Privacy Policy
1. Data Controller
This Privacy Policy applies to services provided by:
- Bluegate Studio, a trading name of Luinannon OÜ
- Registry code: 17535432 (Estonian Commercial Register)
- Address: Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10145, Estonia
- Email: studio@luinannon.com
2. Services Overview
Bluegate Studio is a software development company that builds and operates mobile and web applications for its clients. This policy covers two kinds of service:
- Mobile applications that we build and operate for client organisations, such as scientific societies and congress organisers, through which members and attendees access event programmes, faculty information, video content, publications, and an in-app assistant.
- SMS messaging services, providing two-factor authentication (2FA) and one-time passcode (OTP) verification to end users of client applications.
Where an application is operated for a client organisation, that organisation is the data controller for its own membership and registration records. Bluegate Studio processes that data on the organisation's behalf, and is the data controller for the application-specific data described in Section 3.
3. Mobile Applications
3.1 Data we collect
Depending on the features you use, our applications collect and process the following data:
- Account details: Your name, email address, and phone number, as held in the client organisation's membership system. Your email address is used to sign you in; your password is passed to the organisation's system to authenticate you and is not stored by us.
- Account identifiers: A user identifier and, where applicable, a membership or badge identifier, used to associate your data with your account.
- Profile photo: A photo you choose to upload. Optional.
- Push notification identifier: A device-level subscription identifier, created only if you allow notifications, used to deliver event announcements to your device.
- Assistant messages: Messages you send to the in-app assistant and the replies you receive, stored so you can return to earlier conversations. Optional.
- App activity: Sessions you bookmark, videos you mark as favourites, and your playback position in videos, so that these follow you across devices.
- Exhibitor lead records: Where the client organisation provisions your account as an exhibitor, the details of attendees whose badges you scan, together with any notes and photos you add. See Section 3.4.
The camera is used only for scanning badges and taking photos at your request. Images are not stored unless you take a photo within a feature that saves it. We do not collect your location, your contacts, or any health, financial, or sensitive data.
3.2 How we use your data
All data listed above is used exclusively to provide the application's functionality:
- Signing you in and showing you the content your membership or registration entitles you to.
- Delivering event announcements to your device, if you allow notifications.
- Generating replies from the in-app assistant.
- Keeping your bookmarks, favourites, and playback positions in sync across devices.
- Storing exhibitor lead records on the exhibitor's behalf.
We do not use your data for advertising, marketing, or profiling. We do not track you across other apps or websites, and we do not sell or share your data with data brokers. Our applications contain no advertising and no third-party analytics.
3.3 Service providers
We use the following providers to operate our applications. Each processes data only on our instructions and only for the purpose named:
- OneSignal, Inc. (San Mateo, CA, United States) — push notification delivery. Receives the device subscription identifier. Privacy Policy.
- DeepSeek — generation of in-app assistant replies. Receives the messages you send to the assistant, together with the event programme context needed to answer them. Website.
- BunnyWay d.o.o. (Ljubljana, Slovenia) — storage and delivery of images and video. Receives profile photos, lead photos, and serves video content. Privacy Policy.
All other data is stored on servers operated by Bluegate Studio. Membership and registration data remains in the client organisation's own systems and is retrieved when you sign in.
3.4 Exhibitor lead retrieval
Some applications include a lead retrieval feature for exhibitors at an event. It is available only to accounts the event organiser has provisioned as exhibitors; it is not visible to ordinary attendees.
- When an attendee presents their badge, the exhibitor may scan its code. The application then records the attendee's name, email address, phone number, institution, and country as held in the organiser's registration system, and the time of the visit.
- The exhibitor may add notes and photos to a visit.
- Records are stored on Bluegate Studio's servers and are accessible only to the exhibitor account that created them. The exhibitor may delete any visit at any time; deleting the last visit removes the record entirely, including its photos.
By presenting your badge to an exhibitor you consent to the exhibitor recording your registration details for follow-up. The exhibitor is the data controller for those records; Bluegate Studio stores them on the exhibitor's behalf. To exercise your rights over a lead record, contact the exhibitor or the event organiser, or write to us and we will assist.
3.5 Account deletion
You can delete your account from within the application: open the Me tab and choose Delete Account. This removes your profile photo, assistant conversations, bookmarks, favourites, playback positions, and push notification identifier from our systems within 30 days, and requests deletion of your account in the client organisation's system.
If you cannot access the application, email studio@luinannon.com from the address registered to your account, and we will carry out the deletion for you.
4. SMS Messaging Services
4.1 Data we collect
In connection with our SMS messaging services, we collect and process the following data:
- Mobile phone number: Provided by the end user during account registration in a client application.
- Messaging consent status: Whether the end user has opted in to receive SMS verification codes.
- Message delivery metadata: Delivery status and timestamps, used solely for service reliability and troubleshooting.
4.2 How we use your data
Your mobile phone number and related data are used exclusively for the following purposes:
- Sending one-time passcodes (OTPs) for account login and identity verification.
- Sending verification codes for password resets and security checks.
- Maintaining delivery logs for service reliability.
We do not use your mobile phone number or messaging data for marketing, advertising, or promotional purposes.
4.3 SMS messaging disclosure
By providing your phone number and giving explicit consent during registration in one of our client applications, you agree to receive SMS messages containing one-time passcodes (OTPs) for authentication and account verification purposes.
- Message frequency: Messages are sent only when you initiate a login, password reset, or identity verification request. No recurring or scheduled messages are sent.
- Message and data rates may apply depending on your mobile carrier and plan.
- Opt-out: You may opt out at any time by replying STOP to any message received from us. You will receive a confirmation and no further messages will be sent.
- Help: Reply HELP to any message for assistance, or contact us at studio@luinannon.com.
4.4 Service provider
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
Your phone number is shared only with the following third-party service provider, solely for the purpose of delivering SMS verification codes:
- Twilio Inc. (San Francisco, CA, United States) — SMS delivery infrastructure. Your phone number is transmitted to Twilio exclusively for OTP message delivery. Twilio's data processing is governed by their own Privacy Policy.
5. Data Sharing
Beyond the service providers named in Sections 3.3 and 4.4, personal data is not shared with any third party, organisation, or affiliate. Data is transferred at the minimum level required for service operation. We may disclose data where required by law.
6. Data Retention
Your data is retained for as long as your account remains active in the relevant client application. Upon account deletion or opt-out, your data is removed from our systems within 30 days, subject to any legal retention obligations. Exhibitor lead records are retained until the exhibitor deletes them or the exhibitor's account is deleted.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data transmissions between our applications, our servers, and our service providers are encrypted in transit.
8. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Object to or restrict processing of your data.
- Withdraw your consent to receive SMS messages at any time by replying STOP.
- Withdraw your consent to push notifications at any time in your device settings.
To exercise any of these rights, contact us at studio@luinannon.com.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of our services after any changes constitutes acceptance of the updated policy.
10. Contact
If you have any questions about this Privacy Policy or our data practices, please contact us:
- Email: studio@luinannon.com
- Address: Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10145, Estonia