MatchLayer · Updated 2026-09-28

Privacy & data controls

Who is responsible

The event organizer determines the purpose of its attendee records and networking activities. MatchLayer supplies the technical service on the organizer’s instructions. The platform operator determines the purposes of platform account/security processing and the optional portable Pass. The platform operator is Gustavo Brito, acting in his own name. Contact matchlayer.operations@outlook.com. These roles must be confirmed in an organizer data-processing agreement. The organizer must identify itself and its privacy contact before importing participants.

Data, purposes and legal bases

• Organizer account: email, account ID, organization and event settings support the requested service (contract/pre-contract steps). Minimal security records support legitimate interests in protecting the service.
• Event networking: organizers import name and, where needed, business email, company and role. You can provide professional interests, needs, offers, profile links and event answers. Introductions, responses, meetings and outcomes support the networking service. Each organizer must document and disclose an appropriate lawful basis, such as the requested service or assessed legitimate interests, and how to object. Reading this notice is not blanket consent.
• Optional analytics: screen and recommendation views require your device’s optional analytics choice. Refusal does not prevent networking. Actions you request, such as an introduction or rating, still need to be recorded.
• Optional Pass: selected profile/preferences and linked event activity can support cross-event networking only after you explicitly enable/link Pass. The basis is consent, with Pass restricted to adults. Delete Pass to withdraw it; each new event requires an explicit linking action.

Do not enter health, religion, political beliefs, sexual orientation, identity documents or other sensitive information in free-text fields. LinkedIn is optional. The app does not request your date of birth, precise location, camera or microphone.

Recommendations and who sees your data

Matching ranks professional profiles using needs/offers, interests, event answers, similarity and feedback. Profile text can become numerical embeddings inside the Supabase runtime. An enabled Pass can add previous-event signals. Scores are relevance estimates, not probabilities of success, verified credentials or guaranteed financial ROI. They do not determine employment, credit or other legally significant eligibility. You decide whom to contact; edit your profile, reject suggestions or ask the organizer to stop processing.

Other attendees in the same event can see relevant professional profile fields and matching explanations. Counterparties see introductions, meetings and any shared outcome notes. Authorized organizers see event records and reports. A QR link is an access credential: keep it private. We do not sell profiles or publish a searchable attendee directory on the public website.

Providers and international transfers

Supabase provides authentication, database and backend functions; Vercel hosts the website. They may process technical logs including IP addresses. Optional PostHog diagnostics run only when configured and after consent. Resend is the configured provider for transactional authentication, event invitations and relevant networking emails when enabled. Delivery records contain recipient, type, delivery timestamps and failures; bounce or complaint signals suppress further sends. Open and click tracking are disabled. Optional event emails can be disabled from your profile. Event logos may be loaded from an organizer-provided HTTPS host. No advertising SDK is installed. Actual regions, subprocessors, contracts and international-transfer safeguards require an operator review; an EU analytics endpoint alone does not establish that all processing stays in the EU.

Retention

Events have a review period, default 365 days after archive. This is not automatic deletion. The organizer must review necessity and remove or anonymize data when no longer needed. Archive does not erase records. Audit retention is reviewed no earlier than 365 days; read notifications are eligible for review after 30 days. Security and privacy-request records need a documented retention schedule. See device storage.

Your rights and requests

Request access, correction, deletion, restriction, portability where applicable, or object to legitimate-interest processing. Withdraw optional consent at any time without affecting earlier lawful processing. Use Profile → Event privacy requests. The page also accepts the invitation of a deactivated participant. Requests are recorded for the event owner/admin with a reference, status and response. A deletion request is not a completed deletion. The controller must explain any legally necessary retention or refusal.

Contact matchlayer.operations@outlook.com if you have lost your invitation, cannot access the form, or your request concerns a platform account or Pass. Do not email invitation tokens or identity documents unless proportionately required through a secure verification process. Responses are due without undue delay, normally within one month; a justified extension of up to two further months must be explained within the first month. You can complain to CNPD or your competent supervisory authority.

Pass and event records are separate

Export or delete Pass in your profile. Deletion removes the portable identity and its links; event records remain subject to organizer obligations. Exports identify their scope; request a complete event copy separately. Deactivation does not remove privacy rights.

Children and updates

The event organizer sets the minimum age. An event admitting minors must also provide age-appropriate information, establish a lawful basis and obtain or verify representative authorization when required. Admission to the event is not automatic permission for profiling. Optional analytics and cross-event Pass are restricted to people declaring they are 18 or older. Event networking for minors requires the organizer’s documented safeguards and supervision; the platform does not verify parental authority. Material changes in purposes or consent require an updated notice and, where applicable, a new choice.