Privacy Policy

1. Who is responsible

The controller of the data handled in the BoothNook app and on this site is Javier Expósito Martínez, resident in Spain. For any privacy question you can write to me at nikastudio.dev@gmail.com. The holder's full details are in the legal notice.

2. What data the app collects

None reaches me. The app has no accounts and does not ask for your email. You can give your profile a name and a photo; both are optional and stay on your device. The app does not connect to the internet on its own, neither to servers of its own nor to third-party services.

The links in Settings open this site in your browser; the “This website” section then applies.

3. Where your data is kept

Your designs, products, offers, events, sales, expenses and stock movements, your profile and your settings are kept only on your device, in the private storage the system reserves for the app, which other apps cannot read. If you uninstall the app or clear its data from the system settings, they are deleted.

4. Photos and camera

If you add a photo to a product, to your profile or to an event, or an image to the banner of your stand design, the app uses the camera or the gallery only at that moment and because you ask it to. The images are kept on the device, like the rest of your data.

5. Backups

You can export a backup as a ZIP. The ZIP holds your designs, products, offers, events, sales, expenses and stock movements with their images, plus your profile name and your settings; it does not hold your profile photo. Importing it restores all of that except the profile and the settings, which are not applied.

You create it and decide where to keep it or whom to share it with; BoothNook does not receive a copy. If you share the ZIP, you also share your profile name. The ZIP is not encrypted, so keep it somewhere you trust. If you send the ZIP or the image of a design to another app or to a cloud service, that service's privacy policy applies.

6. Ads and analytics

The app shows no ads, does not measure how you use it and includes no third-party kits that collect data.

7. Data when you visit the site

The site is always served over HTTPS. When it serves each page or the app's file, the hosting records technical data about the request, such as the IP address, the page or file requested, the date and the browser. They are used to deliver the site, detect errors and protect it against abuse and attacks. Legal basis: my legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR).

8. If you write to me

If you write to me, or reply to a back-office notice, I use your email address and your message only to reply to you, and I delete them once the conversation is no longer needed. I receive and answer them with Gmail, from Google (see “Who else is involved”). Legal basis: my legitimate interest in dealing with what you ask (Article 6(1)(f) GDPR).

9. If you sign in to the back office

If you have an account in the back office, I keep your email address and your name and, for each passkey, its public key, its identifier, the type of device and, if its provider is not recognised, the browser and system you created it with, so you can tell it apart; your fingerprint, face or PIN never leaves your device. Each time you sign in, I keep the session's IP address and browser. To curb abuse, I count the sign-in attempts from each IP address over one minute, also if you have no account.

When an admin changes an account from the back office (its role, or blocks or unblocks it, or ends its sessions), I keep a record of the change: who made it, on which account, what changed and when. I also keep it when, as the portal's controller, I grant or remove the admin role, invite an admin or remove their passkeys, or close sessions from the server; that record says it was me, with no other data. The record holds only the accounts' internal identifiers, never the email address or the IP address. It lets me know who made each change and undo it: my legitimate interest in the security of the site (Article 6(1)(f) GDPR). Each record is kept for 12 months and deleted at most 30 days later.

When an admin creates or changes a tutorial or a version of the app from the back office (editing, publishing, withdrawing, archiving or moving it in the list), I also keep a record: who did it, which tutorial or version, which step and when, and, if it changed, its status or its position. When a version is published, the record also says which earlier versions' files are no longer kept. This record holds only internal identifiers, never the titles, texts, notes, videos or images, and it has the same purpose, legal basis and retention as the one for accounts.

When a passkey is added to your account or one is removed, I let you know by email so you can tell whether it was you: the notice says what happened, the name the passkey is shown with, the Madrid date and time and the browser and system it was done from, never the IP address. I write to you in the language I keep in your account, Spanish or English. Brevo sends it (see “Who else is involved”).

The account, with its language, is there to give you the access you ask for (Article 6(1)(b) GDPR). The IP address, the browser and the email notices are there to protect the access and curb abuse: my legitimate interest in the security of the site (Article 6(1)(f) and Recital 49 GDPR).

The account is kept while you have access, and I delete it if you ask. A session lasts 24 hours at most, or until you sign out. What has expired (sessions, invitations and attempt counters) is deleted at most 30 days after it expires. Neon hosts this data (see “Who else is involved”).

10. Who else is involved

Vercel Inc. hosts this site and Cloudflare, Inc. serves the app's file, both as processors. Neon, part of Databricks, Inc., hosts the back office's database in the European Union (Frankfurt), also as a processor. All three companies are based in the United States; any transfer of that data to the United States relies on their certification under the EU-U.S. Data Privacy Framework and on the European Commission's standard contractual clauses. You can read how they handle data in Vercel's privacy notice, Cloudflare's privacy notice and Databricks' privacy notice.

Brevo SAS, based in Paris (France), sends the back office's email notices as a processor and keeps its data in the European Union, in France and Belgium. Some of its sub-processors are in the United States and India; those transfers rely on the European Commission's standard contractual clauses and, in the United States, also on the EU-U.S. Data Privacy Framework. You can read how it handles data in Brevo's privacy notice.

Google Ireland Limited, in Ireland, provides the email service (Gmail) with which I receive and answer your messages. Google may process them in the United States, at Google LLC, under the EU-U.S. Data Privacy Framework. You can read how it handles them in Google's privacy policy.

The European Commission's standard contractual clauses are published in Commission Implementing Decision (EU) 2021/914.

11. How long data is kept

Vercel keeps the technical records of each request to this site for one day and then deletes them. Cloudflare publishes no period for those of the app's file: it keeps them for as long as it needs to serve it and protect its network, as its privacy notice explains. What Vercel and Cloudflare keep on their own account for the security of their platforms is also explained in their notices.

The data of the sign-in to the back office is kept as “If you sign in to the back office” explains; what is deleted from the database stays at most seven days in the history from which Neon can restore it. Brevo keeps the record of each notice it sends for one month and then deletes it; what it keeps on its own account for the security of its platform is explained in its privacy notice.

When I delete an email from Gmail, Google takes about two months to remove it from its systems, and it may stay up to six months in its backups.

12. Cookies

This site uses no analytics or advertising, and the fonts are served from the site itself. Visiting it stores nothing on your device. Technical cookies, exempt from consent, are only used when you sign in, and YouTube may store cookies if you choose to play a video. Each cookie, how long it lasts and how to delete it are in the cookie policy.

The back office's email notices carry a tiny, invisible image (a pixel), and Brevo routes their link through an address of its own. With them, Brevo records anonymously, without your email address or your IP address, whether the notice is opened and whether the link is clicked. Brevo uses this for its sending statistics; I don't use it. If you don't want it recorded, block remote images in your email program and copy the address the notice shows as text instead of clicking the link.

13. Minors

BoothNook is meant for artists who sell their work and is not directed at children under 14. Neither the app nor the site collects data from minors.

14. Your rights

Right to object. You can object at any time to what I process on the basis of my legitimate interest (the technical records, the messages you write to me, the security of the sign-in, the email notices and the attempt counter) by writing to nikastudio.dev@gmail.com. I will stop unless there are compelling legitimate grounds that override your interests, rights and freedoms, or I need it to establish, exercise or defend legal claims.

You can ask for access to, rectification, erasure, restriction or portability of your data by writing to the same address. I will reply within one month. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD).

15. Changes

If this policy changes in an important way (for example, if the app starts collecting data), I will announce it on this page and in the next version of the app before it applies. The date at the top shows the last revision. The policy is published in Spanish and in English; if the two versions differ, the Spanish one prevails.