HereQ Privacy Notice
This notice is a supplement for HereQ, the attendance and event check-in service by IO Patina. It adds HereQ-specific details to the IO PATINA Account Privacy Notice, which also applies when you use HereQ.
It describes HereQ under notice hereq-notice-2026-10-22 (shown above): the notice you accept with “Continue & Agree” after signing in, and the one the guest pages refer to when you check in or register without an account.
Who is responsible
IO Patina LLC is the controller of the personal data described in this notice.
Signing in
- You sign in to HereQ with your IO PATINA Account. HereQ asks only for the basic sign-in scope (openid) and receives a pseudonymous account reference. Signing in does not give HereQ your email address or name.
- If your IO PATINA profile has a display name and HereQ is given access to it, HereQ may read that display name and your username to suggest a check-in name. They are not stored unless you save the name as your check-in name. HereQ currently has no such access.
- Where web sign-in is offered, a web session ends after 8 hours without use and after 7 days at most. Signing out erases the session’s sign-in tokens; the session record itself (an account reference and times) is not yet removed automatically.
What HereQ stores when you use your account
- The name you give an organizer for each event.
- Your HereQ check-in details, if you save them: your check-in name; optionally a contact email, phone number, company and team; and your preferred language.
- Event registrations: the fields an organizer asked for and you submitted. A copy of what you submitted is kept for that organizer.
- Attendance records: the time, the outcome, the method (such as QR code, Bluetooth or staff) and how the check-in was confirmed.
- Invitations and join requests.
- Check-in help requests you send to staff (for example no phone, Bluetooth not working, or accessibility), with the reason you picked and how staff resolved them.
- Your acceptance of the HereQ Terms and the history of your optional choices.
- Receipts for the exports and deletions you request.
If you take part without an account
- HereQ stores the name and the fields you enter for the event.
- Your browser creates a random device key. The server stores only a digest of it, not the key itself.
- The key stays in your browser. Your name stays there too, but only if you choose “Remember my name on this device”; unticking it removes the name.
Check-in methods and your device
- Bluetooth check-in tokens are short-lived, and the server stores them only as digests.
- When your phone broadcasts an event’s check-in signal, the app sends a random ID created for this installation of HereQ. The server keeps it with that event’s signal records so that only one phone broadcasts at a time. It is not your phone’s hardware identifier.
- When staff scan an ID document or a school or member card, it is read on the staff phone. To find the person on the event’s list, HereQ sends the name or names read from it (including up to two alternative readings) and, for a school or member card, the card or member number, together with the type of document and how it was read. Staff confirm the person before anything is recorded. HereQ keeps the confirmed name, the document type, how it was read and whether staff corrected it. A card or member number read from the card is used only to find the matching entry and is not stored in readable form. HereQ does not store document images, government document numbers, birth dates or addresses.
- Camera frames never leave the device that took them.
- HereQ does not collect your device location (GPS). On Android, the operating system requires the location permission to scan for nearby check-in signals; HereQ does not read or send your location.
- The Google ML Kit library inside the HereQ Android app may send usage and performance diagnostics (device and app information, a per-installation identifier) to Google.
Analytics and advertising
- Optional usage analytics are used only if you opt in. They are currently not collected.
- HereQ shows no advertising and does not sell personal data.
- Apart from the ML Kit diagnostics above, HereQ uses no third-party analytics or tracking SDKs.
If you host or staff events
- The name participants see for you or your organization, and each event’s settings: title, place, city, schedule, check-in methods and rules, and the information you ask participants for, with your reasons.
- Staff roles: who may run which events.
- An audit log of staff actions, such as check-ins, corrections, approvals, registrations made from an ID scan (with the document type and how it was read) and views of the registrations list. It names the staff member who acted and stays with the event’s records.
Organization lists
- Schools and companies that use HereQ may import their member list: names, student or member numbers, class or group membership, and card numbers, which are stored only as keyed hashes.
- One-time connection codes are stored only as digests.
- The organization decides what its list contains and may have its own notice for its records.
Who can see your data
- Organizers see only the data for their own events.
- Organizations such as schools and companies may have their own notices for their records.
Where data is stored and what is logged
- HereQ runs on its own server on Amazon Web Services Lightsail in the United States (us-west-2). Automatic snapshots of the server serve as backups and keep a copy of the data for a limited period.
- The web server’s access logs, for HTTPS requests and for the redirect from HTTP to HTTPS, record the time, method, path (without query strings), status, size and timing of each request. They do not record IP addresses.
- The web server’s error log may contain IP addresses, for troubleshooting.
- To limit repeated requests, the HereQ server holds the IP address of requests to its public pages (invitation previews and the no-account guest pages) in memory only. It is not written to the database or to logs.
- HereQ’s own service log records start-up and unexpected errors. HereQ does not write names, tokens or answers to it.
How long data is kept
- During the internal beta, event, attendance and registration records (with invitations, join requests, help requests and the audit log) have no automatic end date. Participants cannot delete events or these records; they stay with each organizer.
- Your HereQ check-in details are kept until you delete them.
- Your Terms acceptance, the history of your optional choices and the receipts for exports and deletions are kept after you delete your check-in details, as a record of what you agreed to and asked for.
- Backups keep a copy for a limited period, including of details you have deleted.
- Final retention periods will be published before general availability.
Your choices and rights
- In the HereQ app, open Settings → Privacy & Data to view or change your optional choices and to export or delete your HereQ check-in details.
- Your IO PATINA Account is separate from HereQ. Deleting the whole Account does not yet automatically delete your HereQ data, so delete your HereQ check-in details first in the app (Settings → Privacy & Data). If you can no longer do that, ask through the IO PATINA Privacy Center: HereQ deletes them and keeps a receipt. Event registrations and attendance records stay with each organizer; ask the organizer about them.
- To export or delete your whole IO PATINA Account, go to account.iopatina.com/privacy.
- To contact us, use the IO PATINA Privacy Center.