Privacy policy
The short version
- We collect what's needed to run your booths: your account, your events and designs, and the photos guests take.
- For guests' photos, the event's host decides; we store and process them for the host.
- Guests' photos are deleted after 7 days, unless the host keeps them with paid storage. Hosts can delete any session in one tap.
- We don't sell personal information, show ads, or recognise faces.
- Questions or requests: compliance@fotobooth.dev.
Who we are
fotobooth is photo booth software for events, run by Layag IT Solutions, Taytay, Philippines ("we", "us"). This policy explains what personal information we handle when you use fotobooth.dev, app.fotobooth.dev, the booth screen, guests' download pages and the Booth Agent, and what you can do about it.
We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and the issuances of the National Privacy Commission (NPC).
Our role, and the host's
fotobooth has two kinds of users, and our role is different for each:
- Customers are the people and businesses with a fotobooth account: booth operators, event hosts and their staff. For their account information, we decide how it's used, so we are the personal information controller.
- Guests are the people who use a booth at an event. The customer running the booth decides to take, print and share guests' photos and videos. For that, the customer is the controller and we process the photos on their behalf, as a personal information processor, only to provide fotobooth to them.
If you were a guest at an event and have a question about your photos, you can ask the event's host or booth operator, or contact us and we'll help.
What we collect
| What | From whom | Why |
|---|---|---|
| Name, email address and profile picture, from Google sign-in | Customers | To create your account and sign you in |
| Workspace name, team members and their roles, invitations | Customers | To run your workspace and let your team in |
| Events, designs, uploaded images and backdrops, booth settings, booth names | Customers | To set up and run your booths |
| Guests' photos, prints and video messages, with the time they were taken | Guests, through the customer's booth | To show, print, store and share them as the customer set up |
| Payment records: amount, what was bought, PayMongo reference and status | Customers, and PayMongo | To give you the time or storage you paid for, and for tax records |
| Google Drive or Dropbox connection (encrypted access token, account email, folder) | Customers who connect them | To copy event photos into your own storage |
| Technical records: IP address, browser, times of requests, errors | Everyone | To keep the service secure and working, and to fix problems |
We don't ask guests for their names, emails or phone numbers, we don't use guests' photos to recognise or identify anyone, and we don't sell personal information or use it for advertising.
AI backdrops find the people in the picture on the booth computer itself; that picture isn't sent to us or to anyone else for it.
We never see your GCash, Maya or bank details: you pay inside your own app, through PayMongo, and PayMongo tells us the payment went through.
How we use it
- To provide fotobooth: sign-in, booths, printing, galleries, guests' download pages and copies to your storage.
- To take payments, keep records and send you messages about your account (for example, that your plan is about to end).
- To keep fotobooth secure, stop misuse, and find and fix problems.
- To meet legal obligations, such as tax and accounting rules.
Our lawful basis is the contract with our customers (to provide what they signed up for), our legitimate interest in running a secure service, and legal obligations. For guests' photos, the customer, as controller, is responsible for having a lawful basis and for telling guests (for example, with a sign at the booth).
Who we share it with
Only with the service providers we need to run fotobooth, under agreements that protect your information:
- Hetzner Online GmbH (Germany): our servers and photo storage, in data centres in Falkenstein, Germany.
- Cloudflare, Inc.: delivers our websites securely and quickly.
- Google LLC: sign-in with Google; and Google Drive, if you connect it.
- Dropbox, Inc.: only if you connect Dropbox.
- PayMongo Philippines, Inc.: payments.
- Vercel Inc.: hosts this website (fotobooth.dev).
Guests' photos are shared with the people the customer chooses: the customer's team, and the guest who opens their download link. Anyone with a session's download link can see that session's photos, so treat the link like the photos themselves.
We may disclose information when the law requires it, for example a lawful order from a court or the NPC.
Storage outside the Philippines
Our servers and photo storage are in Germany, in the European Union, which has strong data protection laws. Some of our service providers also process information in other countries. When information leaves the Philippines, we stay responsible for it under the Data Privacy Act and use providers that protect it to a comparable standard.
How long we keep it
- Guests' photos and videos: 7 days after they're taken, then deleted automatically, unless the customer has extra storage, which keeps them while it's paid. If storage ends, past events' photos are kept for 6 more months, then deleted.
- Deleted photos: when a customer deletes a session (for example, because a guest asked), its photos are deleted from our storage straight away.
- Copies elsewhere: copies in a customer's Google Drive or Dropbox, on the booth computer (saved by the browser or the Booth Agent), and prints are under the customer's control, not ours.
- Account information: while your account is open. When you ask us to close it, we delete it, except what we must keep.
- Payment records: for as long as Philippine tax and accounting rules require.
- Technical records: only as long as we need them to run fotobooth and keep it secure.
Your rights
Under the Data Privacy Act, you have the right to:
- be informed about how your personal information is used (this policy);
- access your personal information and get a copy;
- correct information that's wrong;
- object to its use, and have it blocked or deleted, when there's no longer a reason to keep it;
- get your information in a format you can use elsewhere (data portability);
- be compensated for damage caused by wrong or unlawful use;
- complain to the National Privacy Commission (privacy.gov.ph).
To use these rights, email us at compliance@fotobooth.dev. To delete your data, see how to delete your data. We'll answer within 15 working days. Guests can also ask the event's host, who can delete their session from the event's gallery in one tap.
Cookies
The fotobooth app uses cookies only to keep you signed in. The booth screen also saves its event, settings and waiting photos on the booth device, so it works without internet. We don't use advertising or tracking cookies.
This website (fotobooth.dev) doesn't set cookies. Our websites load their font from Google Fonts, which receives your IP address.
Security
We protect information with encrypted connections (HTTPS), access controls and team roles, encrypted storage of connected-account tokens, and booth setup PINs that are stored only in scrambled (hashed) form. No system is perfectly secure; if a breach puts your personal information at real risk, we'll tell the NPC and the people affected within 72 hours of finding out, as the law requires.
Children
Accounts are for people 18 and over. Events like birthdays and debuts may include children in photos; the host running the booth is responsible for the consent of parents or guardians. A parent or guardian can ask the host or us to delete a child's photos at any time.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change matters, we'll tell customers by email or in the app before it takes effect.
Contact us
Data Protection Officer, Layag IT Solutions
Taytay, Philippines
Email: compliance@fotobooth.dev