Privacy and erasure

#Personal data needs people:read

Names, email addresses, companies, phone numbers, answers to registration questions, buyers on orders and invoices: everything that says who somebody is needs the people:read scope. Without it the API still answers, with people as ids:

{
  "attendeeId": "b3ac0008-0000-4000-8000-000000000000",
  "ticketTypeName": "Conference pass",
  "firstName": null,
  "lastName": null,
  "email": null,
  "answers": null,
  "status": "active",
  "valid": true,
  "personalData": "withheld"
}

So a dashboard that counts tickets, a sync of the programme or an AI assistant that reports sales needs no personal data at all, and should not be given it. A call whose whole purpose is a person, such as searching attendees by name or reading leads, is refused without the scope (peopleScope).

Speakers and sponsors are on the event's public page, so their names are not personal data here; a speaker's email address is, and needs people:read.

#Somebody who deleted their data

An attendee can delete their data from the event app (More › Delete my data). From that moment:

• the API answers them with "erased": true, "personalData": "erased" and nothing personal, whatever scopes the key holds;
• search never finds them;
• answers kept for an Idempotency-Key that named them are deleted;
• the attendee.erased webhook tells every endpoint at once, by id only.

When you receive attendee.erased, delete or anonymise your own copy of that attendee. Their ticket was cancelled if the event was still to come (ticketCancelled), and no separate attendee.cancelled is sent. Invoices keep the buyer as printed, because the law keeps invoices for seven years.

#Modules switched off

An organiser can switch features off per event under the event's Modules. While one is off, its endpoints answer 409 with "code": "moduleOff" and the module's name, and its MCP tools say the same. Nothing is deleted: switched on again, the data is back.

#Never in an answer

• API keys, webhook signing secrets (except once, when made), payment providers' keys.
• A ticket's code, which lets its holder in, and ticket types' access codes.
• A share kit link's personal token.
• A webhook endpoint's address in full: the query is hidden, because a Power Automate address carries its key there.
• The keys' log never records a query string, a body or an answer.

#Where it is

AttendBeacon runs in the European Union (Sweden Central). What your integration copies out is yours to look after: keep it no longer than you need, and act on attendee.erased.