1. Who we are

CredsNow LLC ("CredsNow", "we", "us") provides event credentialing software: the CredsNow Platform (including CredsNow Checkin), CredsNow Sessions and CredsNow LR (lead retrieval), available through our web applications and mobile apps. This policy explains how we handle personal information through those services and our website, credsnow.com.

CredsNow LLC, 4183 Wildcreek Road, Sandy, UT 84092. Email: security@credsnow.com.

2. Our two roles

We handle personal information in two different roles:

• On behalf of event organizers. When an event organizer (our "Customer") uses CredsNow for an event, we process attendee information on the Customer's behalf and only according to its instructions. The Customer owns that information and decides how it is used; the Customer's own privacy notice applies to it.
• For our own business. We also handle a limited amount of information for our own purposes, such as the accounts of people who use our applications and our communications with customers and prospects.

3. Information we process for event organizers

Attendee information. We receive attendee information from the registration platform the Customer designates (for example Stova, Cvent, Swoogo or Eventbrite) or directly from the Customer. This typically includes the name printed on the badge, email address, company, job title and other badge information the Customer chooses to provide. We also create records of badge printing, check-in, session tracking and access control (entry scans) when our services are used at the event.

Lead retrieval. When an exhibitor scans an attendee's badge with CredsNow LR, the exhibitor receives the attendee information the Customer has chosen to make available, and can add notes and answers to qualifying questions. Any additional information shown to the exhibitor is determined by the Customer.

If you attended an event and have a question or request about your information, please contact the event organizer. We will help the organizer respond.

4. Information we collect for our own purposes

Account information. If you have a CredsNow user account (for example as an organizer's staff member or an exhibitor), we collect your name, email address and login credentials. You sign in either with a CredsNow account or through our authentication provider, Auth0. We do not offer sign-in through social media accounts.

Payments. Purchases in CredsNow LR are processed by Stripe. Card details are entered directly into Stripe and never reach CredsNow's servers; we receive only confirmation of the transaction from Stripe.

Business contacts. If you contact us or do business with us, we keep the contact details you give us, such as your name, email address, phone number and company.

Technical information. Our systems automatically record technical information needed to operate and secure the services, such as IP address, device and browser type, and the date and time of requests.

5. How we use information

We use personal information to provide and support our services (badge printing, check-in, session tracking, access control and lead retrieval); to manage accounts and process payments; to communicate with customers about the services; to secure our systems, prevent misuse and investigate incidents; and to meet legal obligations. We do not sell personal information.

6. How we share information

We share personal information only as needed to provide the services:

• With the event organizer (Customer) that owns the attendee information.
• With exhibitors, when an attendee's badge is scanned using CredsNow LR, as configured by the Customer.
• With service providers that support our services under contract, including Microsoft Azure (hosting and databases), Auth0 (authentication), SendGrid (email delivery), Stripe (payments) and HubSpot (our customer relationship management).
• When required by law, or to protect the rights, property or safety of CredsNow, our customers or others.
• As part of a merger, acquisition or sale of assets, subject to this policy.

7. Where information is stored

Our services are hosted on Microsoft Azure in the United States, with a disaster-recovery copy in a secondary Azure region in Western Europe.

8. How long we keep information

Unless the Customer's agreement with us says otherwise, we delete event attendee information approximately six months after the event. Backup copies expire on our standard backup schedule. We keep account information while the account is active, and business records as long as needed for legal, accounting or security purposes.

9. Security

We protect personal information with administrative, technical and physical safeguards, including encryption in transit and at rest, role-based access with multi-factor authentication for administrative access, security monitoring, and regular vulnerability scanning. More detail is available in our Trust Center at credsnow.com/trust and in our Terms of Service. If we confirm a security breach affecting a Customer's data, we notify that Customer as described in our Terms of Service.

10. Your choices and rights

Depending on where you live, you may have rights to access, correct or delete your personal information, or to object to certain uses. For attendee information, please contact the event organizer, who controls that information; we will assist them. For information we hold for our own purposes, email security@credsnow.com and we will respond within the time required by applicable law.

11. Children

Our services are designed for professional and business events and are not directed to children. We do not knowingly collect personal information from children for our own purposes. Event organizers are responsible for any attendee information they provide to us.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date.

13. Contact us

CredsNow LLC, 4183 Wildcreek Road, Sandy, UT 84092 — security@credsnow.com (for privacy requests and security concerns).