Privacy statement
BoothManager is booth-planning software. Using it means processing personal data — customer names, contacts, what you discussed. This page explains what we process, why, where it lives and the rights people have.
Version: 29 September 2026.
This is an honest working draft based on how the system actually runs today. It still needs review by a lawyer / data-protection officer before it is relied on, and the fields marked “to be completed” need your organisation’s legal details.
Who is responsible
Two roles, because it matters who decides what happens with the data.
- Your company is the controller for customer data
- The company using BoothManager decides which fair contacts and customers are stored and why. Heide Ventures (the company behind BoothManager) only processes that data on their instructions (a “processor”). A standard-form data processing agreement is available in-app — a company administrator can review and accept it under Company settings.
- Heide Ventures is the controller for account data
- For the login accounts of app users (name, e-mail), Heide Ventures (KvK 30252428, trading as BoothManager) is the controller. Contact: info@boothmanager.eu. DPO details: to be completed.
What we process
- Account
- Name and e-mail address of colleagues who log in.
- Customers & fair contacts
- Name, company, role, e-mail, phone, country, notes and a tag — as entered or imported by your team.
- Planning & logistics
- Meetings and who attended, travel (arrival/departure, hotel, and a licence plate for parking), check-in times, and any badge or ticket a colleague uploads for themselves.
- Billing (only if your company subscribes online)
- The subscription status and Stripe’s customer reference. Billing contact, address, VAT number and card details are entered on Stripe’s own pages and stay with Stripe.
- No tracking
- Only functional cookies (theme, language) and the login session. No analytics, advertising or third-party tracking — so no cookie banner is needed.
Why, and on what basis
- To run the service
- Data is processed to provide booth planning to your company under our agreement with them. Login data rests on that contract and our legitimate interest in running a secure product.
- Fair contacts
- Storing leads and customers is normally based on your company’s legitimate interest (following up business contacts), or on consent where that applies. Your company sets and documents this basis as the controller.
Where it is stored
- In the EU
- Database and application both run in Frankfurt, Germany (Supabase eu-central-1, Vercel fra1). The optional services under “Who else touches the data” are the exceptions, and each says where it runs.
- Protected
- Encrypted in transit (HTTPS) and at rest (AES-256), separated per company by row-level security. See the security page for the details.
Who else touches the data
The full list of sub-processors, stated plainly.
- Supabase — database & login
- Runs on AWS in Frankfurt. Supabase Inc. is a US company; the data itself stays in the EU.
- Vercel — hosting
- Runs in Frankfurt. Vercel Inc. is a US company; the data itself stays in the EU.
- Push notifications (only if enabled)
- If a colleague turns on notifications, the browser’s push service (Google, Apple or Mozilla) delivers the alert. Only a device token and the message are involved.
- Resend — calendar-sync e-mail (only if used)
- Sends the invitation e-mail for “Send invitation”, and receives mail CC’d to your company’s sync address, only for that optional feature. An American company; unlike Supabase and Vercel above, we do not have confirmed EU-only data residency for it — see /security for what that means in practice.
- Stripe — payments (only if your company subscribes online)
- Handles checkout, card payments and invoices when an administrator subscribes online. Stripe is an American company with its European entity in Ireland. Card details never reach BoothManager; we keep only the subscription status.
- Anthropic — AI business-card reading (only if your company turns it on)
- Off by default. When an administrator switches it on, the photo of a scanned business card is sent to Anthropic, an American AI provider, to read the contact details. This processing takes place outside the EU. BoothManager does not store the photo.
How long we keep it
- While in use, until deleted
- Data is kept while the account is active and removed when you delete it or close the account. A fixed retention period per data type is still to be set by your organisation.
Your rights
Everyone whose data is processed can exercise these under the GDPR.
- Access & portability
- Ask what is stored and get a copy. Admins can export a customer’s data from the app; for other data, contact us.
- Rectification
- Have incorrect data corrected — customer and account records are editable in the app.
- Erasure
- Have data deleted. Deleting a customer removes their record and links; ask if you need a full erasure across older meetings.
- Object & complain
- Object to processing, and complain to a supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens).
Exercising a right or a question?
For customer/lead data, requests go through the company using BoothManager (the controller) and we help them. For account data or anything about this statement: info@boothmanager.eu.
← Back to home