Legal

Privacy Policy

Last updated: November 6, 2026

This policy explains how Spruce Technology, Inc. ("Spruce", "we", "us") handles personal information in Talli, our event management platform. Talli includes the web app at app.tallievents.com, public event pages, the brand portal for exhibitors, and the Talli app for iPhone.

Who is responsible for your information

Talli is used by organizations that run events ("organizers"). When you register for an event, answer a survey, or visit an exhibitor's booth, the organizer of that event decides what it collects and how it uses it. The organizer is the controller of that information, and Spruce processes it on the organizer's behalf, following the organizer's instructions and our agreement with them.

If you are an attendee, a visitor, or an exhibitor at someone else's event, please contact that event's organizer first with questions or requests about your information. We will help organizers respond, and if you contact us directly we will pass your request to the organizer where we can identify them.

Spruce is responsible for the information we handle for our own purposes, such as organizer account details and keeping the service secure.

Information we collect

Organizers' team members. Name, work email, password (stored in hashed form), the organization you belong to and your role (owner, admin or staff). We also record the sessions you sign in with, including the IP address and browser or device type of each session, and a log of changes made in Talli, with who made them and whether they were made directly or through a connected AI assistant.

Attendees. What the organizer's registration form asks for. Every form asks for first and last name, work email, organization and preferred language, and may ask whether you need an interpreter and about accessibility needs. Organizers can add their own questions, for example a professional license number or meal choice. Talli also keeps your registration status, ticket code, check-ins at entry points and sessions (with time, place and the device that scanned you), session sign-ups, continuing education credits, the emails sent to you, and whether you unsubscribed.

Survey responses. Answers to an organizer's survey. On a named survey, answers are linked to your registration. On an anonymous survey, Talli does not record who answered: it keeps only the day each response was sent, and the network connection only as a keyed hash used to limit abuse.

Exhibitors and their staff. The brand's name, tagline, website, logo, and contact name and email, the names and emails of booth staff the brand adds, booth page content, and booth visits scanned by the brand.

Devices used for check-in. For each phone, tablet or browser used to check people in: a random device id, the device's name and model, app version, who is signed in, its entry point, when it last connected and synced, how many scans it is holding, and on the iPhone app, its battery level.

Technical information. Our hosting provider processes request data such as IP addresses to deliver and protect the service. To limit sign-in attempts and ticket lookups, we store short-lived counters keyed by a keyed hash of the email address, IP address or device id, never the value itself, and delete them when they expire.

How we use information

To provide Talli to organizers: registration, tickets, check-in, emails, surveys, sessions, exhibitors, reports and exports.
To send emails organizers schedule or that the service sends automatically, such as registration confirmations and sign-in links.
To translate event content and draft text when an organizer asks for it (see AI features).
To keep accounts and the service secure, prevent abuse, and fix problems.
To meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use attendee information for our own marketing.

The organizer. The organizer's team sees attendee information according to their role, and owners and admins can export it. Every export is recorded in the activity log.

Exhibitors. A brand learns about the attendees who visit its booth only as the organizer's lead sharing setting allows. When an organizer chooses to share contacts, the registration form asks attendees "Share my name and email with exhibitors I visit", which is never ticked in advance. Only attendees who agree are listed by name, organization and email, and an attendee can stop sharing at any time from their ticket page.

AI assistants an organizer connects. Organizer team members can connect their own AI assistant, such as Claude or ChatGPT, to Talli. The assistant works with the same permissions as the person who connected it. Answers marked sensitive, such as accessibility needs, are hidden from assistants unless an owner turns that off. What the assistant provider does with that information is governed by the organizer's own agreement with that provider. See AI assistants.

Service providers

We use these providers to run Talli:

Cloudflare, Inc. hosts the application and stores its data (database, files, temporary export files, background job queues), sends email from noreply@tallievents.com, and keeps operational logs.
Anthropic, PBC provides the AI models used for automatic translation and Write with AI.

We may also disclose information if required by law, to protect the rights and safety of people and the service, or as part of a merger, acquisition or sale of assets, subject to this policy.

AI features

Talli uses AI models from Anthropic for two features:

Translation. When an organizer offers an event in more than one language, Talli sends the event's text to be translated: for example the title and description, registration questions, agenda sessions and speaker bios, emails, surveys, booth pages and the event website. Comments attendees write in a survey can also be translated into the event's language for the organizer's team.
Write with AI. When an organizer asks for a draft, Talli sends their request, the chosen tone and reading level, and event details such as the title, date, venue and session titles. Attendee registrations are not part of this request.

This information is sent only to generate the text that was requested. AI-generated text is marked in Talli so the organizer can review it. See Write with AI and Languages and translation.

Cookies and local storage

Talli uses only cookies needed for the service to work. We do not use analytics, advertising or tracking cookies, and Talli does not load third-party tracking scripts.

Session cookie (better-auth.session_token, with a __Secure- prefix over HTTPS): keeps you signed in. It is HttpOnly and lasts up to 7 days, renewed while you use Talli. A brand portal session ends one day after the brand's last event.
Language cookie (talli_lang): remembers the language you picked on public pages, for up to one year.

On the web check-in page and the booth scanner, your browser also keeps a random device id, your chosen entry point, the event's check-in list and any scans not yet sent, so check-in keeps working without signal. Check-in lists are deleted when you sign out and a day after the event ends.

The Talli app for iPhone

The iPhone app is for organizers' door staff. It stores your sign-in token and a random device id in the iPhone's Keychain, and stores the selected event's attendee list (name, ticket code, attendee type, language and check-in status) and any scans not yet sent on the phone. The app uses the camera only to scan ticket codes, and only after you allow it. When you sign out, the app deletes the saved attendee list; scans that have not reached Talli are kept until they can be sent. The app does not include analytics or advertising tools. See Talli for iPhone.

How long we keep information

We keep information for as long as the organizer's account needs it to provide the service, and delete it when the organizer asks us to or when their account is closed, unless the law requires us to keep it longer. Some data is kept for shorter periods:

Export download links work once and expire after 10 minutes.
Requests from an AI assistant waiting for a person's approval expire after 10 minutes.
Rate-limit counters are deleted when their time window ends.
Offline check-in lists on a device are deleted on sign-out and, in the browser, a day after the event ends.

Cancelling, closing or unpublishing an event does not delete its registrations. Removing a person from an organization keeps their account and the history they created.

Security

We use reasonable technical and organizational measures to protect information, including encrypted connections, hashed passwords, role-based access within each organization, confirmation before exports and sensitive assistant actions, and an activity log of changes. No system is completely secure, and we cannot guarantee the security of information.

Your rights and choices

Depending on where you live, including some US states, you may have the right to know what personal information is held about you, to get a copy, to correct it, to delete it, and to opt out of certain uses. We do not sell or share personal information for cross-context behavioral advertising.

Attendees and visitors: contact the organizer of your event first, since they control your information. You can unsubscribe from an organizer's event emails using the link in any of them, and you can stop sharing your contact with exhibitors on your ticket page.
Organizer team members: contact us at the address below.

We will not discriminate against you for exercising these rights. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law allows. If we deny a request, you may appeal by replying to our decision.

Children

Talli is a business service and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will work with the organizer to delete it.

International transfers

Spruce is based in the United States. Our providers may process information in the United States and other countries where they operate. By using Talli, you understand that information may be processed outside the country where you live, where data protection laws may differ.

Changes to this policy

We may update this policy from time to time. We will change the date at the top, and if a change is significant we will tell organizers by email or in Talli before it takes effect.

Contact

Spruce Technology, Inc. operates Talli.

Questions about this policy? Email privacy@tallievents.com