Skromia — Organizer Privacy Notice

Draft — not reviewed by an attorney.

Effective Date: August 18, 2026

Last Updated: August 18, 2026

This Organizer Privacy Notice explains how Skromia, Inc. ("Skromia," "we," "us") collects and uses information from venue and event organizers who create accounts, configure venues, create events, pay for events, or contact us about organizer services.

This notice is separate from the Skromia Attendee Privacy Policy. Attendees use Skromia anonymously. Organizers create accounts and may provide business contact, venue, event, and payment information.

1. What We Collect From Organizers

Account information. Organization name, account holder name if provided, work email address, password hash, account settings, and authentication records.

Venue configuration. Venue name, event environment, opportunity categories, public meeting-point landmarks, walking hints, and any organizer-supplied configuration notes.

Event information. Event name, event date, start time, end time, timezone, expected attendance, selected pricing tier, join code, Quick Response (QR) code/sign assets, event status, cancellation status, and aggregate event statistics.

Payment and billing records. Checkout session information, Stripe customer/payment references, selected price tier, invoices, refunds, discounts, tax/accounting records, and payment status. We do not store full card numbers. Card processing is handled by Stripe.

Support and safety communications. Messages you send to support@skromia.com, safety@skromia.com, privacy@skromia.com, or other Skromia support channels, including requests to disable Skromia at a venue or restrict access on your premises.

Technical and security data. IP address, browser/device data, logs, timestamps, session cookies or similar strictly necessary technologies, and fraud/security signals needed to operate the organizer web app.

2. What We Do Not Provide To Organizers

Organizer accounts do not receive attendee identities, attendee device identifiers, individual attendee choices, individual pairings, reports, blocks, individual feedback responses, or any data that would allow an organizer to reconstruct who met whom.

Organizer dashboards show aggregate statistics only. Where participation is too low to aggregate safely, statistics are suppressed.

3. How We Use Organizer Information

We use organizer information to:

• create and secure organizer accounts;

• configure venues and reusable public meeting points;

• create event instances with event-specific join codes;

• operate checkout, invoicing, discounts, refunds, and tax/accounting records;

• provide event dashboards and aggregate statistics;

• generate printable Quick Response (QR) code signs;

• handle support, cancellation, safety, and venue-disable requests;

• prevent fraud, abuse, and unauthorized access;

• comply with legal and accounting obligations;

• communicate operational updates about Skromia events and organizer accounts.

We do not sell organizer information. We do not use organizer information for cross-context behavioral advertising.

4. Legal Bases — EEA and UK Organizers

Where GDPR (General Data Protection Regulation) or UK GDPR applies, we process organizer information on these bases:

• Performance of a contract: account creation, event setup, payment, support, dashboards, and service delivery.

• Legitimate interests: security, fraud prevention, business communications, aggregate measurement, and service improvement.

• Legal obligation: tax, accounting, corporate, safety, and valid legal-request obligations.

• Consent: optional marketing communications, where required.

5. Service Providers

We use service providers to operate the organizer service, including database/application hosting, email delivery, payment processing, logging/security infrastructure, and customer support tools. Current expected providers include Supabase and Stripe. We will update this notice when material provider categories change.

6. Retention

• Organizer account records: retained while the account is active and for up to 12 months after closure unless a longer period is required for legal, accounting, tax, dispute, or security purposes.

• Venue and event configuration: retained while the venue/account is active and for up to 24 months after the last event unless needed longer for accounting, dispute, safety, or legal reasons.

• Payment, invoice, refund, and tax records: retained as required for tax, accounting, and legal obligations.

• Support and safety communications: retained up to 24 months unless needed longer for an active dispute, safety issue, legal request, or compliance reason.

• Security logs and IP addresses: retained no longer than 30 days where possible, unless needed for security, fraud, abuse investigation, or legal compliance.

7. Your Rights

Depending on where you live or operate, you may have rights to access, correct, delete, restrict, object to, or port certain personal data. To exercise rights, contact privacy@skromia.com from the work email associated with your organizer account.

Some organizer records cannot be deleted immediately because we must keep them for tax, accounting, fraud prevention, dispute handling, or legal compliance.

8. International Transfers

Skromia is operated from the United States and uses service providers that may process data in North America. Where required, transfers out of the EEA or UK rely on appropriate safeguards such as Standard Contractual Clauses.

9. Security

We use reasonable administrative, technical, and organizational measures to protect organizer information. No system is perfectly secure. Organizers are responsible for keeping account credentials secure and limiting account access to authorized personnel.

10. Changes

We may update this notice. Material changes will be communicated through the organizer web app or by email where required.

11. Contact

privacy@skromia.com

support@skromia.com

Skromia, Inc.

514 Millburn Ave, Suite #1137

Short Hills, NJ 07078

EU representative (GDPR Article 27): [TO BE APPOINTED BEFORE EEA ORGANIZER OFFERING]

UK representative (UK GDPR Article 27): [TO BE APPOINTED BEFORE UK ORGANIZER OFFERING]

*Counsel should review this notice before launch, especially retention, service-provider disclosures, international transfers, and organizer-rights handling.*