Privacy Policy

1. Data we collect

We collect only what we need to provide the service:

• Account data — your email address, hashed password, and business name when you register.
• Event data — event titles, dates, locations, notes, and status that you enter into the platform.
• OAuth tokens — access and refresh tokens for connected integrations (Google Calendar, Etsy, Shopify, QuickBooks). All tokens are encrypted at rest using AES-256 before being stored.
• Log data — server-side logs including IP address, browser type, and pages accessed, retained for up to 30 days for security and debugging purposes.

2. How we use your data

• To authenticate you and maintain your session.
• To store and display the events and data you create.
• To communicate with connected integrations on your behalf.
• To detect and prevent abuse, fraud, and security incidents.
• To send transactional emails (e.g. password reset) — we do not send marketing email without consent.

3. Data storage and security

Your data is stored on servers located in the European Union. We apply the following protections:

• All OAuth tokens encrypted with AES-256 before database storage.
• Passwords hashed with bcrypt (12 rounds) — we never store plaintext passwords.
• All data in transit protected by TLS 1.2+.
• Database access restricted to the application server; no public exposure.
• No third-party analytics or tracking scripts embedded in the application.

4. Third-party integrations

When you connect a third-party service (Google, Etsy, Shopify, QuickBooks), we access only the scopes you explicitly authorize. We do not share your integration data with any other party. You can disconnect any integration at any time from your dashboard, which immediately deletes the stored tokens.

5. Address lookup and mapping

To suggest addresses as you type and to estimate driving distance for mileage deductions, we send the address text you enter — and no other account information — to OpenStreetMap-based mapping services (Photon for address suggestions, Nominatim for geocoding, and OSRM for route distance). These requests are made by our server, not your browser, so your IP address is not shared with them. No name, email, or other identifying data accompanies the lookup.

6. Data sharing

We do not sell, rent, or share your personal data with third parties except:

• When required by applicable law or a valid legal process.
• To protect the rights, property, or safety of VARO Industries, our users, or the public.
• In connection with a merger or acquisition, in which case users will be notified.

7. Data retention

Your account data is retained for as long as your account is active. If you delete your account, all associated data (events, integrations, tokens) is permanently deleted within 30 days. Log data is purged after 30 days on a rolling basis.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Object to or restrict certain processing activities.
• Data portability (export of your event data in a standard format).

To exercise any of these rights, email [email protected].

9. Cookies

We use a single httpOnly, Secure, SameSite=Strict cookie to maintain your authenticated session (refresh token). We do not use advertising cookies, tracking pixels, or any analytics cookies.

10. Children

BoothBook is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, contact us at [email protected] and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by displaying a notice in the application at least 14 days before the change takes effect. Continued use of the service after that date constitutes acceptance of the updated policy.

12. Contact

Questions or concerns about this policy? Contact us at: