Privacy Policy

Last updated 11 September 2026

Boothiva holds two very different kinds of information, and the difference decides everything else in this policy: the account details of the operators who buy the software, and the photographs their guests take at events. We decide what happens to the first. Our customers decide what happens to the second, and we act on their instructions.

1. Who we are

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It applies to boothiva.com, the customer and administrator portals, the booth application, and our API.

2. Our two roles

For account and business information, we are the entity responsible. If you sign up for Boothiva, we decide what we collect about you and why, and this policy governs it.

For photographs taken at events, our customer is responsible and we are not. The photobooth operator running the event decides what is captured, who may see it, and how long it is kept. We store and process those photographs on their instructions and do not use them for any purpose of our own. If you were photographed at an event and want your photograph removed, contact the operator who ran that event — they can delete it immediately. If you cannot reach them, write to us and we will pass the request on. The terms governing that relationship are in our Data Processing Agreement.

3. What we collect

When you open an account

• Your first and last name, and your email address.
• Your password, stored only as a salted hash — we never hold the password itself and cannot recover it.
• If you turn on multi-factor authentication, the shared secret needed to verify your codes.
• Your business name, contact email, and optionally a contact phone number, country and time zone.

When you use the product

• The events, templates, devices and galleries you create, and the settings you choose.
• An audit history of significant actions taken in your account — who did what, and when. This exists so that you can see it, and so that a change to your own data can be accounted for.
• Session records from your booths: which device, which event, when it started and finished, how many photographs were taken, and whether the guest gave consent. These records contain nothing that identifies the guest.
• Diagnostic log bundles, when you or we upload them from a booth to investigate a fault. These are deleted automatically after 30 days.
• Fault reports, when something fails while serving a request or running a background job: the error and the code path that produced it, sent to Sentry in the European Union. It is set up to send no request bodies, cookies, user identifiers or addresses, and it never receives photographs.

When you pay us

Payments are handled entirely by Stripe. We never see or store your card number. We hold your subscription status, plan, billing period and the identifiers Stripe gives us to link your account to your subscription.

Photographs

Photographs taken at an event are stored against that event. They are the only content in the system that depicts an identifiable person who is not one of our customers, and they are treated accordingly — see sections 2, 5 and 6.

4. What we deliberately do not collect

Stating this plainly because it is unusual, and because it constrains what we could do even if we wanted to:

• No contact details are captured from guests. The booth does not ask a guest for a name, an email address or a phone number, and there is nowhere in the system to store one. A guest's photograph is not linked to any identity we hold.
• No advertising or analytics trackers. This website sets no cookies at all and loads no analytics script. The portals set only what signing in requires: a session cookie and a cross-site request forgery token.
• No IP address logging against your account. Requests are logged for a short period for operational purposes, but we do not build a record of where you sign in from.
• We do not sell personal information, and we do not disclose it for anyone else's marketing.

5. Why we hold it, and on what basis

We collect account and business information because we cannot provide the product without it: to create your account, authenticate you, apply the limits of your plan, bill you, send you transactional email about your account, and support you when something breaks. We hold photographs because our customer has asked us to store them on their behalf.

We do not use your information for anything else. We do not use photographs to train anything.

6. How long we keep it

• Photographs are deleted automatically once they pass the retention window of the customer's plan. This runs daily. A customer can also delete an event's photographs at any time, which takes effect immediately.
• Diagnostic log bundles are deleted automatically 30 days after upload.
• Account and business records are kept while the account is open. After it closes we keep only what we must for tax and record-keeping obligations, and delete the rest.
• Audit history is kept for the life of the account, because its purpose is to be able to account for past changes.

7. Where it is stored

Your data is stored in Australia. The database is hosted in Sydney, the servers that run the API and background jobs are in Sydney, and the object storage holding photographs is in the Oceania region.

Three things necessarily leave Australia, and the Australian Privacy Principles require us to say so:

• Stripe processes payments and is based in the United States.
• Resend delivers our transactional email and is based in the United States. It receives the recipient's email address and the contents of the message.
• Sentry receives our fault reports and stores them in the European Union. It receives no photographs and no contact details.

In addition, requests to our websites pass through Cloudflare's global network, which may route a request through infrastructure outside Australia in transit. Stored data is not held there.

Every provider we use is listed, with what it receives, on our sub-processors page.

8. How we protect it

• All traffic is encrypted in transit. The site and portals are served over HTTPS only.
• Every query against customer data is filtered by tenant at the database layer, so one customer's account cannot read another's. This is enforced centrally rather than remembered case by case, and the few places that deliberately operate across all customers — billing reconciliation, retention sweeps — are individually listed and tested.
• Passwords are stored as salted hashes. Multi-factor authentication is available on every account and we recommend turning it on.
• Uploaded files are scanned before they are made available.
• Access to production systems is limited to the operator named in section 1.

No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify the affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9. Access, correction and complaints

You can see and change most of your information yourself in the portal at any time. Beyond that, you may ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, or ask us to delete your account and its data. Write to help@boothiva.com and we will respond within 30 days.

If you are unhappy with how we have handled your information or your request, tell us first — we would rather fix it. If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects how we handle your personal information, we will email account holders before it takes effect rather than relying on you to notice.