Goldcast

GDPR overview

GDPR compliance is claimed explicitly: the plan comparison table lists SOC 2 Type 2, ISO 27001 and GDPR under security and privacy on all four plans. The privacy policy, updated on 11 December 2025, carries a full EU users section listing the rights of access, rectification, erasure, restriction, portability and objection, plus the right to complain to a supervisory authority (the ICO is named for the UK). Contractual necessity, legitimate interest and consent are cited as legal bases. EU, UK and Swiss transfers to the United States rely on Standard Contractual Clauses and their addenda, a data protection officer is reachable at dpo@cvent.com, and a data processing addendum is published and incorporated into the terms. One gap: no Article 27 EU representative is named, the contact section giving only a US address.

Who owns the data?

The terms governing Goldcast are the Cvent Event Cloud Terms of Use, which the site's terms link resolves to. Section 9.2 states that, as between the parties, the customer owns all rights, title and interest in its Customer Data, a definition section 1.6 extends to AI inputs and outputs. The customer grants Cvent a worldwide, non-exclusive, sublicensable, royalty-free licence for the subscription term, limited to delivering the service. Section 9.3 goes further: Cvent alone owns Aggregate Data, meaning everything the platform collects in aggregated and anonymous form, and may use it for any commercial purpose, including distribution to other customers and benchmarking, provided it names no customer as source and holds no personal data.

Reuse rights

Because the customer owns its Customer Data, recordings, clips, transcripts and AI outputs can be reused without asking permission, subject only to the general requirement in section 5.1 that use stays lawful; the vendor states it does not monitor transmitted content. Section 13.5 gives customers 30 days after expiry or termination to request a downloadable file of their Customer Data in its then-current format. The AI Features clause dated 13 November 2025 makes AI use entirely optional and lets a customer have the features switched off for the account at any time. That clause also states that Cvent does not process, store or use Customer Data, including inputs and outputs, to develop, train or enhance artificial intelligence models operated by third parties, wording that matters because it is limited to third-party models, and that its AI suppliers are contractually barred from storing or retaining Customer Data. Nothing is said about models the vendor operates itself. Outputs carry a human-in-the-loop caveat: no automated decision without human review, and the vendor disclaims responsibility for what the AI produces.

Data retention & training

Hosting summary

The privacy policy states that Goldcast is based in the United States and processes data there, and presents transfers to the US as necessary to perform the contract. Transfers from the European Union, the United Kingdom and Switzerland rely on Standard Contractual Clauses and their approved addenda. No other hosting country or region is named, no data centre or cloud provider is identified, and no subprocessor list is published; the privacy policy names only categories of service provider. The security page, updated on 14 January 2025, documents AES-256 encryption at rest, SSL/TLS in transit and a secure deletion process triggered by customer request or at contract end. It also lists firewalls, quarterly penetration tests by an external firm, a bug bounty programme, static code analysis, employee background checks, least-privilege access, granular access logging, a 99.99% uptime target and a public status page. Buyers with European data residency requirements should note that no EU hosting option is described anywhere on the site.