Privacy Policy — Boothzy

Introduction

Boothzy takes the protection of your personal data seriously. This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have.

1. Personal data we process

We process data you provide to us directly, and data that is recorded automatically when you visit our website.

Data you provide to us:

• Name and contact details — your first and last name, email address, and phone number, as entered when requesting a quote or making a booking.
• Delivery address — the street, house number, postal code, city, and country where the photobooth is delivered and picked up.
• Booking details — your chosen event date, the selected package, and any notes you leave with your request.
• Payment details — the status of your payment and the payment reference from our payment provider. Your bank account or card number is never sent to us; the payment provider handles that directly.
• Files you upload — the design for your photo strip, and the photos taken with the photobooth during your event.

Data recorded automatically:

• Visit and session data — a session identifier and a visitor identifier, the pages you view, when you viewed them, how far you scroll, what you click, and which steps of a form you complete.
• Where your visit came from — the page you landed on, the referring website, and the source labels from the link you arrived through: utm_source, utm_medium, utm_campaign, utm_content, and utm_term, along with click identifiers such as gclid, fbclid, msclkid, wbraid, gbraid, ttclid, and li_fat_id. We keep both your first and your most recent source.
• Advertising data — if you arrive via an ad, the campaign identifier, ad group identifier, keyword, ad identifier, and placement.
• Device and browser — your device type, browser, screen size, language setting, and time zone.
• IP address and user agent — when you request a quote, we record your IP address, user agent, and the country derived from it on our servers, so we can trace the request and prevent abuse.
• Email engagement — for emails we send you, whether they were delivered, opened, and clicked, and which link was clicked.

2. Purposes for processing

We process personal data only for the following purposes:

• Handling quote requests and preparing a quote.
• Fulfilling the rental agreement: delivering, picking up, and processing the photobooth, and the related communication.
• Handling payments and invoicing.
• Providing your customer portal and the photos from your event.
• Improving our website and our services.
• Analyzing website usage, to see which pages work and where visitors drop off.
• Marketing purposes, including measuring the performance of our advertising.
• Complying with legal obligations, such as record-keeping requirements for our accounting.

We rely on performance of our agreement with you, compliance with a legal obligation, our legitimate interest in a working and findable website, and your consent where consent is required under applicable data protection law.

3. Forms and communication

When you request a quote or contact us through the website, we process the data you provide to handle your request and to contact you about it.

If you leave only your email address — for example to receive a discount code — we record that address together with the visit data known at that moment as an open request, so we can follow up.

After a booking, you get access to a personal customer portal through a unique link in your email. Anyone with that link can see the details of that booking, so please don't share it with others.

You can unsubscribe from our follow-up emails using the unsubscribe link at the bottom of every email. We will keep sending emails that are needed to fulfill the rental, such as delivery and return information.

4. Cookies and similar technologies

We use cookies and similar technologies, including storage in your browser. We distinguish:

• Necessary cookies and storage — needed to make the website work, to recognize your session, and to keep administrators logged in.
• Statistical storage — for insight into how the website is used: which pages you view, how far you scroll, what you click, which steps of a form you complete, and where you drop off. This uses an identifier in your browser that lets us connect two visits from the same device. We do not record what you type into a form field.
• Marketing cookies — for measuring the performance of our advertising. This covers the cookies placed and read by the Meta pixel.

All three categories above are used on every visit to this website, including the Meta pixel. We do not show a cookie banner here, and we would rather say so plainly than ask a question we do not act on.

If you would rather we did not use your data for advertising, email us at the address in section 12 and we will exclude you. You can also block or delete cookies in your browser settings, and you can limit interest-based advertising in your own Meta account settings — both work without our involvement.

5. Third parties (recipients of data)

We work with the following service providers. Each receives only the data it needs for its task.

Necessary for the service:

• Supabase — our database and the servers our background functions run on. Your booking, quote, and visit data are stored here.
• Cloudflare — delivers the website to your browser and stores the photos taken with the photobooth in Cloudflare R2.
• Mollie — handles your payment. Mollie receives the amount, a description, and a reference for your booking; your bank account or card details are processed by Mollie directly and are never visible to us.
• Brevo — sends our email and records whether an email was delivered, opened, and clicked.
• Ceyenne / MoreStorage — packs, ships, and processes the return of the photobooth. This party receives your name, email address, phone number, and delivery address, and itself relies on a shipping/network service to carry that traffic.
• Google Fonts — provides the website's typefaces. Your IP address is shared with Google in the process. No tracking cookies are placed.
• Bunny.net — delivers the videos shown on the website and in the customer portal, through an embedded player.

Marketing:

• Meta (Facebook and Instagram) — receives events about your visit, both through the pixel in your browser and directly from our server. Your name, email address, phone number, city, postal code, and country are sent encrypted (hashed); your IP address and user agent are sent unencrypted.

These parties process personal data on behalf of Boothzy. We do not sell your data and do not share it for third parties' own purposes.

6. Retention periods

We do not keep personal data longer than necessary for the purposes it was collected for, unless a legal retention obligation applies. Specifically:

• The photos from your event remain available in your customer portal for thirty (30) days after your event.
• The source/attribution data stored in your own browser expires after ninety (90) days.
• Data that forms part of our accounting records, such as invoices, is kept for as long as applicable record-keeping law requires.
• Visit and event data is kept for twelve (12) months after your last visit.

7. International data transfers

Some of the service providers named in section 5 are based in the United States or use servers outside the European Economic Area — this is true, at minimum, for Meta, Google Fonts, and Cloudflare.

For US visitors, this means your data may be processed both inside and outside the United States, depending on where each provider operates its servers. Where personal data is transferred internationally, this happens under the safeguards applicable to that transfer.

8. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, and unauthorized access.

All traffic with our website and with our service providers is encrypted.

The admin portal where your booking is visible is protected by a personal login and is only accessible to authorized staff.

Links to the photos from your event are signed and expire automatically, so they cannot be shared without limit.

9. Your rights

Depending on applicable data protection law, you may have the right to:

• Access the personal data we hold about you.
• Have your data corrected or deleted.
• Have processing restricted.
• Object to processing.
• Withdraw your consent, without affecting the lawfulness of processing carried out before the withdrawal.
• Receive your data in a portable format.

You can reach out about any of this using the address in section 12. We aim to respond within thirty (30) days. If the law of your state gives you more rights than the list above, those apply on top of it; section 13 covers California specifically.

10. Minors

Our website and services are not directed at anyone under the age of sixteen (16). We do not knowingly collect personal data from minors.

If you are a parent or guardian and believe we have collected data about your child without your consent, please contact us and we will remove that data.

11. Changes

We may update this privacy policy from time to time. The most current version is always available on our website; the date at the top of this page shows when it was last updated.

12. Who to contact

Boothzy is responsible for the processing described in this policy.

Email: service@boothzy.com

We have not appointed a dedicated data protection officer; you can reach us with any questions about this policy at the email address above.

13. If you live in California

We do not sell your personal information for money, and we never have.

We do send events about your visit to Meta so we can measure how our advertising performs, as described in sections 4 and 5. Under California law that counts as “sharing” personal information for cross-context behavioral advertising, even though no money changes hands.

To opt out, email service@boothzy.com with the subject “Do not sell or share my personal information”. We will exclude your address and stop sending events about you. You do not have to give a reason, and we will not treat you differently for asking.

You can also ask us what personal information we hold about you, ask us to delete it, or ask us to correct it, using the same address. We answer within 45 days.