Privacy Policy

1. Introduction

This Privacy Policy explains how MCI USA Operating Co. ("MCI," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with Jade (the "Platform" or "Services"), including registration, housing, sourcing, mobile app, exhibitor, lead, onsite, support, reporting, API, webhook, and AI-assisted workflows.

2. Scope and Roles (Organizer vs. End User)

Jade supports events operated by Organizers. In many cases:

• The Organizer determines why and how personal data is processed for an event (the "controller" or equivalent role).
• MCI processes personal data on behalf of the Organizer to provide the Services (the "processor" or equivalent role).

For enterprise customers, processing terms may be governed by a Data Processing Addendum (DPA). If you have questions about an event's data practices (such as how to exercise rights), you may also need to contact the Organizer directly.

3. Personal Information We Collect

We collect information from Organizers, Attendees, Exhibitors, and other Users.

3.1 Information You Provide

Depending on the event and configuration, we may collect:

• Identifiers and contact details (e.g., name, email, phone number, mailing address);
• Account credentials (username, password, authentication tokens);
• Registration and profile details (e.g., employer/organization, job title, attendance preferences);
• Housing and accommodation details (e.g., check-in/out dates, rooming preferences, rooming lists, and hotel confirmation details);
• Event participation details (e.g., session selections, speaker submissions, survey responses, CE credits, badge or wallet pass details, mobile app activity, appointments, and attendance/check-in records);
• Exhibitor and lead details (e.g., company profiles, booth information, staff, lead scans, lead qualifiers, collateral selections, and prospect invitations);
• Sourcing and contract details provided by suppliers, venues, or event teams where those workflows are enabled;
• Communications (support requests, chat messages, emails sent through the Platform);
• Accessibility, dietary, or other special assistance information (which may be considered sensitive under certain laws);
• Government ID or travel documentation information if required by the event (processed on Organizer instructions);
• Event-related content you upload (documents, images, notes).

3.2 Payment Information

Jade supports payment processing via third-party Payment Processors such as Stripe. Where an event uses credit-card guarantees rather than immediate charges, card details may be tokenized through a third-party vault such as Basis Theory. Payment card information is provided directly to Payment Processors and handled under their security standards and terms. MCI does not store full payment card numbers.

3.3 Automatically Collected Information

When you use the Services, we may automatically collect:

• device and browser information;
• IP address and approximate location derived from IP;
• log data (access times, pages/actions, error reports);
• identifiers needed for authentication and security;
• usage analytics and performance data.

3.4 Cookies and Similar Technologies

We use cookies and similar technologies for authentication, security, preferences, and analytics. See the Cookie Policy for details.

4. How We Use Personal Information

We use personal information to:

• provide, operate, and maintain the Services;
• process registrations, housing, and event-related workflows;
• process payments and manage refunds/chargebacks with Payment Processors and Organizers;
• support approvals, pricing rules, discounts, sourcing, lead retrieval, mobile app, onsite, and recommendation workflows (including via AI Features where configured);
• send transactional and event-related communications (confirmations, updates, receipts);
• provide customer support and respond to requests;
• monitor, prevent, and investigate fraud, abuse, and security incidents;
• improve, debug, and enhance the Services;
• comply with legal obligations and enforce our Terms and Policies.

5. AI Processing and Automated Decision-Making

Jade uses AI Features for tasks such as data validation, normalization, event setup assistance, support, analytics, recommendations, report drafting, document analysis, and suggested actions (depending on configuration).

• Automated workflows: Some features may involve automated or rule-based processing that affects Users (for example, eligibility routing, approvals, pricing tiers, discounts, fraud signals, or recommendations). Where applicable, Organizers may configure workflows and controls.
• No training on personal data: MCI does not use Customer Data or Attendee/Exhibitor personal data to train general-purpose AI models.
• Human oversight: Human review and override may be available depending on configuration and operational processes.

For more, see the AI Use & Transparency Policy.

6. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

6.1 Service Providers and Subprocessors

We use service providers ("subprocessors") to operate the Services, including:

• Microsoft Azure — Cloud hosting and infrastructure
• Amazon Web Services (AWS) — Cloud hosting and infrastructure (as applicable)
• MongoDB Atlas — Database hosting
• Stripe — Payment processing
• Basis Theory — Card vaulting for guarantee-only payment instruments where configured
• Mailjet / Mailgun — Email delivery and messaging
• Twilio — SMS text messaging and phone-number verification
• OpenAI — AI-assisted platform features where configured
• Apple Wallet / Google Wallet providers — Wallet pass issuance where configured

6.2 Organizers and Event Stakeholders

Information may be shared with the Organizer operating the event and authorized event stakeholders (e.g., housing teams, exhibitors management, on-site check-in) consistent with the event configuration. This sharing does not include mobile phone numbers provided solely for the purpose of receiving SMS notifications under the SMS Communications section (Section 14) below.

6.3 Legal, Safety, and Compliance

We may disclose information if we believe in good faith that disclosure is necessary to:

• comply with law or legal process;
• protect rights, safety, and security of MCI, Users, or the public;
• investigate and prevent fraud, abuse, or security incidents; or
• enforce our agreements and policies.

6.4 Business Transfers

If MCI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction subject to appropriate safeguards.

7. Data Retention

We retain personal information for as long as necessary to:

• provide the Services and operate events;
• comply with legal and accounting obligations;
• resolve disputes; and
• enforce agreements.

Retention periods may vary by event and contract. Organizers may control retention for event data under their agreements with MCI. We may retain de-identified or aggregated data that no longer identifies an individual.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. Children's Privacy

The Services are not directed to children under 13. If an event involves minors, Organizers are responsible for obtaining any required parental or guardian consent and providing appropriate notices. If we learn we collected personal information from a child under 13 without appropriate authorization, we will take steps to delete it.

10. US State Privacy Rights

Depending on your state of residence, you may have rights regarding your personal information, such as the right to access, correct, delete, or obtain a copy of your data, and to opt out of certain processing.

Because many events are operated by Organizers (who may be the controller), we may direct certain requests to the Organizer or assist them as required under our DPA. To submit a request, contact legal@wearemci.com and identify the event and your role (Attendee/Exhibitor/Organizer).

Non-discrimination: We will not discriminate against you for exercising applicable privacy rights.

11. Do Not Track

Some browsers offer "Do Not Track" signals. The Services do not respond to Do Not Track signals in a uniform manner because standards are not finalized.

12. International Data Transfers; Future Expansion

At launch, the Services are hosted in the United States. If we expand hosting to additional regions (including the EU), we will implement appropriate safeguards as required by applicable laws (such as contractual protections and transfer mechanisms).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy and update the "Last Updated" date. Material changes may be accompanied by additional notice as required by law.

14. SMS Communications

This section applies only to mobile phone numbers that Organizers submit through Jade's account alert settings for the purpose of receiving SMS notifications about their events (for example, sell-out alerts, VIP check-in alerts, or registration-count thresholds). It does not apply to phone numbers or other registration information collected from Attendees, Exhibitors, or other Users, which is handled as described elsewhere in this Privacy Policy.

No sharing for marketing. Mobile information and SMS opt-in/consent data collected under this program will not be shared with third parties or affiliates for marketing or promotional purposes. This information is not sold, rented, or otherwise transferred to any third party for their own marketing or promotional use.

We may share mobile information with subcontractors who support this service (for example, our messaging provider and customer support tooling) solely to deliver the SMS notifications and operate the program.

Organizers opt in through the Platform by entering a mobile number, confirming ownership through a one-time verification code, and agreeing to receive these messages. Message frequency varies based on account and event activity, and message and data rates may apply. Reply STOP to opt out at any time, or reply HELP for assistance.

This section governs only Jade's own Organizer-facing SMS program. SMS opt-ins collected by individual event organizers under their own messaging programs are governed by that organizer's own privacy policy, not this one.

15. Marketing-Site Assistant

This section applies only to the AI assistant on this website — the "Ask Jade" chat available on our public pages. It does not apply to registration, housing or exhibitor data collected through an event, which is handled as described elsewhere in this Privacy Policy.

Our role is different here. Section 2 describes MCI acting as a processor for an Organizer. For this assistant there is no Organizer: you are dealing with MCI directly, and MCI is the controller of the information you give it.

What we collect. The messages you send and the assistant's replies; a work email address, and optionally your name and organization, if you choose to continue past the first few questions; the page you arrived on, the referring site, and any campaign parameters in the link you followed; a coarse country derived from your connection; and a one-way cryptographic hash of your IP address, used to limit abuse. We do not store your IP address itself.The email address is self-declared and not verified — we do not send you a confirmation link and do not treat it as proof of identity.

Uploaded documents. If you upload a document, it is read once to extract the questions it asks and is then discarded. It is not saved to our systems, is never attached to any email, and is deleted from our AI provider within the same request. We keep the file name and the extracted questions, not the document.

Why we process it. To answer your questions, to prevent abuse of a public service, and — where you have given an email address — for our legitimate interest in responding to a business enquiry. We may share the conversation with our sales team so they can follow up; this is stated in the interface at the point we ask for your address.

AI provider. Your messages and any uploaded document are processed by our AI provider (named in section 6.1) solely to generate the response. That provider does not use them to train its models and does not retain them beyond the request. See our AI Use & Transparency Policy for the full commitment.

Retention.We keep the conversation for up to 12 months, after which the personal details in it are erased. Abuse-limiting counters are kept for up to 90 days.

Your rights. You do not need an account to exercise them, and you do not need to identify an event or a role. Email legal@wearemci.com from the address you gave the assistant, or quote the reference shown in the chat, and we will locate and act on your conversation. This is the intended route for section 10 rights as they apply to this assistant, in place of the event-identification steps described there.

What it will not do. The assistant does not quote prices, contract terms, delivery dates, service levels, or certification status, and nothing it says is binding on MCI.

16. Contact

For questions or requests, contact: legal@wearemci.com.