The EventHex Connector is a Model Context Protocol (MCP) server operated by EventHex that lets an authorized AI assistant (e.g. Claude, ChatGPT, IDE assistants) access and manage your EventHex data on your behalf. This policy explains what it accesses and how that data is handled.
The connector acts for a single franchise (workspace) and is authorized by a franchise administrator via an EventHex API key or OAuth sign-in. It can only access data belonging to that franchise.
| Category | Examples | Access |
|---|---|---|
| Events | Event details, dates, settings | Read / write |
| Tickets | Ticket types, prices, capacity, discounts | Read / write |
| Agenda | Speakers, sessions | Read / write |
| Website | Event website design, content, domains | Read / write |
| Registrations | Names, contact details, ticket, approval, payment, and check-in fields where explicitly requested | Read / update / export (separately scope-gated) |
| Analytics & billing | Registration stats, invoices, subscription status | Read |
Access is limited by the scopes granted to the connector key (for example event:read, tickets:write). A key only receives the scopes its administrator selects.
Data is used solely to fulfil the actions the administrator (through their AI assistant) requests — for example creating an event, editing tickets, or building a website. EventHex does not sell connector data, use it for advertising, or use it to train EventHex models.
Tool inputs and outputs necessarily pass to the AI client you connect (for example OpenAI or Anthropic), governed by that provider's privacy policy. When you explicitly use an AI-generation tool, the relevant event content and prompt may also be sent to EventHex's configured model provider (for example OpenAI, Google, or OpenRouter) to generate the requested private draft. Other data is shared only with infrastructure providers needed to operate EventHex.
For security and abuse prevention, the connector records an audit log of each tool call (credential and actor identifiers, tool, event, success/failure, argument fingerprint, and timestamp — not the raw tool arguments). Audit logs are retained for 180 days and then automatically deleted. Connector API keys, confirmation tokens, and OAuth grants are stored only as one-way hashes where applicable; raw connector keys are shown once and are not stored.
Attendee exports are stored as private CSV objects. The connector returns a signed download link that expires after approximately 15 minutes; attendee rows are not returned inline to the AI client. Export objects remain subject to EventHex's service data-retention and deletion controls.
All traffic uses HTTPS. Authentication is by hashed API key or OAuth 2.1 (PKCE). Every event-scoped action is verified to belong to the authorized franchise before it runs.
A franchise administrator can revoke any connector key or OAuth connection at any time from the EventHex dashboard (Developer → Connectors), which stops further access. Destructive actions, public publishing, public form/poll creation, and attendee exports require a short-lived, single-use confirmation prepared for the exact action arguments.
Questions or data requests: support@eventhex.ai.