Privacy Policy

The data controller is CraftingProduct.io, the trade name of Dima Abramov, Amsteldijk 12, Amsterdam, the Netherlands, VAT NL005364058B63. The event is run by Dima Abramov and Elena Avramenko, the organisers of Vibecoding Conference in Amsterdam. Contact: hello@craftingproduct.io.

Ticketing data. Tickets are sold through Luma. When you register, we receive your name, email address, and ticket tier from Luma. Payments are processed by Stripe through our Stripe account, so we also receive transaction and billing details (such as the amount paid and your billing information), which we use for invoicing and our financial records. Full card numbers are handled by Stripe and never reach us. Luma and Stripe process your data under their own privacy policies as well. VibeConf 2026 is a World AI Week affiliated event, so part of this registration data is also shared with the World AI Week organiser — see section 05.

Collaboration enquiries. If you use the collaboration form on our community page, we receive your name, work email, organisation or community, what you are planning, your description of the audience and desired outcome, and any city and timing you add. See section 11.

Correspondence. If you email us, we keep the exchange for as long as needed to help you.

Photos and video. The event is photographed and may be filmed. See our terms for how this works and how to object.

Speaker workspace data. Confirmed speakers get a private link to a workspace for their own announcement material. There we hold their name, role, bio, LinkedIn URL, chosen framing, any replacement portrait they upload, a one-way hash of the link, and two timestamps recording that the workspace was opened and that an image was downloaded. Section 09 describes this in full.

Website analytics. This site uses Vercel Analytics, which is cookieless and aggregated. We see page-level statistics, not profiles of individual visitors. On the Signal Card page we additionally keep an anonymous daily count of how often the card link is clicked and how often a card is downloaded, including the chosen card style and size. The photo, the name and everything else you type there stay on your device and are never sent to us.

We use ticketing data and correspondence to run the event and manage your attendance (performance of a contract). We use payment and billing data to issue invoices and keep the financial records we are required to keep (legal obligation). We use event photos and video for communication and marketing about the event (legitimate interest, with the opt-out described in the terms). We use analytics to understand how the site is used and improve it (legitimate interest). We disclose limited registration data to the World AI Week organiser on the basis of the consent you give at registration (section 05).

We use the speaker workspace to coordinate confirmed speaker participation and to provide event communication and promotional materials. That is based on performance of the speaker arrangement we have with each speaker, and on our legitimate interest in running and promoting the event.

We may also email past attendees about similar future events we organise, such as the next edition; every such email contains an unsubscribe link and you can opt out at any time (legitimate interest in keeping our own attendees informed). Beyond that, we do not use your data for advertising, profiling, or automated decisions.

Luma (ticketing), Stripe (payment processing), Vercel (website hosting and analytics), and the venue where needed for entry and safety. As a World AI Week affiliated event, we also share limited registration data with Inspired Minds Media Ltd, as described in section 05. Lovable, our website platform, delivers the practical ticket-holder emails we send; it does not receive Signal Card photos or the cards you generate, which stay in your browser. The website also loads fonts from Google Fonts and images from Supabase, which means those providers see your IP address when the site loads. Replacement portraits uploaded by speakers are held in private storage at Supabase, our database and storage provider; they are not publicly readable and are shown back to the speaker and to organisers only through short-lived signed links. We do not sell personal data and we do not share it with ad networks.

VibeConf 2026 is an affiliated event of World AI Week, which is organised by Inspired Minds Media Ltd. Because we run registration on our own platform (currently Luma), our affiliation agreement requires us to share registrant data for this affiliated event with Inspired Minds Media Ltd, in compliance with the GDPR, so that they can administer and run the affiliated event programme.

“By registering for this World AI Week affiliated event, you consent to the sharing of your data with the event organiser, Inspired Minds Media Ltd, for the sole purpose of running the event.”

The affiliation agreement requires this notice to be presented in the registration form. We will rely on consent for this disclosure only where it has been collected at registration.

What is shared. We share data for all registered attendees, limited to the registration data reasonably necessary for that purpose: your name, your email address, your ticket or registration status/tier, and any other registration field strictly required to administer the event.

What is not shared. Full payment-card details (which we never hold), billing and invoicing records that are not needed for event administration, anything you enter or upload on the Signal Card page, and our anonymous website analytics are not part of this transfer.

When it is shared. The affiliation agreement requires registrant-data snapshots two weeks before the event, five days before the event, and five days after the event, and it also refers to fortnightly registration updates. To be transparent about that overlap: we provide the three required snapshots, plus any fortnightly registration updates required by the affiliation agreement.

Purpose. The disclosed purpose is event administration only. Any unrelated marketing use would require its own lawful basis and its own notice, and is not covered by this sharing.

After the transfer. Once received, Inspired Minds Media Ltd handles the copy it receives under its own privacy policy, available at worldaiweek.ai/privacy. For privacy requests about their processing, contact ivana@inspired-minds.co.uk. For anything about our own processing, contact hello@craftingproduct.io.

Withdrawing consent. You can withdraw your consent to this sharing at any time by emailing hello@craftingproduct.io. Withdrawal stops future disclosures and does not affect processing already carried out before you withdrew. It does not by itself erase data Inspired Minds Media Ltd has already lawfully received; requests about their copy should go to them directly.

Inspired Minds Media Ltd is established in the United Kingdom. Transfers of registration data from the EU to the UK currently rely on the European Commission’s adequacy decision for the United Kingdom.

Some of our other providers may process data outside the European Economic Area. Where that happens, transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We keep attendee data for up to 12 months after the event, then delete it, unless the law requires us to keep specific records longer. That period applies to our own copy of the data. Inspired Minds Media Ltd decides how long it keeps the copy it receives, under its own privacy policy; we cannot delete their copy on your behalf.

Invoices and other financial records are kept for 7 years, as Dutch tax law requires. Event photos and video may be kept for up to five years for archive and marketing of future editions.

Private speaker workspace data — the speaker’s own draft edits, any replacement portrait they uploaded, the one-way hash of their link, and the opened and downloaded timestamps — is retained through 5 November 2026 and is cleared or deleted from 6 November 2026, one month after the event. Public programme copy and approved promotional assets are separate: those may be kept under our event archive and marketing retention above.

Under the GDPR you can ask us for access to, correction of, or deletion of your personal data, ask us to restrict or object to its use, withdraw consent you have given, and request a copy in a portable format. Email hello@craftingproduct.io and we will respond within a month. Rights requests concerning the copy held by Inspired Minds Media Ltd should be sent to ivana@inspired-minds.co.uk. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Confirmed speakers receive a private link to a workspace where they can adjust their own bio, framing and portrait and download announcement images. The link itself is the access: we store only a one-way hash of it, never the link. We keep the speaker’s name, role, bio, LinkedIn URL, chosen framing, any portrait they upload, and two timestamps recording that the workspace was opened and that an image was downloaded.

The finished speaker-card PNGs are generated on the speaker’s own device and are never uploaded to us. A replacement portrait is different: when a speaker deliberately uploads one to replace the photo we hold, that file becomes private server data, kept in storage that is not publicly readable and readable only through short-lived signed links. Organisers can revoke or regenerate a speaker’s link at any time, which immediately stops the old one working.

From 6 November 2026 this workspace data is cleared: uploaded portraits and link hashes are deleted, opened and downloaded timestamps are cleared, and each speaker’s draft row is retained only as an empty record with their private edits reset back to our default bio, framing and website portrait. This is a manual, operational control an organiser runs; there is no automatic scheduled job.

Ticket holders are registered through Luma, which remains the record of who holds a ticket. So that we can welcome you and answer practical questions, we read a limited copy of that registration from Luma: your email address, first name or display name, your approval status, and when you registered. We do not write anything back to Luma.

We use that copy to send you a small number of practical event emails and to give you a private page with your event details. That page is reached through a private link sent to you by email; we store only a one-way hash of the link, never the link itself, and we can revoke it at any time. Our basis is our legitimate interest in running an event you hold a ticket for, and performance of the ticket contract for the practical arrangements.

If you ask us for a company invoice, the billing details you submit — company name, contact name, billing email, VAT or tax ID, billing address, and any reference or note you add — are stored encrypted and used only to issue and administer that invoice. We also ask for the email address the ticket was bought with, the ticket purchase date, and an optional order or payment reference, so we can match your request to the right purchase and prepare the invoice. So that our organisers can process the request, the billing and purchase-matching details you submit are also delivered to a private organiser channel in Slack, our internal communications provider. They are not published and not used for marketing.

These emails are separate from marketing: we do not use this data to send you promotional messages unless you have separately opted in. Guest data is kept under the attendee retention period in section 07, and invoices under the 7-year financial retention there.

We use the details you submit through the collaboration form to review your enquiry, to respond to you, and to take the steps that may be needed before any agreement between us. Our basis is taking pre-contractual steps at your request, and our legitimate interest in answering enquiries about our events and programmes.

The content of the form is delivered to a private organiser channel in Slack, our internal communications provider, which therefore receives that content. It is not published, not used for marketing, and not shared with the parties named in sections 04 and 05.

We delete collaboration enquiries once they are no longer needed for the conversation or for any work that follows from it, subject to any legal record-keeping obligations, such as the financial retention in section 07 where an enquiry leads to invoiced work.

This site does not use tracking or advertising cookies. Our analytics are cookieless.

If we change this policy, we will post the new version here with an updated date. Material changes affecting ticket holders will be announced by email.