a professional service and is not directed at children. We do not knowingly collect data from anyone under 16.

14. Changes and contact

We may update this policy as the service evolves. If changes are significant, we will let customers know by email or in the platform. Questions or requests can be sent to privacy@standsense.eu.