Konfi privacy notice
Version 1.1 · 6 August 2026
Konfi is an AI assistant for events, operated by Konfi Labs d.o.o. This notice applies to event attendees and other persons who communicate with the Konfi assistant. It explains what personal data is processed, where it comes from, what it is used for, and which rights you have.
Questions about this notice or about your data: privacy@konfi.ai.
The short version
- Konfi processes the registration details the event organizer shared with it, what you tell it in chat, and limited publicly available information (for example, speaker details published on the event’s website).
- Your details are never shown to other attendees unless you opt in to the attendee directory.
- Your conversations are not used to train AI models, and your personal data is never sold.
- You can request deletion of your data at any time — in the chat or by email. You receive a confirmation link before anything is deleted.
Who is responsible for your data
Depending on the channel you use, one of two parties is the “controller” — the party legally responsible for your data:
- An event’s own channel (for example, a conference’s own WhatsApp number): the event organizer is the controller. Konfi Labs operates the assistant on the organizer’s behalf, as its processor, under a data processing agreement. The organizer’s own privacy notice applies alongside this one.
- Konfi’s own channels (Konfi’s WhatsApp number, other Konfi-branded channels, and konfi go pages): Konfi Labs is the controller, and your relationship is directly with us.
In both cases the assistant behaves the same and your rights are the same. The distinction determines who is answerable for your data, and it means that data you share on Konfi’s own channels can stay with Konfi across events (see “How long we keep data”).
Konfi Labs d.o.o., Braće Radića 30B, 10410 Velika Gorica, Croatia — an EU company. Contact: privacy@konfi.ai.
What we process, and where it came from
Some information comes from you, and some comes about you from other sources — the GDPR requires us to be explicit about both:
| Category | Examples | Source |
|---|---|---|
| Registration data | Name, company, role, ticket type, phone number or other channel handle | The event organizer, or their registration platform (e.g. Sessionize, Luma, Zuddl) |
| Conversations | Messages you exchange with Konfi — questions, requests, reactions, media you send | You |
| Learned preferences | Interests, sessions you care about, dietary notes, a flight number you share for carpooling | You, in the course of chatting |
| Directory profile | A short professional profile, LinkedIn link | You — opt-in only |
| Publicly available information | Professional information published publicly — for example, speaker or organizer details on the event’s website | Public sources |
| Operational metadata | Delivery status, channel identifiers, timestamps | The messaging platforms |
Konfi does not request special categories of personal data (health, beliefs, etc.). If you volunteer sensitive information in order to receive help with it — for example, an accessibility need — it is used for that purpose only.
What it’s used for, and on what legal basis
| Purpose | What that means | Legal basis |
|---|---|---|
| Running the assistant | Answering questions, guiding you through the event, reminders, live help, human handoff when Konfi cannot answer | Performance of the event engagement / the organizer’s legitimate interest in running the event; on Konfi’s own channels, performance of our service to you |
| Attendee directory & matchmaking | Making you visible to other attendees, suggesting introductions | Consent — opt-in, withdrawable at any time in chat |
| Proactive outreach | Session reminders, practical heads-ups, carpool matching. You can mute or stop these with one message | Legitimate interest / performance of the engagement |
| Tailoring event content | Selecting which event content — including sponsor or partner questions the organizer runs — is most relevant to you, based on your profile and interests | Legitimate interest; individual conversations are never shared with sponsors |
| Cross-event memory (Konfi channels only) | If you talk to Konfi’s own number at your next event, it can remember your preferences instead of starting from zero | Legitimate interest in providing a continuous assistant; deletion available at any time |
| Updates you opt in to | If you opt in — for example, when asked at the end of an event — Konfi may send you updates about future editions of that event. You can unsubscribe at any time | Consent — opt-in only |
| Post-event analytics for organizers | Aggregated engagement and satisfaction reporting | Legitimate interest; individual conversations are not shared with sponsors |
| Service improvement | Understanding what worked, in aggregated or de-identified form | Legitimate interest |
What we don’t do
- We never sell your personal data.
- No AI training on your conversations. Our model providers (Anthropic, OpenAI) are used via commercial APIs whose terms exclude training on submitted data, and we do not train models on identifiable conversations either.
- No attendee-list leaks — by construction. The assistant has no ability to enumerate attendees. Looking someone up requires already knowing their name or company, and you appear in the directory only if you opted in.
- No unsolicited marketing. After an event, you hear from Konfi again only if you opted in to updates.
Who else is involved
Konfi runs on EU infrastructure (Hetzner, Germany/Finland). Messages travel through the channel you chose (WhatsApp via 360dialog, Telegram, email via Mailgun), and the assistant’s reasoning uses AI model providers (Anthropic, OpenAI) in the United States under EU-approved transfer safeguards (Data Privacy Framework and/or Standard Contractual Clauses).
The full, current list — what each provider does and where it is — is at konfi.ai/legal/subprocessors.
How long we keep data
- Event data (your conversations and profile on an event’s own channel) is retained for 18 months after the event ends, then deleted or anonymized — unless the organizer, as controller for their channel, instructs deletion earlier.
- Data on Konfi’s own channels (including cross-event memory) is retained for 18 months after your last interaction with Konfi. Before deletion, we notify you, and you can choose to keep your profile active.
- Aggregated, de-identified data (e.g. “60% of attendees used Konfi”) contains no personal data and may be kept indefinitely.
- Backups roll off within 30 days; deletions propagate as backups rotate.
Your rights
Under the GDPR you can request access to your data, correction, deletion, restriction, or portability, object to processing, and — where processing is based on consent — withdraw that consent at any time.
You can make any of these requests directly in the chat (for example, “delete my data”) or by email to privacy@konfi.ai. For deletion requests, you receive a link to a confirmation page that shows what will be deleted; deletion is carried out once you confirm. Where the event organizer is the controller, we forward the request and assist; you can also contact the organizer directly.
If you are not satisfied, you can lodge a complaint with a supervisory authority — in Croatia, AZOP (Agencija za zaštitu osobnih podataka, azop.hr) — or with the authority of your own EU country.
This notice is versioned; material changes are announced in the chat. Version 1.1, 6 August 2026.