Privacy Policy

1. What we collect

We only collect what CFPKit needs to run a call for papers.

Information you give us

• Account details: your name, email address and password. Passwords are stored only in hashed form; we never see them.
• Speaker profile (optional): a tagline, a short bio, a profile photo and links to your social profiles.
• Talk proposals: the title, abstract and other answers you give on an event’s submission form, any files you attach, and the history of your proposal’s status (for example submitted, accepted or confirmed).
• Organiser and reviewer content: events you create (name, dates, location, description, images, form questions, email templates), the people you invite to your team, and the scores, comments and decisions you record.
• Messages to us: anything you send to our contact address.

Information collected automatically

• Technical logs: like most websites, our servers record basic request information such as your IP address, browser type and the time of each request. We use these logs to keep the service running and secure.
• Session tokens: after you sign in, a session token is kept in your browser so you stay signed in (see Cookies and browser storage).

We do not use analytics or advertising trackers, and we do not buy personal data from anyone.

2. Signing in with Google

You can create an account or sign in with your Google account instead of a password. If you do, CFPKit asks Google only for the basic sign-in permissions (openid, email and profile).

• What we receive: your name, your email address, whether Google has verified that address, your Google account identifier and the link to your Google profile picture.
• How we use it: only to create your CFPKit account, sign you in, show your name in the app and send you service email at that address. We do not use your Google profile picture.
• What we never access: your Gmail, Google Drive, contacts, calendar or any other Google data. We do not receive your Google password.
• Sharing: your name and email are shared only as described in section 4, the same as for an account created with a password. We do not sell Google user data, use it for advertising, or transfer it to data brokers or information resellers. We do not use it to determine creditworthiness, to build databases unrelated to running CFPKit, or to train artificial intelligence or machine learning models.
• Retention: kept with your account and deleted with it (see section 6). You can also remove CFPKit’s access at any time from your Google Account’s connections page.

CFPKit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use your data

• To create and secure your account and sign you in.
• To run calls for papers: show events, accept proposals, let an event’s team review and decide on them, and record each step.
• To send service email: account confirmation and password reset, receipts for proposals you submit, team invitations, decisions about your talk, confirmation requests, and notices to organisers about their event. Organisers write some of these messages themselves using CFPKit’s templates.
• To keep CFPKit working, investigate problems, and prevent abuse or fraud.
• To answer you when you contact us.
• To meet legal obligations.

We process your data because you asked us to provide the service, and for these purposes only. We do not use it for advertising, and we do not sell it.

4. Who can see it and who we share it with

Inside CFPKit

• Event teams: when you submit a proposal to an event, that event’s organisers and reviewers can see it along with your name, email address and speaker profile. If the organisers turn on blind review, reviewers do not see who wrote it. Organisers can export their event’s proposals, and they are responsible for how they use what they export.
• Teammates: people on an event’s team can see each other’s names, email addresses, roles, scores and comments for that event.
• The public: published event pages, including their images, are public, and so is a profile photo you add. Proposals and their attachments are only ever visible to you and the event’s team.

Service providers

We rely on trusted third-party providers for hosting, data storage, authentication, content delivery and email delivery. They process personal data only on our behalf, under our instructions and confidentiality obligations, and only as needed to provide their service to us. If you choose to sign in with Google, Google also handles that sign-in.

Other disclosures

We may disclose information if the law requires it, to protect the rights, safety or property of our users or CFPKit, or as part of a transfer of the service to a new operator, who would remain bound by this policy. We never sell personal data.

5. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, and access controls that limit each person to the data their role needs. Your data is primarily stored in India and may be processed in other countries where our service providers operate, with safeguards that keep it protected.

No method of storing or transmitting data is completely secure. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires.

6. How long we keep it, and deleting it

• Account data, including data received from Google, is kept for as long as you have an account.
• Proposals and event content are kept until they, or the account that owns them, are deleted.
• Technical logs are kept for a limited time, normally no more than 30 days.
• Backups are overwritten on a rolling basis, so deleted data disappears from them within a short period.

To delete your account, email cfpkit@gmail.com from the address on your account. We will delete it within 30 days. Deleting an account also deletes the events it owns and the proposals it submitted. Copies that an organiser has already exported, or emails that were already sent, are outside our control.

7. Your rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you can:

• ask what personal data we hold about you and how we process it;
• correct or update it (most of it you can edit yourself in the app);
• ask us to delete it;
• withdraw consent, for example by deleting your account or removing Google access;
• nominate someone to exercise these rights for you in case of death or incapacity; and
• raise a grievance with us, and, if it is not resolved, with the Data Protection Board of India.

To make a request, write to cfpkit@gmail.com. We may need to confirm it is really you before acting.

8. Cookies and browser storage

CFPKit does not use advertising or analytics cookies. The application keeps your session token and a few interface preferences (such as light or dark theme) in your browser’s local storage so it can keep you signed in and remember your settings. Signing out removes the session. This website loads its typeface from a third-party font service, which receives your IP address when it delivers the font.

9. Children

CFPKit is not meant for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use your data, including data received from Google, we will tell you by email or in the app before it takes effect.

11. Contact and grievances

For any privacy question, request or complaint, email cfpkit@gmail.com. We aim to reply within 7 days and to resolve grievances within 30 days.