Privacy Policy
Version 1 for approval | Prepared 12 October 2026
This Policy explains how UAB Such Much AI handles personal data for Such Much Community, including its community subdomains, AI-assisted matching, event profiles, invitations, messaging and billing. It applies even if an organiser has uploaded a profile about you and you have not signed up.
For an organiser-funded event, your professional profile may be discoverable immediately after upload, before you create an account. It is shown only within the identified matchmaking audience, not as a public web directory. You can object or ask for removal at info@suchmuchai.com without signing up or paying.
1 Who is responsible
UAB Such Much AI is the controller for the platform activities described in this Policy: company code 306405204; registered address Bukčiū g. 6-38, Vilnius, LT-04127, Lithuania. Contact info@suchmuchai.com with “Privacy” in the subject line, or write to that address. You do not need to use a special form.
An organiser, such as the Lithuanian Chamber of Commerce in the UK (LCCUK) or the relevant Vilnius Founders event organiser, is responsible for its own ticketing, registration and decision to provide attendee data. Its privacy notice also applies to those activities. Where we and an organiser jointly determine a particular use, the event notice identifies the joint arrangement and its essential responsibilities. Where we act solely on an organiser’s documented instructions, that organiser is the controller for that instructed activity and we act as its processor.
You may contact us about data held on the platform regardless of these arrangements. We will handle the request for our activities and coordinate with the organiser where needed, rather than require you to create an account or identify the correct legal role yourself.
2 Information we collect and where it comes from
Account and membership information: your name, email, account identifier, verified sign-in status, community and event memberships, eligibility, preferences, Terms acceptance records and privacy choices. Email is used for verification and service messages; it is not automatically displayed to other participants.
Professional profile information: company, role, professional biography, interests, objectives, what you offer or seek, relevant sector or business stage, and any professional links or photograph you choose to supply or that the organiser lawfully provides. We do not require special-category information such as health, political or religious beliefs, ethnicity or sexual orientation, or criminal-record information. Do not include these in your profile or AI conversation.
Networking information: AI-concierge inputs and outputs, structured profile summaries, recommendation explanations, invitations, acceptance or decline status, messages, blocks, reports and meeting feedback you choose to provide. We do not record an offline meeting or assume that accepting an invitation means a meeting occurred.
Payment and administrative information: selected plan, subscription status, billing and invoice details, Stripe customer and transaction references, payment status and support correspondence. We do not receive or store your full payment-card number or card security code. Stripe handles those details.
Technical information: IP address, browser and device information, sign-in events, essential session identifiers, timestamps, error and security logs and necessary service-usage events. Optional analytics or tracking technologies are subject to the controls explained below.
Sources include you, other participants who send you messages or reports, the relevant organiser and its registration tools, including Luma, and our payment and service providers. For imported profiles, the event notice identifies the supplying organiser and the categories supplied. We do not treat a publicly available professional page as blanket permission to collect everything on it.
3 Profiles uploaded before signup
For the LT–UK Business Forum 2026, LCCUK and Such Much AI pre-upload eligible participants for the agreed Forum matchmaking and identified linked Vilnius Founders London events. Uploaded professional profiles can immediately appear to authorised participants and receive invitations. Raw ticket records, private contact information and payment details are not displayed as part of that profile.
We rely on legitimate interests for this pre-signup activity only after assessing necessity, reasonable expectations and the impact on participants. The interests are enabling relevant introductions at the attended event and giving attendees a usable networking pool. Our assessment must support the specific data and audience; an organiser agreement or ticket purchase alone does not establish participant consent.
LCCUK or we provide the applicable notice before, or at the latest when, your data is first disclosed to other participants. It identifies the source, scope, purpose, lawful basis and removal route. If the required notice or lawful basis is absent, the profile must not be made discoverable until this is resolved.
You can ask us to correct, hide or delete an imported profile before signup. We stop discoverability promptly when you object to this optional matchmaking use. We retain only the limited suppression information needed to prevent an unwanted re-import, subject to the retention rules below. Signing up lets you verify and manage your profile and accept or decline invitations; upload does not create consent, a payment obligation or acceptance of the Terms.
4 Why we use data and our lawful bases
Providing your chosen service — contract, Article 6(1)(b) GDPR. After you request an account or service, we use necessary information to verify your email, manage access, create your profile, generate requested matches, deliver invitations and messages, operate billing and answer service requests. We do not use this basis to justify publishing an unclaimed profile before you have a contract with us.
Pre-signup matchmaking — legitimate interests, Article 6(1)(f). This is the limited event-networking purpose described in section 3, subject to a documented balancing assessment, advance transparency and a practical objection route.
Security, moderation and service administration — legitimate interests, Article 6(1)(f). We use proportionate data to prevent fraud and abuse, investigate reports, troubleshoot, maintain reliability, measure essential service performance and establish or defend legal claims. We balance these purposes against your rights and minimise data. This is not permission for optional device tracking without consent.
Legal compliance — legal obligation, Article 6(1)(c). We keep required accounting and tax records, respond to lawful authority requests and fulfil applicable consumer and data-protection duties.
Optional marketing and optional cookies — consent, Article 6(1)(a), together with applicable electronic-communications rules. We use separate choices where required; declining does not prevent the core service. You can withdraw consent as easily as you gave it. We do not add imported attendees to marketing lists simply because they bought a ticket.
Where UK data-protection law applies, the corresponding UK GDPR bases apply. We will tell you before using data for an incompatible new purpose and obtain a new lawful basis or consent where required. Necessary account and eligibility information is needed to provide the relevant service; optional profile details and feedback are voluntary.
5 AI assistance and recommendations
The concierge is visibly identified as AI. It processes the professional profile details, goals and concierge messages needed to help you describe your needs and find relevant people. Matching may use structured tags, rules and AI-assisted interpretation to compare needs and offers within your authorised community or event. A Surprise match is labelled separately and does not imply a close similarity.
AI can infer an incorrect summary or explain a recommendation badly. You can review and correct your profile, refine your goals, ignore a suggestion and report a problem. We do not intentionally infer sensitive characteristics or use matching to make decisions about legal rights, employment, credit or similarly significant matters. People decide whether to connect; there is no solely automated decision with legal or similarly significant effects in this networking process.
Only the information needed for the relevant AI task is sent to the AI service provider. Billing records, sign-in secrets and private participant-to-participant conversations are not available to the concierge. If you deliberately paste content into an AI conversation, it is processed as that conversation. We do not use profiles, concierge conversations or private messages to train general-purpose models, and do not permit AI providers to use them for that purpose. Processing for service delivery and permitted security retention is separate from model training.
6 Who can see your information
Other authorised participants can see the professional profile information needed for matching within the identified community or event scope. Invitation recipients see the sender’s relevant profile and invitation note. Private messaging content is available to its participants. Your email, payment records, raw import files and concierge transcript are not part of the attendee directory. Profiles are not intended for public search-engine indexing.
An organiser receives the information necessary to administer its event access, such as roster or eligibility status, and appropriately aggregated participation results. It does not receive blanket access to private chats, AI transcripts or payment-card details. Any additional identifiable organiser reporting requires a disclosed purpose, lawful basis and appropriate access controls.
Authorised staff and contractors access data only for tasks requiring it, such as support, security and handling a report. A reported conversation may need limited human review. We use providers for hosting, databases, authentication, AI processing, transactional email, security and technical support, under appropriate contractual safeguards. Stripe handles payment processing and may act as an independent controller for its own regulated, fraud-prevention and compliance purposes. Luma and organisers have their own responsibilities for data collected through their services.
We may disclose necessary information to professional advisers, competent authorities or parties to a genuine legal claim where lawful. A business transfer may require limited protected disclosure to a prospective or new operator, with notice and safeguards where required. We do not sell participant lists or disclose profiles for unrelated advertising. Sharing information across communities is not automatic and requires a separately disclosed and lawful basis.
7 International transfers
Our service providers and their authorised subprocessors may process information outside Lithuania, including outside the European Economic Area or the UK. A provider’s EU service location does not necessarily mean all support, logs or subprocessors remain in the EU. We do not promise that all Community data stays in the EEA.
Where a restricted international transfer occurs, we use an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses and, where required, the UK Addendum or UK International Data Transfer Agreement, together with the necessary transfer assessment and supplementary measures. A US provider’s certification is relied on only where it is valid and covers the relevant processing. You may ask us for information about relevant recipients, locations and safeguards, including a copy or description of the safeguards with necessary confidential details protected.
8 Cookies and communications
Essential cookies and similar browser storage support sign-in, security, session continuity and privacy preferences. They are used only where necessary for the requested service. Disabling them can prevent sign-in or other essential features. Where optional analytics or similar technologies are offered, they remain off until the required consent, with clear accept and reject choices and a way to change that choice later.
The cookie information presented with those choices identifies the actual technology, provider, purpose and duration. We do not use acceptance of the Terms or continued browsing as cookie consent. Server-side processing is not automatically exempt from privacy or electronic-communications rules.
Necessary messages include sign-in links, invitations and their status, security notices, billing and material service updates. Manage optional notification preferences where available or contact us to stop unwanted matchmaking notifications. Promotional messages require the applicable permission and include an unsubscribe route. Unsubscribing from marketing does not prevent necessary account or legal notices.
9 How long we keep information
We apply the shortest relevant period below, unless a specific legal obligation or documented claim requires limited information to be kept longer. Retention does not make an expired event profile discoverable. Truly anonymous statistics may be kept longer; replacing a name with an identifier alone is not anonymisation.
| Information | Retention rule |
|---|---|
| Event only profiles and networking records | Until the disclosed event access window ends, or earlier valid deletion. For LT–UK Business Forum 2026, the window is three months after the event. Event visibility then ends and active event records are deleted within 30 days. An independently chosen continuing account does not extend the Forum dataset’s window. |
| Continuing account and community profile | While the account is active and the information is needed for the chosen service. With no current paid or sponsored entitlement, accounts inactive for 12 months are scheduled for closure after at least 30 days’ notice. Event-specific shorter periods still apply. |
| Invitations and participant chats | During the relevant active service or event window. On deletion or expiry, remove the departing profile and deal with message content under the deletion rules below; no indefinite retention merely because a conversation existed. |
| AI concierge transcript | Up to 90 days after the last concierge interaction, or earlier account or event deletion. The confirmed structured profile follows the applicable profile retention period. |
| Raw upload files | Delete within 30 days after the import has been checked, unless a shorter period applies. Necessary structured roster fields follow the event retention period. |
| Support and security records | Routine support correspondence for up to 12 months after closure; routine technical and security logs for up to 180 days. Isolated evidence of an incident or dispute may be retained for the necessary claim or legal period. |
| Invoices and required accounting data | Normally 10 years where required by Lithuanian accounting or tax rules. This does not justify retaining profile content or chats for 10 years. |
| Deletion and suppression records | Minimal proof of privacy choices or a withdrawal request for as long as needed to demonstrate compliance or address a claim. Restricted suppression identifiers are retained while re-import remains possible, reviewed at least annually and removed when no longer needed. |
| Restricted backups | Deleted active data ages out of normal backups within 90 days of active-system deletion. Backups are not used for ordinary access; if restored, relevant deletion instructions are reapplied. |
On an account deletion request, we remove discoverability promptly and ordinarily erase active personal data within 30 days after any necessary identity verification. If a legal exception requires specific records to remain, we explain the reason and limit access and use. Closing an account also stops future subscription renewals; billing and legally required records follow their separate retention rules.
Messages may contain both your information and the recipient’s. We assess erasure against the other person’s rights and any genuine legal need, removing or redacting identifying material where appropriate rather than treating a renamed account as anonymous. The remaining participant may retain only the content lawfully justified for the remaining service period or a specific legal need. We cannot delete copies a participant independently saved outside the platform, but take the steps required by data-protection law.
10 Your rights and choices
Depending on the applicable conditions, you can request access and a copy, correction, erasure, restriction, or portability of information processed automatically on consent or contract. You can withdraw consent without affecting earlier lawful processing. You can object to processing based on legitimate interests, particularly based on your circumstances; we then stop unless the law permits a justified continuation. We honour an objection to optional event discoverability by hiding the profile. An objection to direct marketing is absolute.
Email info@suchmuchai.com, including if you have never registered. Tell us which event or account is involved and what you want us to do. We request only proportionate information needed to verify identity or clarify the request, not an identity document as a routine requirement.
We respond without undue delay and normally within one month. Where the law permits a further two months because of complexity or number of requests, we tell you within the first month and explain why. Requests are normally free. If we cannot grant a request in full, we explain the legal reason and available challenge rights.
You may complain to the Lithuanian State Data Protection Inspectorate, including at ada@ada.lt, or to the competent supervisory authority where you live, work or the alleged infringement occurred. In the UK, you can contact the Information Commissioner’s Office. You do not have to complain to us first, and court remedies remain available.
11 Security and age restrictions
We use proportionate technical and organisational measures, including restricted access, separation of community data, secure transmission and procedures for security incidents. No online service is risk-free. Private chat is access-controlled, but this Policy does not claim end-to-end encryption. Keep sign-in links private and avoid sending information that is unnecessary for professional networking.
The service is for adults aged 18 or over. We do not intentionally offer it to children or create child networking profiles. If you believe a child’s data has been imported or used, tell us so we can investigate, stop inappropriate visibility and remove information as required.
12 Changes and contact
We update this Policy when the service or legal requirements change. We identify the version and notify affected users of material changes through an appropriate channel. A revised notice does not authorise incompatible reuse of an existing attendee list. Where a new consent or other step is required, we take it before starting the new use.
For a privacy question, imported-profile removal request or information about our providers and safeguards, contact UAB Such Much AI at info@suchmuchai.com, Bukčiū g. 6-38, Vilnius, LT-04127, Lithuania.