Privacy Policy

Last updated: 11 September 2026

Contact: hello@hallway.events

Who we are

Hallway ("Hallway", "we", "us", or "our") is a directory of technology conferences and their calls for papers (CFPs), together with tools that help organisers run those events and help speakers and attendees take part. Hallway is a product of Venn Labs LLC, and is an independent, commercial service. Browsing the directory and being listed in it are free.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It is written to be jurisdiction-neutral: where your local law gives you specific rights, those rights apply to you regardless of the general descriptions below.

An important point up front: because Hallway helps organisers coordinate real events, some people have information in Hallway before they have ever visited the site. An organiser can add you as a speaker, or import your public speaker profile, and a placeholder ("unclaimed") profile is created for you. The section "Data organisers enter about you" and the section "Unclaimed profiles and how to claim or remove your data" explain how this works and what you can do about it.

How Hallway is structured: organiser tools and individual accounts

Hallway has two sides, and the side you are on decides who controls your data.

Hallway as a tool for organisers. For event organisers, Hallway works like a CRM: a place to plan an event and coordinate the people involved in it. An organiser can process certain data about the people they work with without those people having to agree first, and without an individual veto. This organiser-controlled processing covers:

• appearing on an event's public pages, schedules, and talks listings;
• receiving and completing forms an organiser sends you;
• itineraries and travel or logistics records an organiser keeps for you; and
• an organiser's own notes about your participation.

For this organiser-controlled processing, the organiser is the controller and determines the lawful basis; Hallway processes the data on the organiser's instructions under our Data Processing Addendum. Organisers warrant to us (see our Terms) that they have a proper basis to enter this data about the people they work with. This description is jurisdiction-neutral: where your local law gives you stronger rights, those rights apply, and you can raise a request with the organiser or with us and we will pass it on.

Hallway as an optional social platform for individuals. The social side of Hallway is opt-in and requires you to claim an account by verifying an email address. Only once you have claimed an account can you: post, use chats and direct messages, create organisations or events, follow people or events, and extend a public profile of your own.

Ghost (unclaimed) people. If an organiser has added you but you have not claimed an account, you can still use a magic login link to reach your own portal - your itinerary, and the forms an organiser has sent you - without claiming anything. Using a magic link this way does not create a social account, and you never gain the social capabilities listed above until you choose to claim.

What you always keep, whether or not you claim. Regardless of whether you ever claim an account, you always retain the ability to:

• ask us to correct data about you;
• ask us to remove data about you, which we honour wherever feasible (an organiser's own event records may need to persist for that event);
• unsubscribe from non-essential email.

Your travel and contact details (such as flight, accommodation, and phone information) are never made publicly visible on Hallway.

What we collect and why

Account and identity data

When you sign in, we store the data needed to identify you and keep your account secure:

• Email address. Used to identify your account, send you sign-in links, and send service messages. An account can have more than one verified email identity.
• Sign-in method. You can sign in with a one-time magic link sent to your email, with a password (which we store only as a salted hash, never in readable form), or with Google. If you use Google, we receive the basic profile claims you consent to at Google's prompt - your OpenID identifier, email address, name, and profile picture URL (the openid, email, and profile scopes). We do not receive your Google password, and we do not request access to your Gmail, Drive, Calendar, or contacts.
• Session data. When you are signed in we set a session cookie so you stay signed in between pages. See "Cookies and similar technologies" below.

Profile data

Your profile is the information you choose to publish about yourself as a speaker or participant. It can include your display name, a public handle, a short biography, your profile photo or avatar, a home time zone, and an approximate home location if you set one. Onboarding answers (the roles and topics you select) are stored to tailor what Hallway shows you. Profile data you mark as public is visible to other users and may be indexed as part of the public directory.

Data organisers enter about you

If you are a speaker, an event organiser may enter or import information about you so they can plan the event. This can include:

• Your name, email, biography, links, and photo (for example imported from a public speaker profile - see "Where directory data comes from").
• Travel and logistics data entered on your behalf: flight details (flight number, scheduled times, airport, and direction of travel), accommodation (hotel name and address, and stay dates), ground-transfer details (pickup and drop-off locations and times), and related notes.
• Contact and requirements data captured through forms an organiser sends you, which can include a phone number, dietary or accessibility requirements, and any other questions the organiser asks.

We process this data to provide the event-coordination features to the organiser and to you, and to show you your own itinerary. Organisers are responsible for having a proper basis to enter data about you, and for keeping it accurate (see our Terms). Some fields an organiser collects are treated as sensitive and are masked in the interface until an organiser with the right permission chooses to reveal them. Some of these - in particular dietary requirements and accessibility needs - can amount to special category or health data; we treat them accordingly, keeping them in the private visibility tier (never public), masked by default, and deleted on the same schedule as other participant data.

Form responses

When you answer a form - for example a CFP submission, a speaker questionnaire, or a logistics form - we store your responses and associate them with your profile and the relevant event. CFP submissions and similar free-text answers are automatically scanned for personal data so that sensitive details can be masked from people who should not see them.

Content you create

If you submit a talk, post to a community space, follow an event, or otherwise create content, we store that content and the fact that you created it.

Analytics data

We measure how the site is used with a privacy-preserving, cookieless first-party beacon. When you view a page or take a tracked action (for example clicking through to a CFP), the beacon records the type of action, the page path, and the host of the referring site (the referring host only, never the full referring URL or its query string). To count unique visitors without identifying anyone, we compute a short one-way hash from your IP address and browser user-agent combined with a server secret that rotates every day. We do not store your raw IP address or user-agent in the analytics tables, we do not set an analytics cookie, and the daily-rotating input means the hash cannot be tied back to you across days. The beacon does not identify you. If your browser sends a "Do Not Track" or Global Privacy Control signal, we go further and do not record the visit at all - not because the beacon tracks you, but because that is the strongest reading of your request.

We may also record operational logs and error reports (which can include an IP address, a request path, and a user-agent) for security, debugging, and abuse-prevention purposes.

How we use your data

We use the data described above to:

• provide, maintain, and secure the Hallway platform and your account;
• operate the public conference and CFP directory;
• let organisers run their events and coordinate speakers, including travel and logistics;
• send you service messages such as sign-in links, form invitations, reminders, and confirmations;
• understand and improve how the service is used; and
• detect, prevent, and respond to abuse, fraud, and security incidents.

The lawful basis depends on who controls the data. For organiser-entered participant data we are the processor: the organiser is the controller and determines the lawful basis, and we act on the organiser's instructions under our Data Processing Addendum. For Hallway's own surfaces - your account and authentication, the cookieless analytics beacon, operational and security logs, and discovery of public event listings for the directory - we are the controller, and where your local law requires a lawful basis we rely, depending on the activity, on performing our contract with you (running your account), our legitimate interests in operating and securing an independent, commercial directory (analytics, logs, abuse prevention, and compiling public listings), your consent where we ask for it, and compliance with legal obligations. You can withdraw consent, or object to processing based on legitimate interests, using the contacts and rights described below.

Automated processing and AI

Hallway uses third-party large language model providers for the following purposes:

• Directory enrichment (via OpenRouter). We send the public content of conference and CFP web pages (the pages our documented crawler reads) to a small, fast language model, accessed through OpenRouter, to classify and structure them for the directory. This concerns published event information, not your private account data.
• Administrative log assistant (via OpenRouter). Our staff can query operational system logs with a model-assisted tool. This operates over internal logs (which may reference an account identifier and a request path), not over your profile, itinerary, or the content of your form responses.
• Detecting personal data in CFP submissions (via Anthropic). When you submit a CFP or similar free-text answer and the event's organiser has switched this feature on in their CFP settings (it is off by default), the text is sent to Anthropic to detect passages that identify a person (for example a name or employer), so that those passages can be masked from reviewers who are meant to assess your submission blind. This processing exists to protect you, not to profile you. When the feature is off, a deterministic on-server scanner runs instead and no submission text leaves Hallway.

Providers reached for directory enrichment. Enrichment and embedding of public event-listing content is routed through OpenRouter to a fixed roster of downstream model providers. Because this content is already public, we route freely within this roster - for example to work around an outage, or for quality or cost reasons:

Alibaba Cloud (Qwen), ByteDance, DeepSeek, MiniMax, Moonshot AI, Tencent, and Z.ai (Zhipu AI) are based in China and are used only for processing publicly available event-listing content; they are never used for form responses, CFP submissions, or any organiser-entered participant data. Data sent to them for that limited, public-data-only purpose may be processed in China and subject to Chinese law. This enrichment roster processes public content only; participant data an organiser enters is governed by our Data Processing Addendum, whose separate sub-processor list does not include this roster.

We name the providers that process this text; the specific model versions used within a provider are operational detail, can change without changing who processes your data, and are not listed on these legal pages. The model providers process this text on our instructions and do not use it to train their models. We do not use your personal profile data, form responses, or travel logistics to train, fine-tune, or otherwise modify any AI model, and we do not sell your data to anyone.

Who we share your data with

We do not sell your personal data. We share it in the following limited ways.

With event organisers. When you take part in an organiser's event as a speaker or through their forms, the organiser can see the data relevant to that participation.

With other users and the public. Profile and content you publish, and listings in the public directory, are visible to others by design.

With service providers (processors) who act on our instructions. We use:

As a source, not a recipient: Sessionize and the open-data projects listed on our data sources page are places we read public speaker and event data from; we do not send your data to them.

For legal reasons. We may disclose data where we are required to by law, or to protect our rights, users, or the security of the service.

Where directory data comes from

Some information in Hallway is gathered from public sources rather than entered by you: our documented crawler reads conferences' own public web pages (see about the Hallway bot), and organisers can import public speaker profiles from platforms such as Sessionize. Every listing sourced this way is reviewed by a human before it appears, and any listing can be corrected or removed on request (see below).

Unclaimed profiles and how to claim or remove your data

Because organisers can add or import speakers, an "unclaimed" (ghost) profile may exist for you before you have ever used Hallway. An unclaimed profile is one that no signed-in person controls yet.

Importing you does not, by itself, contact you. An organiser reviews who was imported and takes a separate, deliberate action to invite them through Hallway; that invitation explains what we hold about you and includes both the claim link and the removal path described below.

• To claim it: verify an email address associated with the profile - for example by following an invitation link, or by signing in with that email. Once you prove ownership, the profile becomes yours to edit, correct, or hide, and any duplicate profiles for the same verified email are merged into your account.
• To correct or remove it without creating an account: contact us at hello@hallway.events and ask. We will correct or delete data about you, or exclude a source from future imports, on request - no justification required.

Data retention

We keep your account and profile data for as long as your account is active.

Organiser-entered participant data (such as form responses and travel logistics) is retained according to the organiser's instructions as controller. When an organiser stops using the Service or asks us to delete it, we delete that data as processor within 30 days, as set out in our Data Processing Addendum - except where we must retain something to comply with a legal obligation or where it sits in routine backups, which expire on their normal 30-day cycle.

Hallway's own operational records are held for a bounded window rather than indefinitely: our application, security, and LLM-call logs are rotated automatically and deleted after 90 days, and raw analytics events are deleted on the same 90-day cycle after being aggregated into non-identifying daily counts (the aggregated counts contain no identifier for you). Those aggregated daily counts contain no identifier for any individual, so we keep them indefinitely as anonymous statistics about how the site is used over time.

When you delete your account, we delete or anonymise your personal data within 30 days, except where we must retain something to comply with a legal obligation, resolve disputes, or enforce our agreements. Profile photos and images are removed from storage once no record points to them.

Your rights

Depending on where you live, you may have some or all of the following rights:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data ("right to erasure");
• export your data in a portable format;
• object to or restrict certain processing, including profiling; and
• withdraw consent where we relied on it.

You can exercise many of these directly by signing in and editing or hiding your profile and content. To delete your account or the data we hold about you, and for anything else you cannot do yourself - including claiming, correcting, or removing an unclaimed profile - contact us at hello@hallway.events and we will action it. If you are not satisfied with our response, you may have the right to complain to your local data protection authority.

Cookies and similar technologies

Hallway uses a small number of cookies. The essential ones keep you signed in and protect forms against cross-site request forgery; without them the service cannot function. We may also store your interface preferences (such as your colour theme) on your device. Our usage analytics are cookieless - they use the daily-rotating one-way hash described under "Analytics data" rather than a cookie or any persistent identifier. For more detail see our Cookie Policy.

Children

Hallway is not directed at children. You must be old enough to consent to this processing under your local law (at least 16 in many places) to use the service.

Law enforcement and government requests

We may disclose personal data when required by law, subpoena, court order, or other legal process. When permitted by law, we will notify affected users before disclosing their data in response to a legal request, unless we are legally prohibited from doing so or we believe notification would create a risk of harm.

We evaluate each request to ensure it is legally valid and appropriately scoped. We do not provide law enforcement with direct access to our systems, and all responses to legal requests are handled through our contact at hello@hallway.events.

International transfers

Our service providers may process data in countries other than your own, including the United States, where Hallway is operated. The safeguard depends on which kind of data is moving.

Participant data - the data an organiser enters, imports, or collects about their speakers and form respondents - is transferred under the safeguards set out in our Data Processing Addendum: the EU Standard Contractual Clauses and the UK International Data Transfer Addendum are incorporated into that addendum by reference and apply automatically to transfers of participant data out of the EEA and UK, with no separate request needed.

Hallway's own controller-side data - your account, profile, and authentication data, the cookieless analytics beacon, and our operational and security logs - is processed by our United States-based service providers (among them Railway, Cloudflare, Resend, Sentry, Arcjet, Google, and Anthropic). Each of these providers maintains its own data processing terms governing international transfers, and most incorporate the EU Standard Contractual Clauses in those terms. We rely on those provider-level commitments as the transfer safeguard for this data, rather than adopting a separate mechanism of our own.

Directory enrichment providers reached through OpenRouter, including the China-based providers named under "Automated processing and AI" above, are a different case: we do not claim a Standard Contractual Clauses arrangement or any other named transfer mechanism for that leg. Instead we limit what reaches that roster in the first place - it processes only public event-listing content, information a conference or its organiser has already published to the world, and it is never used for account data, form responses, CFP submissions, or any other participant data.

Security

We protect your data with encryption in transit (TLS), encrypted backups, hashed and salted secrets, access controls, and rate limiting and abuse protection. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident. A fuller description of our security posture is on our Security page.

Changes to this policy

We may update this policy from time to time. When we make a material change we will update the "Last updated" date above and, where appropriate, tell you through the service. Continuing to use Hallway after an update means you accept the revised policy.

Contact us

Questions about this policy, or requests about your data, can be sent to hello@hallway.events.