The legal stuff, but in plain English. No confusing jargon, just exactly how we handle your data.

​

Promise: We treat your data the way we'd want our own data treated. We don't sell it, we don't use it to train AI models, and we keep it separated from everyone else's.

​

Version 1.5 Last updated: July 22, 2026

⚡ TL;DR (The Short Version)

BoothFlo is a B2B platform for routing sales meetings at trade shows. To make the app work, we collect user emails for login, your uploaded sales routing data (Reps, Accounts, Territories), and logs of the meetings you book. We store this securely in the United States on Google Cloud. We use a few trusted third parties to help run the app (like Mailgun for sending emails and tawk.to for chat support), but we absolutely never sell your data, and we never use it to train AI models. If you close your account, we permanently delete your data 30 days after your final billing cycle.

1. Who We Are

When we say "we," "us," or "our," we are talking about BoothFlo LLC, the company that builds and runs BoothFlo. BoothFlo is a business-to-business (B2B) service intended for use by companies and their employees, not for individual consumers.

​

Contact: hello@boothflo.com

2. Information We Collect

Because BoothFlo is a business tool, we only collect the information necessary to provide the service. We break this down into three categories:

A. Information You Provide to Us

• Account Information: When you or your Tenant Admin creates an account, we collect names, email addresses, and assigned roles (like Admin or User).

• Customer Sales Data: To make the routing engine work, Tenant Admins upload CSV files containing their organization's Sales Reps (and their calendar links), Named Accounts, and Geographic Territories.

• Support Inquiries: If you email us or use our live chat for help, we collect that correspondence so we can actually help you.

B. Information We Collect Automatically

• Booking Logs: When a user books a meeting on the show floor, we log the details: who booked it, which rep it was routed to, the event name, and the timestamp.

• Audit and Security Logs: To keep the platform secure, we maintain structured system logs of important events (like logins, data uploads, password resets, and administrative changes).

• Device and Connection Data: Like almost all websites, our servers automatically collect basic device and connection metadata, such as IP addresses, browser type and version, operating system, device identifiers, referring URLs, and pages viewed. We use this to make sure the app is working properly and to investigate abuse.

• Approximate Location: We may derive a general geographic location (city or region level) from your IP address for security and analytics purposes. We do not collect precise GPS location.

C. Cookies and Similar Technologies

Today, BoothFlo uses only essential cookies required to keep you logged in and to keep the app secure. As we grow, we may introduce analytics or product-usage tools to understand how the app is used and improve it. If we do, we will update this policy and, where required by law, ask for your consent through a cookie banner before those cookies are set.

 

We do not use cookies for advertising or cross-site tracking.

3. How We Use Your Information

We do not sell your personal information or your company's sales data. Ever. We also do not use your data to train AI models: not ours, not our vendors', not anyone's.

 

We only use your data to:

 

• Provide, maintain, and secure the BoothFlo platform.

• Authenticate your identity via passwordless email links.

• Route your prospects to the correct sales representative's calendar.

• Generate your booking analytics and event reports.

• Send you important administrative emails (like tenant invitations and system alerts).

• Monitor the health of your data (e.g., flagging stalled CSV uploads or missing calendar links).

• Provide customer support via email or live chat.

• Improve BoothFlo, but only using de-identified or aggregated data (for example, "the average tenant has X events per year"), never using your identifiable sales data or contacts.

• Comply with legal obligations (like tax and accounting records) and enforce our Terms of Service.

 

For our EU / UK customers: where the GDPR or UK GDPR apply, our lawful bases for processing are (1) performance of a contract with you, (2) our legitimate interests in operating and securing a stable B2B platform, (3) your consent where we ask for it (like optional cookies), and (4) compliance with a legal obligation.

4. How We Share Your Information (Sub-processors)

We do not share your data with advertisers or data brokers. However, we do use a few trusted third-party services (called sub-processors) to host our infrastructure and run the app.

 

Here is exactly who touches your data and why:

 

• Google Cloud & Firebase/Firestore: This is our core cloud provider. Your data and our application are hosted securely on their infrastructure in the United States.

• Mailgun: We use Mailgun to deliver our system emails (like your secure login links). They process your email address strictly for the purpose of delivering these messages.

• Google Gemini (via Genkit): We use Google's AI specifically to generate the secure HTML templates for our system emails. Important: We do not use AI to process your underlying sales data, and no BoothFlo data is used to train Google's AI models.

• Tawk.to: We use tawk.to, to provide live chat support on our platform. If you interact with our chat widget, they process your chat transcripts and basic metadata (like your IP address), so our team can assist you.

• Stripe: We use Stripe to process subscription payments and manage recurring billing. Stripe receives your billing name, email address, billing address, and payment method. Your full credit card number is entered directly on Stripe's secure infrastructure. BoothFlo never sees or stores it.

 

We also may share your information when:

 

• Legally required. If we receive a valid subpoena, court order, or other lawful request, we will comply. We will attempt to notify you first unless we are legally prohibited from doing so.

• Safety and enforcement. To investigate, prevent, or address suspected fraud, security incidents, violations of our Terms of Service, or threats to the safety of any person.

• Business transfers. If BoothFlo LLC is ever involved in a merger, acquisition, financing, reorganization, or sale of assets, your data may be transferred as part of that transaction. If that happens, we will notify Tenant Admins in advance, and the new owner will remain bound by the commitments in this policy (or a policy at least as protective).

• With your direction. If you or your Tenant Admin instructs us to share data with a specific third party (for example, an integration you enable).

5. Security and Data Isolation

We take architecture-level steps to keep your data safe.

 

• Tenant Isolation: Every organization on BoothFlo is an isolated "Tenant." Your data is kept strictly separated from every other customer's data using custom security claims directly in our database rules.

• Encryption at Rest: All of your organization's data, including sales lists and booking logs, is automatically encrypted at rest while stored within Google Cloud Firestore.

• Encryption in Transit: All data moving between your browser and our servers is protected with modern TLS encryption.

• Log Redaction: We use advanced logging tools (Pino) that automatically scrub sensitive information (like security tokens, passwords, and tenant IDs) before logs are ever saved.

• Platform Oversight: Our support team can see metadata (like how many events you have or row counts) to help you troubleshoot, but we cannot and do not read your actual sales data or prospect lists.

 

No system is perfectly secure, but we take our responsibility seriously and design BoothFlo to minimize risk.

 

Data Breach Notification: In the unlikely event of a confirmed security breach that compromises your organization's data, we will notify your Tenant Admin via email within 72 hours.

6. Data Retention and Deletion

You own your data. We don't want to hold onto it if you aren't using the app.

 

• Active Accounts: We keep your data as long as your account is active so you can access your historical event logs and routing setups.

• Cancelled Accounts: If you cancel your subscription, your account stays active until the end of your billing cycle.

• The 30-Day Purge: 30 days after your final billing cycle ends, we securely and permanently delete all of your organization's underlying data, including Reps, Accounts, Territories, and Booking Logs.

• Records We May Keep Longer: We may retain a limited amount of information for legal, tax, accounting, or dispute-resolution purposes (like invoices), along with de-identified or aggregated statistics that no longer identify you.

 

Note: If you need your data deleted sooner, just email us.

7. International Data Transfers

BoothFlo is hosted in the United States on Google Cloud. If you access BoothFlo from outside the U.S. (including from the EU, UK, or other regions with different privacy laws), your data will be transferred to, stored in, and processed in the United States.

 

For customers in the EU, UK, or Switzerland, we rely on appropriate safeguards for these transfers, typically the European Commission's Standard Contractual Clauses (SCCs) and the UK's International Data Transfer Addendum,  which are in place through our sub-processors' data processing terms.

​

If you would like more information about these safeguards, or need a signed Data Processing Addendum (DPA) that incorporates the SCCs and UK IDTA, email us.

8. Your Privacy Rights

Depending on where you live (such as California, the EU, or the UK), you may have specific legal rights regarding your personal data, including the right to:

 

• Access the personal information we hold about you.

• Correct inaccurate or incomplete data.

• Delete your personal information.

• Port your data to another service in a common, machine-readable format.

• Restrict or object to certain processing.

• Withdraw consent you previously gave (this won't affect processing done before you withdrew).

• Opt out of "sale" or "sharing" of personal information (we don't do either, but you have the right regardless).

• Not be discriminated against for exercising any of these rights.

• File a complaint with your local data protection authority (such as your EU member state's supervisory authority, the UK ICO, or the California Privacy Protection Agency).

 

Because BoothFlo is a B2B platform, most data is controlled by your organization's Tenant Admin. If you are a standard user, please start by contacting your Admin. However, if you need to exercise any of these rights directly with us, email privacy@boothflo.com, and we will respond within the timeframe required by applicable law (typically 30 – 45 days).

 

Authorized agents: If you are a California resident, you may designate an authorized agent to make requests on your behalf. We may ask you to verify your identity and confirm that you authorized the agent.

 

EU / UK representative: We do not currently have an appointed Article 27 representative in the EU or UK. As our customer base expands into those regions, we will appoint one and update this policy accordingly. In the meantime, EU and UK users can contact us directly at the email above.

9. Minors

BoothFlo's Services are intended for business use by individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a minor, we will delete it as quickly as possible. If you believe a minor has provided us with personal information, please email us.

10. Do-Not-Track Signals

Some browsers offer a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal. Because there is no consistent industry standard for responding to DNT signals, we do not currently change our behavior based on them. However, we already do not track you across other websites or sell your data. If we introduce optional analytics in the future, we will honor GPC signals where required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time as our app evolves or laws change. If we make significant, material changes, we will notify you via email at least 14 days before the changes take effect. For minor edits (like fixing a typo or clarifying wording), we will update the version number and "last updated" date at the top of this page.

12. Contact Us

If you have any questions, concerns, or feedback about this Privacy Policy or how we handle your data, please reach out:

​

📧 Email: hello@boothflo.com

🏢 Company: BoothFlo LLC

📍 Location: Merritt Island, Florida