Privacy Policy

This Privacy Policy describes how Boothio, operated by Digital Agents s.r.o. (Company Registration No. 23270667, VAT No. CZ23270667), with its registered office at Na Folimance 2155/15, Vinohrady, 120 00 Prague 2, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 424287 ("we," "us," or "our"), collects, uses, and shares information when you use our service at boothio.ai("Service"). Digital Agents s.r.o. is the data controller responsible for your personal data. This policy applies to all users worldwide. We aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and similar privacy frameworks.

1. Information We Collect

Account information. When you sign up, we collect your email address, a password (hashed), and any profile details you provide (name, business name, country).

Subscription and billing information. When you subscribe to a paid plan or buy credits, our payment processor collects payment-method details on our behalf. We receive only a subscription record, plan tier, and last-four digits, never full card data.

Content you upload. Photos, video clips, audio tracks, transparent overlays, and other media you upload to use AI features. We treat this content as confidential and process it only to deliver the Service to you. We do not use your uploaded content or AI-generated outputs to train our own models.

Generated content. AI-generated images, videos, captions, and other outputs produced from your inputs.

Usage data. Pages visited, features used, credit transactions, render history, error logs, IP address, browser/device type, and timestamps.

Cookies and similar technologies. We group cookies into three categories: Necessary (authentication and session management, no consent required under EU law), Analytics (PostHog, loaded only if you allow the Analytics category), and Marketing(advertising and remarketing measurement, loaded only if you allow the Marketing category). No marketing cookies are active today. You can change or withdraw your choice at any time via “Cookie settings” in the site footer. For the full list and durations, see our Cookie Policy.

2. How We Use Your Information

• To provide and operate the Service (run AI generation, render videos, deliver outputs)
• To process subscriptions, credits, and one-time purchases
• To send transactional emails (account verification, billing receipts, password resets)
• To send service announcements and product updates (you can opt out)
• To monitor for abuse, fraud, and violations of our Terms of Service
• To improve the Service through aggregated, anonymised usage analytics
• To comply with legal obligations and respond to lawful requests

3. Legal Basis for Processing (GDPR)

For users in the EU, UK, and EEA, we rely on these lawful bases:

• Contract: processing necessary to deliver the Service you signed up for
• Legitimate interests: security, fraud prevention, product analytics
• Consent: non-essential cookies, marketing emails (where required)
• Legal obligation: tax records, responding to legal process

4. Sub-Processors

To operate the Service, we rely on vetted third-party sub-processors — for example Supabase (authentication and data storage, EU), OpenAI (AI image, video, and language models, USA), and Stripe(payment processing, USA) — alongside other providers for hosting, content delivery, analytics, email, abuse prevention, and the data sources behind specific features. Each is bound by a written data-processing agreement (DPA) and may only handle your data securely and on our documented instructions.

A complete, current list of our sub-processors is available on request: email hello@boothio.ai and we will provide it. Where we act as your processor (for example, for client data you handle through the Service), we will also notify you of material changes to our sub-processors so you can object.

Some sub-processors are located outside the EU. We use Standard Contractual Clauses (SCCs) and rely on adequacy decisions where applicable to ensure adequate data protection.

5. Data Retention

We retain your data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, or reporting obligations:

• Account and profile data: for the lifetime of your account, then 90 days after closure
• Uploaded media: until you delete it, close your account, or 12 months after upload (whichever comes first; media attached to a still-scheduled post is kept until it publishes)
• Generated outputs: until you delete them or close your account
• Billing records: 7 years (statutory requirement in most jurisdictions)
• Server logs and usage analytics: typically 12 months in identifiable form
• Lead Finder records: 24 months from last verification, then automatically deleted (earlier on opt-out)

6. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (right to erasure / right to be forgotten)
• Export your data in a portable format (data portability)
• Restrict or object to certain processing
• Withdraw consent where we rely on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email hello@boothio.ai. We will respond within 30 days.

7. International Data Transfers

Your data may be processed in countries outside your country of residence, including the United States. We use Standard Contractual Clauses approved by the European Commission and equivalent safeguards under UK GDPR to ensure your data receives adequate protection.

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us at hello@boothio.ai and we will delete it.

9. Security

We implement industry-standard security measures: encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logs, and regular security reviews. No system is 100% secure, however, and we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours where required, and affected users without undue delay.

10. California Residents (CCPA / CPRA)

California residents have the rights described in Section 6 above, plus the right to opt out of any sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising.

11. Overlay Generator

When you generate an overlay, the event details, design selections, text, free-text instructions, and any logo or branding asset you upload (your "Overlay Inputs") are transmitted to a third-party artificial-intelligence image-generation provider located in the United States (an AI image model provider listed among our sub-processors) for the sole purpose of generating your overlay and returning it to you. Logos and other branding assets you upload to the Overlay Generator are transient: they are sent with each generation request and are not stored by Boothio. Generated overlay outputs are retained according to your plan (14 days on Trial, 365 days on paid plans) and are then automatically deleted. Our statement that we do not use your uploaded content or AI-generated outputs to train our own models refers to Boothio's own models; it does not by itself govern the AI provider. Boothio contracts for no-training and zero-data-retention handling on the provider API keys used for this feature. This transmission to a US provider is an international transfer carried out under the safeguards described in the International Transfers section, including Standard Contractual Clauses.

12. Video Editor

When you use the Video Editor, the video clips you upload, any custom music track, and any overlay are processed to produce your output. In Custom AI Edit mode, Boothio extracts still frames from your uploaded clips and sends those frames to a third-party AI service in the United States (an AI vision model provider) for automated clip scoring, and the uploaded clips, custom music, and overlays are transferred to and processed by video rendering compute providers in the United States and, on fallback, fallback video rendering in Australia and the United States for rendering. This footage may contain identifiable individuals filmed at your events; processing it is necessary to provide the Service, and this transmission outside the EEA is an international transfer carried out under Standard Contractual Clauses. Our commitment not to use your content to train our own models extends to these render and analysis sub-processors, who do not use your footage to train their models [needs eng confirmation per provider]. Rendered output is stored on object storage that is reachable via a shareable, effectively unauthenticated link, and is retained for 14 days (Trial) or 365 days (paid) before automatic deletion; your source clips, custom music, and project overlays are purged within approximately 24 hours after rendering. You are responsible for downloading and storing any output you wish to keep and for how you share the output link. [needs counsel] on whether filmed-guest imagery in operator uploads triggers any heightened (GDPR Art. 9 / image-rights) treatment for Boothio as the platform processing it, given operators are the parties who captured it.

13. Social Media and Connected Accounts

When you connect a social media account, an authorization token (OAuth) is issued by the platform and held in encrypted form by our publishing provider on Boothio's behalf; Boothiodoes not store your platform passwords. When you publish or schedule a post, the post content (caption, hashtags, mentions, tagged-account handles, and collaborator handles) and the selected media (which may depict identifiable individuals captured at events) are transmitted to our publishing provider and onward to the platform or platforms you choose. Those platforms are operated by independent third parties based in the United States and process that data under each platform's own privacy policy. This is an international transfer carried out under the safeguards described in the International Transfers section, including Standard Contractual Clauses. You may disconnect or revoke a connected account at any time from your settings or at the platform. As the operator, you are the controller responsible for ensuring you have a lawful basis to publish content depicting third parties (such as event guests or clients) to public channels. We retain your connected-account cache and your scheduled-post records (including caption, mentions, tags, publish result, and any error message) under the account-data retention described in this Policy.

14. Client Selections

When you use Client Selections, Boothio acts as a processor on your behalf for the personal data of your own clients, and you are the controller of that client relationship and its lawful basis. The data this feature touches is limited to a client name or label you enter, the library items your client selects, and an optional free-text request (capped at 2,000 characters); the system captures no client email address or phone number. Selection links are public, unlisted, capability-style URLs at boothio.ai/select/{token} that require no sign-in, so anyone who holds an active link can view the branded gallery and submit selections. The only sub-processors for this feature are our database provider (EU) and our object-storage provider for operator-uploaded brand assets; no AI vendor is involved in the selection flow. If an end client wishes to exercise data-subject rights or have their data erased, they should contact the operator who shared the link, who is the controller; Boothio will refer any such request it receives back to that operator and assist as processor. The /legal/opt-out form does not cover Client Selections data (it is scoped to the Lead Finder database). This feature is not directed to children under 16, consistent with our Children's Privacy section. End-client selection data persists until the operator or an administrator deletes the selection; no automatic retention sweep applies to it.

15. Showcase Widget

The Showcase widget is an embeddable gallery that an operator places on the operator's own website. Boothio's role on the public embed at boothio.ai/embed/{slug}is limited to serving the operator's branded gallery. Boothiodoes not currently set analytics cookies or tracking identifiers, and does not track or log individual visitors on the public embed route, beyond standard, transient server request logs (such as IP address and user-agent retained briefly for security and abuse prevention, the same minimal logging described under Usage Data). When the embed loads on the operator's own website, that website is operated by the operator, who is the controller responsible for its own privacy notice, cookie and consent banner, and any disclosure that boothio.ai is loaded as a third-party resource. Clicking an operator-configured call-to-action sends the visitor to a destination the operator chose, governed by that destination's own policies, not Boothio's. The embed introduces no new sub-processor (it reuses our existing database and object-storage providers). [needs counsel] If view-count or call-to-action click analytics are added in future, this disclosure and a cookie/consent treatment for the public embed must be revisited.

16. Library

For clarity, the usage data we collect includes your Library activity such as view, download, and unlock counts and your per-account unlock record, processed on the basis of performance of our contract with you and our legitimate interests in operating and securing the Service. No special-category data is collected by this activity. Library Assets are AI-generated catalog content created by or for Boothio. They are not depictions of, affiliated with, or endorsed by any real person, and Boothiodoes not knowingly use a real individual's personal data to generate them. If you believe a specific Library Asset raises a personality, likeness, or other rights concern, please contact us through the channel in our Contact section or our DMCA / Copyright Policy. Our statement that we do not train our models on your content is unaffected by this note, because Library Assets are Boothio's own catalog content and not content you provide.

17. Lead Finder — B2B Discovery Database

The Lead Finder feature aggregates publicly available business information so professional users (photo booth operators) can find event organisers, venues, and partners. The data is collected in your professional capacity at a business and is not used for direct marketing by Boothio. Boothio never sends outreach; operators contact prospects from their own tools under their own lawful basis.

What we collect: business name, business email, business phone, business address, role or title of the contact person, business website URL, business rating and reviews from public listings, and public event metadata (name, date, venue, organiser).

Sources we use: Google Maps public listings, public event listings, public business websites, and B2B email-discovery providers (see Sub-Processors above). In addition to public business listings, Boothioitself reads a business's own public website (including pages such as /contact and /imprint) and may resolve email addresses that a site has obfuscated, as a collection activity carried out by Boothio.

Automated suggestions: The automated short description or outreach suggestion the Service generates about a surfaced business or event is itself a processing activity and a category of data stored about that business or its representative.

Lawful basis: Article 6(1)(f) GDPR and equivalents — the legitimate interests of operating a B2B research tool. We have completed a Legitimate Interest Assessment. The data concerns individuals in their professional capacity at a business, is already published publicly in a B2B context, and is never used for advertising, profiling, or automated decision-making.

Retention: 24 months from last verification, then automatic deletion. Earlier deletion on opt-out.

Opt out at any time: use our opt-out form — no account, no friction. We hash your email (SHA-256) into a permanent suppression list, delete every existing record across all operator accounts, and confirm immediately. We never store the raw email. You may also email hello@boothio.ai to exercise any data subject right (access, rectification, erasure, objection, restriction, portability) or to lodge a complaint with your supervisory authority.

18. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via the dashboard. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

19. Contact

Questions about this Privacy Policy or your data? Email hello@boothio.ai. For copyright concerns, see our DMCA Policy.