Privacy Policy

Version: 1.1 Effective: 21 October 2026

BoothApps.ai is a product of Innova.uno Sp. z o.o., a Polish company. We sell ready-made AI Workflows to photo booth and event companies. Those companies run the Workflows at their own events.

This creates two different roles, and this policy keeps them apart.

• For the people who deal with us directly, our Customers and their staff, website visitors, affiliates, waitlist and contact-form senders and users of our feedback portal, we decide why and how the data is processed. We are the controller. Sections 1 to 3 and 5 to 14 are about that.
• For the people photographed at an event, the Guests, the photo booth company running the event decides why and how their data is processed. That company is the controller and we only act on its instructions. We are the processor. Section 4 is about that, and the full rules are in our Data Processing Agreement.

We do not print the list of our suppliers inside this policy, because it changes. The complete, dated and versioned list, with what each supplier does, where it processes data and on what transfer basis, is the Subprocessor Register at /legal/subprocessors. It forms part of this policy by reference.

1. Controller and contact

The controller of the personal data described in this policy is:

Innova.uno Sp. z o.o. Byslawska 84, 04-993 Warsaw, Poland KRS 0000417704, District Court for the capital city of Warsaw, XIV Commercial Division of the National Court Register NIP (VAT ID): PL5213629718 REGON: 146081689 Share capital: PLN 5,000

BoothApps.ai is a product and brand operated by that company. The same company also operates the separate product Fancarta.

Contact for all privacy matters, including exercising your rights, withdrawing consent and reporting a concern about someone's image: support@boothapps.ai.

Data Protection Officer: we have not appointed one. We assessed the requirement under Article 37 GDPR at company level, across both of our products, and concluded that neither the nature nor the scale of our processing makes an appointment mandatory. The assessment is documented and is repeated whenever our processing changes materially, in particular on a significant expansion of BoothApps.ai. Write to support@boothapps.ai for any data protection matter.

2. Who this policy covers

This policy applies to:

• Customers, the photo booth and event companies that hold a BoothApps.ai account, and the individual people who register, log in and act for them.
• Website visitors who browse boothapps.ai.
• Affiliates who join our referral program, and visitors who arrive through an affiliate link.
• Waitlist and contact-form senders who ask us for access or write to us.
• Feedback portal users who sign in to our feedback site to post or vote on ideas.

Guests at an event are not covered by this policy in the same way. We handle their data only on the instruction of the photo booth company running the event. Section 4 explains exactly what we do with it, what we never do with it, and where a Guest should send a request.

Capitalized terms such as Purchase, Transformation, Workflow, Output and Guest have the meaning given to them in the Terms of Service and the Data Processing Agreement.

3. Data we collect and why

Each table below covers one activity. "Retention" states what actually happens. Where an automated deletion rule exists, we give the period. Where one does not yet exist, we say what the real trigger is instead of inventing a number.

3.1 Account registration, login and sessions

The email address, telephone number and password are required. Without them we cannot create the account. The display name is optional. We do not ask for your country at registration.

3.2 Purchases and billing

Our payment provider is an independent controller, not our processor. Our order process is conducted through Stripe Managed Payments, with Link as the merchant of record for all our orders. The provider's legal entities, their role, what they receive and their privacy notice are recorded in the Subprocessor Register.

Payment does not happen on our website. When you pay, we send you to the provider's own hosted payment page, where you enter your payment method and, if you are buying as a business, your company name and VAT number. We never see or store your card number, the card brand or its last four digits, or the cardholder name, and we do not receive your full billing address. Those fields are processed by the provider under its own privacy notice.

Since October 2026 we no longer ask for a billing address, a company name or a VAT number anywhere in our own application. The billing form has been removed.

From the completed payment the provider returns to us the fields listed in the table above, together with your name and email address. We use them to fulfil the order, to support you, to handle refunds and disputes, and to prevent fraud. We do not use them for marketing. You manage your orders, receipts and invoices on the provider's own site, linked from the billing area of your dashboard.

We read the billing country for one specific purpose. We do not serve a small number of countries, listed in our Terms of Service. If an order is paid with a billing address in one of them, the Purchase is not created, we refund the payment in full, and we email you to say so. The country is otherwise used only as part of the payment record.

Deletion requests split between us. If you ask the provider to delete your data, it deletes the customer, payment, charge and invoice objects it holds for you in our account and tells us it has done so. Our own purchase records do not depend on those objects continuing to exist, so they survive that deletion and are kept and deleted on the schedule in section 7. The provider also keeps certain transactional data to meet its own legal obligations. Ask us for the data we hold, and the provider for the data it holds.

Deleting your BoothApps.ai account does not delete your data at the payment provider. Our deletion process does not call the provider, because the provider is the merchant of record and holds that data as a controller in its own right, under its own retention rules. Send it a separate request.

3.3 Usage tracking and service notifications

The usage SMS goes to the telephone number on your account through our own SMS provider, which is listed in the Register. This is a transactional message about a service you bought, not marketing.

3.4 Event reports

Because the report contains links to Guest outputs, it is sent only to the account email address of the Customer that owns the Purchase.

3.5 Operator integrations (your own SMS and email accounts)

Credentials you give us are encrypted in our database and are decrypted only by the server process that sends a message. The verification code is always sent through your own server to the email address on your account. You cannot type in a different destination address, because that would prove nothing about who controls the server and would turn our interface into a mail relay.

3.6 Support, contact form and complaints

3.7 Waitlist

3.8 Feedback portal

The feedback portal runs on our own servers in the EU. What you post there is visible to other users of the portal, so do not put confidential information or Guest data in a post.

3.9 Affiliate program

The referral code is stored in the browser's local storage, not in a cookie, and the click record is written when the link is opened.

3.10 Website analytics and error tracking

Google Analytics runs behind Google Consent Mode v2. Until you consent, analytics storage and advertising storage are both set to denied. The Google tag script itself loads on every page whatever you choose, so Google receives your IP address and basic request information as the recipient of that request; measurement begins only if you consent. The Cookie Policy sets this out in full. We do not use Google advertising features, and we do not build advertising audiences.

GlitchTip is not a third-party analytics company. It is error-tracking software that we run ourselves on our own servers in the EU. Reports from your browser are sent through an endpoint on our own domain so that browser extensions do not silently break them. Authorization headers and cookies are removed before an error is stored.

3.11 Bot protection

Turnstile loads on those five forms by default, because without it the forms cannot be protected. It sets no advertising cookie and is not used to track you across sites. Cloudflare's privacy information is linked from the widget itself.

3.12 Security and audit records

3.13 Marketing

We send no marketing email today. Every message we send you is transactional: a purchase confirmation, an activation notice, a usage alert, a security or account message, an event report, or an answer to something you wrote to us. If we ever start a newsletter or a product announcement list, it will be a separate opt-in and you will be asked for consent first. We do not sell or rent anyone's contact details.

4. Our role for event-Guest data

4.1 Who decides

The photo booth or event company running the event is the controller for everything about its Guests. It chooses the Workflow, decides what the booth asks a Guest, obtains the Guest's consent, writes the message the Guest receives and decides what happens with the results.

We are the processor. We run the Workflow the Customer bought, on that Customer's documented instruction, under the Data Processing Agreement that every Customer accepts when it registers. This section is a plain-language description of that arrangement. The DPA is the binding text.

4.2 What we process for the Customer

Depending on the Workflow the Customer bought, this can include the Guest's photograph, first name, telephone number or email address, the answers given to the booth survey, the generation prompt built from those answers, the AI images, reports and videos produced, the short link created for delivery, and the record that the message was sent and whether it arrived.

4.3 What we never do

• We never contact a Guest for any reason other than delivering the output the Customer told us to deliver. There is no follow-up message and no second message.
• We never use Guest data for advertising, for profiling across events, or to build a picture of a person over time.
• We never sell Guest data, and we never share it with anyone except the suppliers listed in the Register that are needed to produce and deliver the result.
• We do not train AI models on Guest content. The standard we apply when we select an AI supplier is a contractual prohibition on training on the content we send through the interface, and where a supplier offers a contractual or account-level control for this we use it. That is our selection standard, not a claim about every supplier: the contractual position of each supplier, including whether it may train on content and which transfer mechanism applies, is recorded per supplier in the Register.

4.4 Where a Guest should go

A Guest who wants a copy of their data, wants a photo or an output removed, or wants to object should contact the company that ran the event. That company is the controller and is the only party that can decide the request. It is usually named on the booth, on the booking, or in the message the Guest received.

If a Guest writes to us instead, we will not act on the request ourselves, because we are not entitled to. We forward it to the Customer responsible within 3 business days and tell the Guest that we have done so. We then help that Customer carry the request out, including removing outputs and delivery records for a Purchase when the Customer instructs us to.

4.5 How AI is used at an event

The images, reports and videos a Guest receives are generated by artificial intelligence. They are a stylized creation based on the Guest's photograph and answers, not a documentary photograph, and they can be wrong, unflattering or simply inaccurate. The Customer is required by our Terms to tell Guests, before the photograph is taken, that the result is AI-generated.

Most Workflows also need to know roughly who is in front of the camera in order to pick the right artwork, prompt or template. Where the booth survey does not already ask, an automated step estimates the apparent gender presentation and an apparent age range from the photograph. Three things about that step matter:

• It is an estimate, never a certain finding about a person.
• It is used only within the processing run and is not stored as a separate record. It is produced during the run, used to build the generation prompt and to choose the artwork, and it is not stored as an attribute of an identified person in our database. It does appear inside the generation prompt and inside the workflow execution record kept for that session, which follow the retention rules in section 7. No template or pattern of anyone's face is created or stored.
• It is not used to work out who someone is, to match a person against any database or against another photograph, to check a person's identity, or to accept or reject anyone.

The Customer is required by our Terms to tell Guests about this estimate before the photograph is analyzed.

4.6 Which kinds of supplier see Guest data

To produce a result we use suppliers in these categories: object storage and content delivery for the files, self-hosted automation and media services on our own EU servers, AI image and video generation, an AI text service for the written part of a report, an automated step that produces the gender and age estimate described above, an overlay rendering service for branded graphics, and the message channel used to deliver the result (the Customer's own SMS or email account, with our own email provider as the fallback for email).

The named entity behind each category, what it receives, where it processes it, and the transfer basis are in the Subprocessor Register.

Image and video generation involves suppliers in the United States of America. The data transferred for that purpose is the Guest's photograph (or a cropped copy of it) and the generation prompt, which contains survey-derived text and may contain the Guest's first name. The purpose is producing the image or video the Guest asked for at the booth.

The transfer basis for each supplier is stated in the Register, supplier by supplier. For the default image and video supplier it is the European Commission's Standard Contractual Clauses with supplementary measures, which for the suppliers where the Register says so include a contractual zero data retention mode, together with minimization of what we send. Where a supplier has not yet given us transfer terms in writing, the Register says so in that supplier's row rather than implying a safeguard we do not hold. A copy of the safeguards we rely on, or information about where they can be obtained, is available on request from support@boothapps.ai. Section 6 covers transfers in full.

4.7 Where the files live and how long they stay

Guest media is stored in object storage under EU jurisdiction. So that a Guest can open their photo, report or video straight from an SMS or an email, the files are served over HTTPS links that are not guessable and that do not require a login. Anyone who has the link, or who is forwarded it, can open the file. That is a deliberate part of how delivery works, and it is a risk the Customer accepts when it chooses this kind of delivery. Short links we create for that purpose stop working 365 days after they are made.

Original captures. The original capture is deleted once processing completes, unless the Workflow the Customer purchased keeps it as an output. In two Workflows that deletion runs only on a successful run, so where a run fails part-way the capture may remain in our storage until the Purchase's data is deleted. The dashboard shows which outputs a Workflow stores. Deletion means deletion from our active systems; see section 7 for what survives in backups.

Temporary working copies. Producing a result creates temporary working copies of the Guest photograph and of intermediate results, for example a cropped copy prepared for the generation step and a cover frame built for a video. They are held in a temporary storage area during processing and are removed by our cleanup processes.

Outputs. The images, reports and videos produced for an event are kept for at least 365 days after the Event Date so that the organizer can download and use them. After that they may be deleted. We do not promise deletion on a fixed date, and we do not promise to keep them longer.

5. Recipients and processors

We share personal data only with suppliers that need it to run the service, and with public authorities where the law requires it. The categories are:

The complete list is the Subprocessor Register at /legal/subprocessors. It names the legal entity behind each category, the role it plays, the data it touches, the region it processes in, the transfer mechanism, and the contractual status of our arrangement with it. The Register is versioned and dated, its editorial history is kept and a copy of any earlier version is available on request, it is publicly accessible without a login, and it forms part of this policy by reference. It is the place we update when a supplier changes, which is why no supplier list appears here.

When we add or replace a supplier that processes Guest data, we announce it in the Register and by email to account holders at least 30 days before that supplier starts processing, and a Customer may object in writing within that period. The full procedure, including what happens if we cannot offer a reasonable alternative, is in the DPA.

6. International data transfers

Our own infrastructure is in the European Union: the database and authentication in Ireland, our servers in Germany, object storage under EU jurisdiction, and our application hosting in Ireland.

Some things still leave the European Economic Area, and the most important one is image and video generation. We name it directly rather than hiding it behind a category:

• Country. The United States of America.
• What goes there. For image and video generation: the Guest's photograph or a cropped copy of it, and the generation prompt, which contains survey-derived text and may contain the Guest's first name. For the AI text step: survey answers, the Guest's first name and the gender estimate, with no image. For website analytics: the visitor data described in section 3.10, only with consent. For transactional email: the recipient address and the content of the message. Our payment supplier and some of our infrastructure suppliers are US companies whose staff may access EU-hosted systems for support.
• Why. Producing the image, video or report a Guest asked for at the booth; delivering messages; measuring website use with consent; supporting the service.
• The mechanism. The European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). Module 2 is the controller-to-processor module and Module 3 the processor-to-processor one, so where we act as a processor for a Customer and the supplier is our sub-processor we rely on Module 3, and where a supplier treats us as the controller we rely on Module 2. To this are added the UK International Data Transfer Addendum where UK data is in scope, and the Swiss addendum where relevant. For a supplier certified under the EU-US Data Privacy Framework, we may rely on that adequacy decision instead. The basis relied on for each supplier is recorded in the Subprocessor Register, and where a supplier has not yet given us transfer terms in writing, the Register says so.
• Supplementary measures. Encryption in transit everywhere. Minimization of what is sent, so that a generation request carries what the model needs and not a customer record. A contractual prohibition on training models on what we send, applied as our selection standard and recorded per supplier in the Register. A contractual zero data retention mode with the suppliers for which the Register says so, meaning copies of the request content are deleted shortly after the request and are not written to logs or backups. Short breach notification deadlines. We assess and document these measures per supplier before the transfer starts and we review them.
• Getting a copy. You may obtain a copy of the Standard Contractual Clauses we rely on, or information about where they are available, by writing to support@boothapps.ai. The model text is also published by the European Commission.

UK customers: transfers from the UK to the EEA are covered by the UK adequacy regulations, and UK GDPR applies to a UK controller with this policy read accordingly.

7. How long we keep data

The table gives, for each category, the event that starts deletion and the mechanism that carries it out. Where no automated mechanism exists yet, the row says so honestly instead of quoting a period we do not enforce.

A word on terminology. Removing identifiers from a record is not the same as anonymizing it. Where we say a record is anonymized, we mean the identifying fields are replaced with a one-way hash and the direct identifiers are removed, which makes the record pseudonymous rather than anonymous, because someone holding both the secret and a candidate value could still test a match. Those records stay protected by this policy and are deleted at the periods above. We keep data indefinitely only where it is a genuine aggregate that cannot be traced back to a person.

8. Your rights

Where we are the controller, you have the following rights under the GDPR. If you are an event Guest, read section 4.4 first: your rights are exercised against the company that ran the event.

We also notify the recipients of your data about a rectification, erasure or restriction, unless that proves impossible or would require disproportionate effort, and we tell you who those recipients are if you ask (Art. 19).

How to exercise a right. Write to support@boothapps.ai and say what you want. If we cannot tell from the request who you are, we will ask for information that lets us confirm it. We ask only for what is proportionate, and we do not ask for identity documents.

How long we take. We answer within one month of receiving the request. If a request is complex, or if you have sent several, we may extend that by up to two further months, and we tell you within the first month if we do, and why.

Withdrawing cookie and analytics consent. The Cookie Policy at /legal/cookies explains what is stored and how to change it. Today that is done by clearing the site data for boothapps.ai in your browser, which also removes the record of your consent choices.

Complaints. If you think we have handled your data unlawfully, tell us first at support@boothapps.ai so that we can put it right. You also have the right to lodge a complaint with a supervisory authority, and doing so does not depend on contacting us. Our supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) ul. Stawki 2, 00-193 Warsaw, Poland https://uodo.gov.pl

If you live or work in another EEA country, or the alleged infringement happened there, you may complain to that country's authority instead (Art. 77 GDPR).

9. Automated decision-making

We do not make decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. We do not profile you, score you, or let software decide whether you may hold an account.

Two things are automated and could look like decisions, so we explain them.

AI processing of a Guest photograph is content generation, not a decision about a person. The Workflow produces an image, a video or a written report that the Guest asked for at the booth, on the instruction of the event organizer. The gender and age estimate described in section 4.5 exists only to choose the artwork and build the prompt. It does not decide whether a Guest is served, what a Guest may access, or anything else about a Guest's rights or situation. It is used only within the processing run and is not stored as a separate record about a person, it is presented as an estimate and never as a fact, and it is not used to work out who someone is.

Usage limits are contractual counters, not decisions. When a Purchase reaches the allowance you bought, processing pauses until you add more Transformations, and video stops at the number of clips you bought. That is the arithmetic of the contract you entered into, applied identically to every Customer. You can see the counter in your dashboard, we warn you before you reach it, and you can lift it yourself at any time.

Similarly, the geographic restriction described in section 3.2 is not a judgment about you. It is a check of the billing country against a published list, and the result is a full refund and an email, with a route to contact us if you think it was applied wrongly.

10. Security and personal data breaches

We use technical and organizational measures appropriate to the risk. In short: everything travels over HTTPS; passwords are stored only as hashes by our authentication provider; every database table is protected by row-level security and the tables holding operational Guest records are reachable only by our server processes; the credentials you connect for SMS and email are encrypted in the database and decrypted only server-side; administrative actions are restricted and recorded; our webhook and callback endpoints authenticate every caller; our own servers are hardened, firewalled and patched automatically; and our backups are encrypted and stored off-site.

The full, itemised description of the measures is Annex 2 of the Data Processing Agreement, which is where a Customer assessing us should look. We do not claim certifications we do not hold, and we do not claim an independent penetration test we have not had.

If a personal data breach happens. Where we are the controller, we assess it, record it, notify the supervisory authority within 72 hours where the law requires it, and tell the people affected without undue delay where the risk to them is high. Where we are the processor, that is, where the breach concerns Guest data, we notify the affected Customer without undue delay and no later than 48 hours after becoming aware, with the information staged as we establish it, so that the Customer can meet its own 72-hour deadline. The detail is in the DPA.

11. Children

BoothApps.ai is a service for businesses. Accounts are for people who are at least 18 years old and acting in a business capacity, and that is a condition of registration. We do not knowingly collect data from children through our website, our waitlist or our feedback portal.

At an event, a photograph may show a minor. The event organizer is the controller and is responsible for the lawful basis, including obtaining the permission of a parent or legal guardian before a minor's photograph is submitted, and for the separate permission that the use of a person's image requires under national law. Our Terms put that obligation on the Customer expressly. If you believe a photograph of a child has been processed without the necessary permission, write to support@boothapps.ai with the link or the identifier shown on the output. We block access and remove the material first and investigate afterwards.

12. Cookies and browser storage

The website uses a small number of cookies and browser storage items: the strictly necessary ones that keep you signed in, the record of your consent choices, the analytics and error-tracking items you can consent to, the security check on our forms, and the affiliate referral code described in section 3.9. Payment happens on our payment provider's own hosted page, on the provider's own address, so anything it stores on your device is stored there and not by us, under that provider's own notice.

The complete inventory, with the purpose, the provider, the lifetime and the consent category of every item, and how to give or withdraw consent, is in the Cookie Policy.

13. Changes to this policy

This policy is versioned and dated. The version and effective date are at the top.

If we make a material change, we will tell account holders by email before it takes effect, and the new version will be published here with a new version number and effective date. Each version is numbered and dated; earlier versions remain available on request. Changes that only correct a typing error or clarify wording without changing what we do take effect on publication.

Changes to the suppliers we use do not change this policy. They change the Subprocessor Register, which is part of this policy by reference, and are announced as described in section 5.

14. Contact

Innova.uno Sp. z o.o. Byslawska 84, 04-993 Warsaw, Poland KRS 0000417704, NIP PL5213629718, REGON 146081689

All privacy matters: support@boothapps.ai

Related documents: Terms of Service, Data Processing Agreement, Subprocessor Register, Cookie Policy, Refund Policy.