Privacy policy
Regulation (EU) 2016/679 (GDPR) · Last updated: 29/08/2026
1. Data controller
For the account and the subscription: ggaillet — Guillaume Gaillet, Tournai,
Belgium (see the legal notice),
contact@boothapp.be.
For the photographs taken at an event (including those hosted in an online
gallery, see §4): the photo booth operator is the data controller; the Publisher
acts as a processor within the meaning of article 28 GDPR, on the operator's
instructions (activating the gallery, choosing the retention period).
2. Data processed
- Account: e-mail, identifier, subscription and licence data.
- "BoothApp Remote" mobile app (Android): sign-in e-mail and password (or a Google account if you pick that route), profile display name. The app collects no data for advertising or analytics: no ads, no tracker, no audience measurement tool. It accesses neither the photos, nor the contacts, nor the location, nor the camera of the phone. See §9.
- Photographs taken by the booth (images of the guests).
- Online gallery photographs (option): if the operator activates the gallery for an event, a compressed copy of each photograph is hosted online for the retention period they chose (see §4 and §5).
- Contact details entered to receive a photograph: e-mail and/or phone number.
- Minimal technical data: session identifier, timestamp, print counters.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Managing the account and the subscription | Performance of the contract |
| Taking and showing the photograph on the booth | Consent (the person triggers the shot) |
| Sending the photograph by e-mail | Consent (details provided) |
| Printing the photograph | Consent / legitimate interest (event keepsake) |
| Hosting an online gallery reachable by link (option activated by the operator) | Consent (the person chooses to open the link) / the operator's legitimate interest |
4. Data sharing
- Local gallery (QR): the photograph is served on the local network only.
- Online gallery (option): if the operator activates it for an event, the photographs are hosted through Supabase (EU) and reachable through a unique, unguessable link / QR code, with no account and no identification of the guest. Anyone holding the link can view and download the photographs it contains until the gallery expires — the operator remains responsible for how that link is circulated (showing or sending it only to the guests of their event).
- E-mail: through the BoothApp sending server, or the one the operator has configured (SMTP).
- Site audience measurement: boothapp.be counts its visits with Vercel Web Analytics — no cookie, no identifier kept, and no tracking from one site to another. No consent banner is therefore needed, and nothing makes it possible to recognise you from one day to the next.
- Processors: Supabase (accounts, events, online gallery, EU), Stripe (payments, Ireland), Vercel (site and portal).
- No resale and no advertising.
5. Retention
Photographs stored locally on the booth (%LOCALAPPDATA%\BoothApp), under the
operator's control: retention period configurable in the application (automatic deletion after the
chosen delay) or manual deletion. Contact details entered by guests are kept locally on the booth
(a book specific to the event, never sent to the Publisher) and can be deleted by the operator.
Account data are kept for the duration of the contractual relationship and the legal periods.
Online gallery (option): the photographs stay online for the period the operator chose at activation (7 to 90 days after the end of the event), then are deleted automatically (files and associated records) by a scheduled daily purge, with no action required from the operator or the guest. The operator can also switch the gallery off and delete the photographs manually at any time from their BoothApp area. An account is limited to a total gallery storage volume (currently 10 GB): beyond it, new photographs are refused until space is freed (manual deletion or purge).
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. Guests may ask for their photograph to be deleted during and after the event. Contact: contact@boothapp.be.
Deleting your account: you can delete your BoothApp account and the associated data at any time, yourself, from the portal or the Windows application — the full procedure and the list of deleted data are on the Delete your account page (in French).
You may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be. If you live in another EU country, you may equally address your own national supervisory authority.
7. Security
Local storage on the booth, admin access protected by a kiosk PIN code and an operator account. Secrets (SMTP, tokens) protected at rest. E-mail connections over the providers' secure protocols.
8. Notice for guests (to display next to the booth)
"This booth takes your photograph at your request. If you enter your e-mail or phone number, it is used only to send you your photograph. If an online gallery is offered for this event, a link/QR code lets you view it and download your photographs; it is deleted automatically a few days after the event. Your data are not resold. For any request (access, deletion): speak to the booth operator or write to support@boothapp.be."
9. "BoothApp Remote" mobile app (Android)
The mobile app is a remote control accessory for the booth: it takes no photograph and stores none. It only serves to look at your booths and your events, and to act on them remotely (starting, pausing, stopping an event on a booth, print limit).
- Data transmitted: only your sign-in details (e-mail, password or Google identification) and the account data already described in §2. They travel encrypted (HTTPS/TLS) to Supabase (EU).
- Stored on the phone: a session token, so you do not have to sign in again each time. It is erased on sign-out or uninstall.
- No direct link with the booth: the app never contacts your booth itself — no IP address or key to enter, no access to your local network. Everything goes through your account in the cloud, over HTTPS; the booth picks up your commands there.
- No sharing with third parties, no resale, no advertising, no profiling.
- Deletion: see Delete your account (in French).