Privacy Policy
AI Sustainable Development Group, Inc. ("we", "our", or "us") is a nonprofit charitable organization registered in the State of New York and a 501(c)(3) organization. We operate Habibi Tech and the Habibi Tech Summit. This policy explains what personal information habibi.tech collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
This policy covers habibi.tech, the public website where tickets, booths and sponsorships are sold and where applications are filed. The Habibi Tech community platform (the mobile app and portal.habibi.tech) has its own policy, because it collects different information for different reasons.
1. Information You Give Us
Buying a ticket, a booth, or a sponsorship
- The name and email address of every attendee on the order. Each admission is issued to a named person, so a ticket bought for somebody else carries their details rather than the buyer's.
- The buyer's name and email address, and the organization where one is given.
- What was bought, what it cost, any promo code or group saving applied, and the resulting order and ticket records.
- A QR code for each admission, and a record of when and at which event it was scanned at the door.
Applications and forms
- Volunteer applications: name, email, phone, date of birth, which days and shift you can work, and which posts you are offering to cover. See section 11 on our minimum age.
- Press pass applications: outlet, role, publication website, planned and previously filed coverage, and the name and email of every member of your crew.
- Speaker nominations: the nominator's details, and the name, contact details, role and organization of the person being nominated. See section 3.
- Sponsorship enquiries, contact forms, deck downloads and the Seven Stands pledge: the name, email, organization and any message you provide.
Payment information
- Payments are processed by Stripe. We never receive or store your card number, CVC, or full payment details. Card data is entered directly into Stripe's payment form and goes to Stripe, not to us.
- We do receive and store a record of the completed payment: the amount, the currency, the last status of the charge, Stripe's identifiers for it, and the processing fee. Bank transfers and cheques are recorded the same way, by an administrator, with a reference.
2. Information Collected Automatically
Analytics
- Pages viewed, links and buttons clicked, JavaScript errors encountered, and clicks that produced no result. This is collected through a third-party analytics provider on our behalf.
- Approximate location derived from your IP address (typically city or region level), your browser and device type, and the site or advertisement you arrived from.
Session recording
- On our checkout, upgrade and application pages only, we record a replay of the session: the pages you move through, your mouse movement, scrolling, and clicks. This is used to find out why a payment or a form fails, which is otherwise close to impossible to diagnose.
- Text you type into form fields is masked and is not captured. We do not record keystrokes, card details, or the contents of inputs.
- This applies to our checkout, upgrade, booth and application pages. It is switched off everywhere else on the site, including the homepage. Once a recording starts it continues for the remainder of that visit.
Attribution and testing
- We store how you first reached the site and how you most recently reached it, including any campaign tags or advertising click identifiers in the URL. This is kept in your browser's local storage for 30 days.
- We run A/B tests on page copy and layout. A random identifier is stored in a cookie so that you see a consistent version of a page across visits. We do not test prices.
- We generate a random identifier for your browser, stored in local storage, so that activity in your browser can be matched to the corresponding server-side record of the same action. It is not derived from anything about you.
3. Information We Receive From Other People
Some information reaches us from somebody other than you, and you may not have been in contact with us at all when it does.
- Speaker nominations. A member of the public can nominate somebody to speak. We store what the nominator tells us about that person, and we then run an automated research pass that searches publicly published sources and drafts a short biography from what it finds. See section 6.
- Attendees named by a buyer. Somebody may buy a ticket for you and give us your name and email so the admission can be issued to you.
- Crew and team members named on a press application or a booth order.
If you were added this way and would rather not be in our records, write to info@habibi.tech and we will remove you.
4. How We Use Your Information
- To sell you a ticket, booth or sponsorship, and to admit you at the door.
- To send you what you need in order to attend: confirmations, QR codes, receipts, schedule changes and practical detail about the venues.
- To review and decide applications for press passes, volunteering and speaking.
- To answer you when you write to us.
- To send you news about the event and future events, where you have asked for it or have previously taken part. Every one of these carries an unsubscribe link.
- To understand how the site is used, to find and fix what is broken, and to measure whether our advertising is working.
- To meet our accounting, tax and legal obligations, and to prevent fraud.
5. Advertising and Meta
We advertise on Meta platforms (Facebook and Instagram) and we measure those advertisements in two ways that between them involve sharing information with Meta.
- The Meta Pixel runs on our pages and reports page views and actions such as beginning a checkout.
- The Conversions API. When a purchase completes, our server sends Meta a record of it. That record contains: your email address hashed with SHA-256, your IP address, your browser's user agent string, Meta's own cookie identifiers where present, our random browser identifier (also hashed), and the value and contents of the order.
Hashing means Meta does not receive your email address in readable form. It does mean Meta can match the hash to an existing account, which is the purpose. Your IP address is sent as-is. This information is used to attribute purchases to advertisements and to build audiences, including audiences of people who resemble our existing attendees.
We do not sell your personal information. To be precise about what that does and does not mean: we take no money for your data, and no third party is given it to use for their own independent purposes. Sharing information with Meta so that our own advertising can be targeted and measured is nonetheless a disclosure to a company that is not us, which is why it is set out above rather than summarised.
You can limit this. Most browsers can block these cookies; Meta offers its own ad preference controls; and browser extensions that block trackers will stop the pixel loading. See section 10.
6. Artificial Intelligence and Automated Processing
We use automated systems, including AI models, in four places.
- Drafting biographies of nominated speakers. When somebody is nominated, an automated pass searches publicly published sources about that person and drafts a short biography and a one-line description from what it finds. Nothing it writes is published unless that person is later confirmed as a speaker.
- Deciding what to send you. We calculate, for each person in our contact records, how recently and how often we have emailed them, whether they have opened or clicked recent emails, roughly how far they are from New York, and which stage of the ticket funnel they are at. These are used to decide who receives which email and to avoid contacting anybody too often.
- Support. Mail sent to our support address is read by an automated system that assembles the context needed to answer it and drafts a reply.
- Diagnosing failures. When a step of the site breaks, an automated system reads the affected sessions in order to explain what went wrong.
None of these makes a decision with a legal or similarly significant effect on you without a person involved. You can ask us not to apply any of it to you, and you can ask for a human review of anything that has been.
7. Cookies and Local Storage
We use the following. None of it is used to build a profile for anybody else.
- Strictly necessary: Stripe's checkout cookies, and security and load balancing cookies set by our host.
- Analytics: cookies set by our analytics provider, which identify a browser across visits.
- Advertising: Meta's _fbp and _fbc cookies.
- A/B testing: ht_uid and ht_exp, which keep you on one version of a page, and ht_optout if you have opted out.
- Local storage: how you arrived at the site (30 days), and a random browser identifier.
We do not currently show a cookie banner. Analytics and advertising technologies load when you open the site. If you would prefer they did not, browser settings and tracker-blocking extensions will stop them, and we will honour a request under section 10.
8. Who We Share Information With
We do not sell your personal information. We share it with service providers who work for us, each only so far as they need it to do their job, and each bound by a contract that stops them using it for anything else. They are:
- Payment processing. Our processor takes the payment and holds the card details we never see. Your payment is also subject to their own privacy policy, which is shown to you at the point of payment.
- Hosting, database and file storage. Where this website runs and where orders, tickets and applications are held, along with the server logs that come with running a website.
- Email delivery. Sending your confirmations, receipts and any news you have asked for, and recording whether a message was delivered, opened or clicked.
- Analytics and session recording. The measurement and replay described in section 2.
- Advertising platforms. The measurement and audience building described in section 5.
- AI providers. The automated processing described in section 6.
- Internal collaboration and messaging tools used by our own team, where an application or an enquiry is copied so it can be reviewed and decided.
- Embedded maps on our venue pages, provided by a mapping service.
All of these are based in the United States. We will tell you which company sits behind any of these categories if you ask us at info@habibi.tech, and if you are in the EEA or the UK you have a right to that answer.
We may also disclose information where the law requires it, to establish or defend legal claims, or to protect the safety of attendees. If the organization is ever merged or its activities transferred, records may transfer with it, and this policy would continue to apply to them.
9. How Long We Keep It
- Orders, tickets and payment records: for as long as our accounting, tax and audit obligations require, which for a New York nonprofit is a number of years after the financial year concerned.
- Session recordings: deleted automatically after 30 days.
- Analytics events: deleted automatically after 1 year.
- Applications (press, volunteer, vendor, speaker): kept for the event they relate to and for one following cycle, so that we can recognise a returning applicant.
- Contact records and email history: kept until you unsubscribe or ask to be removed, after which we keep only the minimum needed to make sure we do not contact you again.
- Attribution and testing data in your browser: 30 days, or until you clear your browser storage.
10. Your Choices and Your Rights
To exercise any of these, write to info@habibi.tech. We will not charge you and we will not ask why.
- Unsubscribe from any email using the link at the bottom of it. This does not stop confirmations and receipts for something you have bought, which we have to send.
- Access a copy of what we hold about you.
- Correction of anything inaccurate, including the name printed on a ticket.
- Deletion of your information, subject to records we are required to keep, such as a completed sale.
- Objection to our using your information for marketing or for the advertising measurement in section 5, which we will act on without needing a reason.
- Portability of the information you gave us, in a machine-readable form.
- Withdrawal of consent at any time, where we relied on your consent.
11. Minimum Age
The Habibi Tech Summit is a professional event intended for adults. We do not knowingly collect information from anybody under 16.
The one exception is deliberate: volunteers may apply from the age of 16, and that application asks for a date of birth, which we use to check eligibility and to make sure nobody under age is assigned to a post with a higher minimum. A date of birth collected this way is used for that and for nothing else. If you are under 18 we would encourage you to have a parent or guardian read this policy with you, and a parent or guardian may contact us to see, correct or delete what we hold.
12. Where Your Information Is Held
We operate from the United States and our service providers are listed in section 8. If you are visiting from outside the United States, including from the European Economic Area or the United Kingdom, your information is transferred to and processed in the United States, which may not offer the same protections as the law where you live. Where the law requires it, these transfers are made under Standard Contractual Clauses or another approved safeguard.
13. If You Are in the EEA or the UK
AI Sustainable Development Group, Inc. is the data controller. Our lawful bases for processing are:
- Performance of a contract: selling and issuing your ticket, admitting you at the door, and everything you need in order to attend.
- Legitimate interests: running and securing the site, diagnosing failures, preventing fraud, reviewing applications, and telling previous attendees about the next event. We have weighed these against your interests and you may object at any time.
- Consent: analytics, session recording and advertising measurement, and marketing email to people who have not previously taken part. You may withdraw it at any time.
- Legal obligation: accounting and tax records.
You have the rights in section 10, and the right to complain to your national data protection authority.
14. Changes to This Policy
We will update the dates at the top whenever this policy changes. Where a change is significant, and particularly if we start using your information for something this policy does not already describe, we will tell you before it takes effect rather than afterwards.
15. Contact
For any question about this policy, or to exercise any right in it:
AI Sustainable Development Group, Inc.
Email: info@habibi.tech
Web: https://habibi.tech