Privacy Policy

Boston AI Week is an independent community festival for the Massachusetts AI community, operated by SmartCurrent Inc. ("SmartCurrent," "Boston AI Week," "we," "us," or "our"). SmartCurrent Inc. is the data controller (or "business," under U.S. state privacy laws) for the personal information described in this policy. We respect your privacy and are committed to collecting only what we need and being clear about how we use it. This Privacy Policy explains what information we collect through our website, newsletter, accounts, event RSVPs, Shop, applications, surveys, and forms (collectively, the "Site"), how we use and share it, the choices and rights you have, and how to reach us. By using the Site, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Site.

Scope of this policy

This policy covers information we collect through the Site and our related communications, including at events we produce ourselves. It does not cover: (a) events run by independent hosts, who manage their own registrations and privacy practices; (b) sponsors, exhibitors, recruiters, or other organizations that collect information from you directly; or (c) third-party websites and services we link to or embed. Those parties are independent and govern their own data practices.

Information we collect

We collect the following, depending on how you interact with the Site:

• Newsletter signups. When you subscribe to schedule updates, we collect your email address and, optionally, the single role you select (attendee, host, sponsor, speaker, volunteer, or press). The role field is optional.
• Account registration. If you create a Boston AI Week account — for example, to build a personal schedule — we collect your email address, a securely hashed password, and any optional profile fields you choose to provide. You can also create an account by signing in with Google or by requesting a sign-in link by email. If you sign in with Google, Google sends us your name, email address, profile image, and a Google account identifier, and Google's privacy policy governs its own handling of your data. We also record the version of our Terms of Service you accepted, when you accepted it, and the IP address and browser used, so we can evidence the agreement.
• Event RSVPs and saved schedule. When you mark yourself as "Going" to an event, save an event, or build a personal schedule, we record those selections and associate them with your account or email so we can display your agenda, generate calendar files (.ics), and send you relevant reminders and updates.
• Event submissions (hosts). Our "Host an Event" form is built into the Site. The information you enter — including host name, email, organization, mobile number, and event details (title, description, format, date and time, location or virtual link, pricing, visibility, capacity, registration link, and logo) — is stored in our database and used by us to review, approve, publish, and promote listings. Your progress is saved as you complete the form so you can return to it.
• Applications to attend, speak, or volunteer. When you apply to attend the Boston AI Summit or another application-based program, apply to speak, or volunteer, we collect the information you enter, such as your name, email, organization, title, LinkedIn or website, availability, and your answers to the application questions.
• Shop orders. When you buy merchandise, we collect your name, email address, the items and options you order, your fulfillment choice (pickup or shipping), and, for shipped orders, the shipping address you enter on the payment step. Payment card details are entered on Stripe's secure checkout and are processed by Stripe; we never receive or store your full card number. We receive order and payment status, the card brand and last four digits, and the billing details Stripe returns to us.
• Survey responses. When you respond to the State of AI in Massachusetts survey or another survey we run, we collect your answers (for example, your role, organization type, sector, region, and views on AI adoption and the ecosystem) and, only if you provide it, your name and email address for the purposes you opt in to, such as being quoted or contacted.
• Sponsor prospectus requests. When you request our sponsor prospectus or contact our sponsorship team, we collect your full name, company, title, and work email, and any message you include, so we can send you the materials and follow up.
• Contact messages. The form on our Contact page opens a message in your own email application addressed to info@aiweek.boston. We receive the email you choose to send (which includes the name, email, organization, topic, and message you enter) and handle it like any other email; we do not maintain a separate stored database generated by that form.
• Code of Conduct reports. If you report an incident, we collect the details you provide, including who was involved and what happened, and keep records of our review.
• Event photography and recordings. We and our photographers, videographers, and media partners take photos and video at Boston AI Week events, which may include your image, likeness, and voice. Our use of these is described in the media release in our Terms of Service.
• Usage and technical data. When you use the Site, we automatically collect standard technical information such as your IP address, device and browser type, operating system, referring page, the pages and events you view, the links and calls-to-action you interact with, and the dates and times of access. We collect this through server logs and the analytics tools described below.
• Email engagement. Our email provider records whether the emails we send are delivered, opened, and clicked so we can measure and improve our programs and suppress addresses that bounce.
• Communications. If you email or call us, we keep a record of that correspondence so we can respond and maintain context.
• Opt-in choices. When you tick the sharing opt-in or subscribe to updates, we record the choice, the wording you saw, the recipient list in effect, and when and where you made it.

We do not intentionally collect special categories of personal data (such as health, biometric, precise geolocation, or government-identifier data) through the Site, and we ask that you do not submit such information through our forms. If you tell us about an accessibility or dietary need so we can accommodate you at an event, we use that information only for that purpose.

How we use your information

We use personal information to:

• Operate, maintain, secure, and improve the Site, the schedule, accounts, and RSVP and personal-schedule features.
• Build and display your personal agenda and generate calendar files at your request.
• Send festival updates, schedule launches, session announcements, reminders, and host or sponsor call-outs to people who have asked to hear from us.
• Tell you about Boston AI Week programs, events, the Shop, surveys, and opportunities to participate, host, speak, sponsor, or volunteer, using any email address you have given us as described under "Marketing communications and your choices," with an unsubscribe link in every marketing email.
• With your explicit opt-in, share your name, email address, and organization or title with the sponsors, partners, and exhibitors listed on the Site, as described under "Sponsors and sharing."
• Share aggregated, de-identified statistics with sponsors and partners.
• Send account and transactional messages, such as sign-in links, RSVP confirmations, event changes or cancellations, order confirmations and pickup instructions, application decisions, notices of updates to our Terms or this policy, and security notices.
• Review, approve, publish, and promote events submitted by hosts.
• Review and administer applications to attend, speak, or volunteer, and produce speaker and program materials.
• Fulfil, deliver, and support Shop orders and handle defective-item claims.
• Produce and publish aggregated, de-identified research from survey responses, and contact or quote respondents who have explicitly opted in.
• Prepare guest lists for Official Events where a venue requires them for building security or access control.
• Publish photographs and recordings of events to document and promote the festival, as described in our Terms.
• Respond to inquiries about hosting, sponsorship, press, volunteering, and general questions.
• Provide requested sponsorship materials and follow up with prospective sponsors.
• Understand aggregate usage (which pages and events are popular, which calls-to-action work, where errors occur) to improve the experience.
• Detect, prevent, and address security incidents, fraud, abuse, and violations of our Terms or Code of Conduct, and review and act on Code of Conduct reports.
• Maintain records of your acceptance of our Terms and of your privacy choices.
• Comply with legal obligations and enforce our agreements.

Legal bases for processing (EEA / UK)

Where the EU or UK GDPR applies, we rely on the following legal bases: consent (for example, newsletter subscriptions and non-essential cookies); performance of a contract or steps taken at your request (for example, creating your account, displaying your schedule, fulfilling a Shop order, processing an application, or responding to a prospectus request); legitimate interests (for example, operating and promoting the festival, sending festival updates and marketing to people who have taken part in Boston AI Week or given us their email address, with an easy opt-out in every message, securing the Site, documenting events, and understanding aggregate usage, balanced against your rights); and compliance with a legal obligation. You may withdraw consent at any time, without affecting processing already carried out.

Marketing communications and your choices

We send marketing and informational emails only to people who have asked to hear from us — for example, by subscribing to the newsletter, creating an account, or requesting our prospectus. You also ask to hear from us when you RSVP to an event, register for or attend an Official Event, make a Shop purchase, submit an event, apply to attend, speak, or volunteer, request sponsorship or partnership information, or give us your email address on the Site or at an event, including on a survey where you tick the box to receive updates from us. We may send festival updates and marketing about Boston AI Week to any email address you give us in these ways, including dedicated messages we send on a sponsor's or partner's behalf ("sponsored messages"), which are labeled as sponsored and are sent from our own systems; the sponsor does not receive your information. We never use information from Code of Conduct reports, accessibility or dietary requests, or Shop payment details for marketing. Our emails relate to Boston AI Week and may include information about our sponsors; however, this means we may tell you about sponsors in our own communications — it does not mean we share your information with sponsors unless you have explicitly opted in to that sharing (see "Sponsors and sharing" below). Every marketing email contains an unsubscribe link, and you can opt out at any time by using that link or by emailing info@aiweek.boston. We comply with the U.S. CAN-SPAM Act and honor opt-out and consent controls for all subscribers regardless of location. Account and transactional emails (such as sign-in links, RSVP confirmations, order confirmations, event changes, and notices of updates to our Terms or this policy) are not marketing and are sent as needed to operate the Site; you can stop them by closing your account.

Sponsors and sharing

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing or advertising, unless you explicitly opt in as described in this section. Under no circumstances do sponsors of Boston AI Week receive attendee, participant, newsletter subscriber, account, RSVP, or analytics data from us, other than what you explicitly opt in to share through the sharing opt-in described below and the aggregated statistics described below. The only individual-level information a sponsor ever holds about a person is what that person provides directly to the sponsor — for example, through a registration form, badge scan, or sign-up sheet the sponsor operates on its own systems, outside the Boston AI Week site and outside our control — or what that person has explicitly opted in to have us share. When we feature sponsors or mention them in our communications, those communications are sent by us; sponsors are not given access to our lists or data beyond what you opt in to share.

The sharing opt-in. Boston AI Week uses one opt-in for sharing. Where it appears — for example, when you create an account, subscribe to updates, RSVP, apply to the Boston AI Summit, or register for the career fair — it is a separate, optional, unchecked box asking whether you would like Boston AI Week to share your name, email address, and organization or title (where a form collected them) with the 2026 Boston AI Week sponsors, partners, and exhibitors featured on aiweek.boston, meaning every organization with a logo or partner page on the Site for 2026, including career fair employers, as listed at aiweek.boston/sponsors, so they can contact you about their programs, jobs, products, and events. You only need to tick it once: while your opt-in is active we do not ask again, and you can see and withdraw it from your account (My Schedule) or by emailing info@aiweek.boston. If you do not tick the box, nothing is shared. Sharing is at Boston AI Week's discretion; opting in does not entitle you or any organization to have your details shared. Your opt-in covers the organizations on that list when you opt in and any sponsor, partner, or exhibitor added to the Site during the 2026 festival cycle (through December 31, 2026); we record the list in effect at the moment you opted in, we share only with organizations on the list, and the opt-in does not carry over to a later festival year, where we will ask again. We require each recipient to use your details only for the stated purposes, to honor your opt-out requests, to protect the data, and not to sell or pass it on; the recipient then processes it as an independent controller under its own privacy practices. Withdrawing stops future sharing, although a recipient will keep what it already received. A form may occasionally name a specific sponsor for a specific session; the same box, rules, and rights apply. Sharing you direct in this way happens at your request and is not a "sale" or "sharing" of personal information as those terms are defined under applicable U.S. state privacy laws.

Aggregated statistics and audience insights. We may share aggregated, de-identified statistics and insights with sponsors and partners, and publish them in reports — such as page views, RSVP totals, attendance counts, engagement, and audience composition by role, sector, or seniority — that do not identify any individual.

For clarity: (a) if a venue for an Official Event, including a venue that is also a sponsor or partner, requires a guest list for building security, we may provide the names of registered guests to the venue's security desk solely for admission, and we require that the list not be used for any other purpose; (b) survey responses are shared with research partners and sponsors only in aggregated, de-identified form, unless you explicitly opt in to be quoted or contacted; and (c) apart from the opt-in sharing described above, if we ever offer another feature that lets you share your information with a sponsor, recruiter, or host, we will ask for your explicit consent at that time, and sharing will apply only to the information you choose to share.

How and when we share information

We share personal information only in these limited circumstances:

• Service providers (processors). With the trusted vendors listed under "Service providers and sub-processors," who process information solely on our behalf and under contract.
• Payment processing. With Stripe, which processes Shop payments as an independent payment processor under its own terms and privacy policy.
• Co-producers, venues, and vendors of Official Events. Limited to what is needed for admission, safety, and delivery of the event, such as guest lists for building security or a caterer's headcount, and not for marketing.
• Photographers, media partners, and press. Event images and recordings, as described in the media release in our Terms.
• At your direction. When you choose to interact with a host, sponsor, recruiter, ticketing page, or other third party through the Site, the information you provide to them goes to them as independent controllers.
• With your opt-in. With the sponsors, partners, and exhibitors covered by the sharing opt-in you ticked, as described under "Sponsors and sharing."
• Legal and safety. When we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Boston AI Week, our participants, or the public, or to enforce our Terms or Code of Conduct.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will require the recipient to honor this Privacy Policy or provide notice of any material change.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws. Sharing that you explicitly direct by opting in is done at your request and is not a sale or share.

Independent event hosts, recruiters, and exhibitors

Boston AI Week lists events run by independent hosts and includes career and recruiting activities and sponsor or exhibitor activations. If you register for, attend, or interact with an individual event, booth, or recruiter, any information you provide to that party is collected and controlled by that party under its own privacy practices — not by Boston AI Week or SmartCurrent. We do not collect attendee information on a host's, recruiter's, or sponsor's behalf, and we are not responsible for their data practices. We do not provide your RSVP or contact information to hosts; if a host uses its own registration page — for example on Luma, Eventbrite, Meetup, Partiful, or a similar platform — we may email you and ask you to register with the host as well so the host has your details, and that platform processes your information under its own privacy practices, not ours.

Service providers and sub-processors

We rely on a small set of trusted providers to operate the Site and our communications. Each processes information solely on our behalf and is bound by its own security and privacy obligations:

• Lovable and Supabase (via Lovable Cloud) — application platform, hosting, database, authentication, and backend storage for accounts, submissions, applications, RSVPs, schedules, and orders.
• Email providers (Lovable Cloud Emails, Resend, and Google Workspace / Gmail) — Lovable Cloud Emails and Resend deliver our newsletter, program, and transactional emails from aiweek.boston addresses (including notify.aiweek.boston and news.aiweek.boston), with engagement tracking and storage of the subscriber list necessary to do so; Google Workspace (Gmail) hosts our staff mailboxes, including info@aiweek.boston, for correspondence with you.
• Stripe — payment processing for the Shop; card details are entered directly with Stripe.
• Google — Google Sign-In for account authentication, and Google Tag Manager and Google Analytics for deployment of analytics tags and aggregate website analytics. We do not embed Google Forms: every form on the Site, including the Host an Event form, is built into the Site, and the only Google service you interact with directly is Google Sign-In.
• Hosting, content delivery, DNS, and calendar/.ics generation — infrastructure that serves the Site and produces calendar files at your request.
• Host event-registration platforms (such as Luma, Eventbrite, Meetup, and Partiful) — used by independent hosts, not by us. When you register for a host's event on one of these platforms, the platform and the host process your information as independent controllers under their own privacy practices, as described under "Independent event hosts, recruiters, and exhibitors."

Cookies and analytics

We use cookies and similar technologies to operate the Site and to understand aggregate usage. These fall into two broad categories: strictly necessary technologies that make the Site work (for example, security, load balancing, remembering that you are signed in, remembering your cookie choice, and Stripe's fraud-prevention cookies at checkout), and analytics technologies deployed through Google Tag Manager and Google Analytics that help us measure traffic and improve the experience. Analytics tools may set cookies or similar identifiers on your device and transmit usage data to Google. You can control cookies through your browser settings or a tracking-protection extension, and the Site will continue to function. Where required by law, we honor recognized opt-out preference signals, including the Global Privacy Control (GPC), and we obtain consent for non-essential cookies.

When you first visit, a banner lets you accept or decline analytics cookies; strictly necessary cookies are always on. You can change your choice at any time using the "Cookie settings" link in the footer of every page. We use Google Consent Mode so that analytics tags run only after you consent where consent is required, and we treat the Global Privacy Control signal as a decline of analytics cookies. Cookies we use typically include a cookie that remembers your consent choice; Supabase authentication cookies that keep you signed in; Google Analytics cookies (such as _ga and ga*) when analytics is enabled; and Stripe cookies on the checkout step. Google Analytics is configured not to collect precise location and to retain user-level data for a limited period.

International data transfers

We are based in the United States, and our providers may process information in the United States and other countries. Where we transfer the personal information of individuals located in the EEA, the UK, or Switzerland to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable), together with supplementary measures where appropriate.

Data retention

We keep personal information only as long as we need it for the purposes described in this policy, after which we delete or anonymize it. In general:

• Newsletter subscribers: until you unsubscribe, after which you are promptly removed from active marketing lists (we may retain a minimal suppression record to honor your opt-out).
• Account data: for the life of your account; we delete or anonymize it on verified request or after a prolonged period of inactivity.
• Event RSVPs and saved schedules: through the relevant festival cycle plus a reasonable archival period for planning and historical metrics.
• Host submissions: through the relevant festival cycle and for a reasonable period afterward for recordkeeping and planning.
• Applications to attend, speak, or volunteer: through the relevant festival cycle and a reasonable period afterward for program planning and future invitations.
• Shop orders: for as long as needed to fulfil and support the order, and then as required for tax, accounting, and dispute records (generally seven years).
• Survey responses: identifiable responses and opt-in contact details for as long as needed to produce and support the research report and any follow-up you opted in to; aggregated, de-identified results indefinitely.
• Terms acceptance records: for the life of your account and for the period during which a claim could be brought afterward.
• Opt-in choices: for as long as the opt-in remains active, and afterward for the period needed to evidence it and to honor any withdrawal.
• Code of Conduct reports: for as long as needed to review, act on, and document the matter and to enforce any resulting decisions.
• Photographs and recordings: indefinitely, as part of the festival's documentary and promotional archive, subject to removal requests we agree to honor.
• Sponsor and contact correspondence: as long as needed to respond and for related follow-up and recordkeeping.
• Server logs and analytics: for a limited period consistent with our providers' defaults and our operational needs.

We may retain information longer where required to comply with legal obligations, resolve disputes, or enforce our agreements.

Security

We use industry-standard administrative, technical, and organizational safeguards to protect personal information, including encryption in transit (TLS), hashed passwords, role-based access controls, row-level database security, data minimization, and limited retention. Payment card data is handled entirely by Stripe, a PCI DSS Level 1 certified processor, and never passes through our servers. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify affected individuals and relevant authorities as required by applicable law, including, for Massachusetts residents, the notices required by Massachusetts General Laws chapter 93H.

Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information: to know/access what we hold; to correct inaccuracies; to delete it; to port a copy; to restrict or object to certain processing; to withdraw consent; to withdraw an opt-in to marketing or to sharing with a sponsor, exhibitor, or recruiter; and to opt out of the sale or sharing of personal information or of targeted advertising (note that we do not sell or share personal information or use it for targeted advertising). To exercise any of these rights, email info@aiweek.boston. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law permits. We will not discriminate or retaliate against you for exercising your rights. If we deny a request, you may appeal where applicable law provides an appeals process by replying to our response; you may also have the right to contact your local data protection authority or attorney general.

To close your account and delete the personal information associated with it, email info@aiweek.boston from the email address on the account. We may keep records we need for legal, security, accounting, or dispute purposes, as described under "Data retention."

California residents: we do not sell or share personal information and do not disclose personal information to third parties for their direct marketing purposes within the meaning of California's "Shine the Light" law.

Event photography

We and our photographers, videographers, and media partners take photos and video at Boston AI Week events to document and promote the festival. By attending, you agree to the photography, recording, and media release in our Terms of Service. If you prefer not to be photographed close-up, tell the photographer or an organizer at the event. To request the removal of an image of you from our own channels, email info@aiweek.boston; we will consider requests in good faith but cannot control images published by hosts, sponsors, media, or other attendees.

Children

Boston AI Week is intended for a professional, adult audience. The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with information, please contact us and we will delete it. Where an individual event may involve minors, the event host is responsible for any required parental or guardian consent and for handling that information appropriately.

Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not engage in these activities, no opt-out is necessary; however, we honor the Global Privacy Control where applicable as described above. Sharing you explicitly direct by ticking the sharing opt-in is done at your request and is not a sale or share; you can withdraw it for future sharing at any time from your account or by emailing info@aiweek.boston.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page, and where required by law we will provide additional notice. Your continued use of the Site after an update means you acknowledge the revised policy.

Each version of this policy has a version number and effective date, and prior versions are available at aiweek.boston/privacy/versions or on request. For material changes, we will notify account holders and subscribers by email or by a prominent notice on the Site before the change takes effect where practicable. We will not use personal information we have already collected for purposes materially different from those described in the version of this policy in effect when it was collected without first obtaining your consent.

Contact

SmartCurrent Inc., operator of Boston AI Week
1770 Massachusetts Ave, Suite 205, Cambridge, MA 02140
Email: info@aiweek.boston
See also our Terms of Service and Code of Conduct. Version 2.0, effective September 10, 2026. Previous version: June 5, 2026.