Data and Privacy

Last updated: October 20, 2026

---

1. Introduction

BoothRev ("we", "our", or "us") is a lead capture and follow-up platform for revenue teams at live events. This Privacy Policy explains how we collect, use, store, and protect information when you use our mobile application and web platform (collectively, the "Service").

By using BoothRev, you agree to the collection and use of information in accordance with this policy.

This policy is governed by the General Data Protection Regulation (GDPR) (EU 2016/679) and the Dutch Uitvoeringswet Algemene Verordening Gegevensbescherming (UAVG). Where we refer to legal bases for processing, these correspond to Article 6 of the GDPR.

---

2. Who we are (data controller)

BoothRev is owned and operated by UserINNOV, established in the Netherlands. UserINNOV acts as the data controller for account and platform data.

For personal data that your organisation captures about third-party contacts (leads), your organisation is the data controller and UserINNOV acts as the data processor on your behalf, in accordance with Article 28 GDPR.

If you have any questions about this policy, please contact us:

• Privacy enquiries: privacy@boothrev.com
• Data handling & requests (access, deletion, portability): data@boothrev.com
• General enquiries: general@boothrev.com

---

3. Information we collect

3.1 Account information

When your organisation's administrator creates an account for you, we collect:

• Your work email address (used as your login identifier)
• Your name
• Your role within your organisation

We use passwordless one-time passcode (OTP) authentication — we do not store passwords. Access is granted via a time-limited 6-digit code sent to your email address, valid for 10 minutes.

3.2 Lead contact data you enter

As part of using the Service, you capture contact information about people you meet at events. This data is entered by you or your team and may include:

• Full name, first name, last name
• Work email address
• Phone number
• Job title and company name
• Notes and voice transcripts from conversations
• Business card images (processed on-device using on-device OCR; raw images are not transmitted to our servers)

This data is entered by you on behalf of your organisation. Your organisation (the "tenant") is the data controller for this information under GDPR. BoothRev processes it on your organisation's behalf as a data processor (Article 28 GDPR). A Data Processing Agreement (DPA) is available on request at data@boothrev.com.

3.3 Usage and device data

We collect limited technical information to operate and improve the Service:

• Device type, operating system, and app version
• App crash reports and error logs (via our error monitoring provider, if enabled)
• Product usage data — the features and pages you use, and how often — collected via our product analytics provider, and linked to your account so we can understand how teams actually use BoothRev

We do not use this data for advertising, and we do not sell it to third parties.

3.4 Audio recordings

The mobile app offers an optional voice note feature. When you use it:

• Audio is recorded locally on your device immediately
• When you have an internet connection, the recording is transmitted to our speech-to-text provider (based in the United States) solely for transcription
• The transcribed text is stored on our servers; the audio file is not retained on our servers after transcription
• You can review and delete voice notes at any time

---

4. Legal bases for processing (GDPR Article 6)

We do not use your data for advertising, profiling for marketing purposes, or sell it to any third party.

When we rely on legitimate interests (Art. 6(1)(f)), we have assessed that our interests do not override your rights and freedoms as a data subject, given the strictly B2B nature of the Service and the limited personal data involved.

---

5. AI processing (Rev)

BoothRev uses a third-party large language model provider to generate lead summaries, priority scores, follow-up email drafts, and qualification insights ("Rev"). This processing:

• Uses only data you have already entered (notes, transcripts, contact fields)
• Does not infer or generate information you have not provided
• Never overwrites contact details that you have explicitly confirmed
• Outputs are always presented for your review before any action is taken

We have implemented appropriate measures with this provider under Article 28 GDPR. A copy of their data processing terms is available on request at data@boothrev.com.

---

6. Data sharing and sub-processors

We share data only as necessary to operate the Service. The following categories of sub-processors act on our behalf under Article 28 GDPR:

All sub-processors are bound by data processing agreements and process data only for the purposes listed above. A list naming each specific sub-processor is available on request at data@boothrev.com.

For transfers to providers outside the EEA (United States), we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission under Article 46(2)(c) GDPR, supplemented by a Transfer Impact Assessment where required.

We do not share your data with:

• Advertisers or marketing platforms
• Data brokers
• Any third party for their own commercial purposes

We may disclose data if required to do so by EU law, Dutch law, a court order, or a competent supervisory authority.

---

7. Data retention

Retention for account and lead data depends on how your relationship with BoothRev ends:

• Unused Pilot event: if a Pilot event isn't upgraded to a paid plan, it is archived 14 days after the event ends. You can restore it by starting a paid plan within 6 months of archiving; after that, it is permanently deleted.
• Cancelled Solo or Pro subscription: your account becomes read-only when cancellation takes effect at the end of the billing period. If you don't resubscribe, your events are archived 90 days after cancellation. You can restore them by resubscribing within 12 months of cancellation; after that, they are permanently deleted.
• Single-event plan: access lasts 30 days from purchase. Your account becomes read-only 90 days after the term ends, and your events are then archived. You can restore them within 12 months of the term ending; after that, they are permanently deleted.

You or your administrator can request deletion of specific data at any time by contacting data@boothrev.com. We will process deletion requests within 30 days unless a legal retention obligation applies.

---

8. Data security

We implement appropriate technical and organisational measures (TOMs) in accordance with Article 32 GDPR:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted by our hosting providers (AES-256)
• Authentication uses short-lived, single-use one-time passcodes — no passwords stored
• Access is restricted by role (Rep, Event Owner, Admin, Super Admin)
• Tenant data is strictly isolated — no cross-tenant data access is possible
• We conduct regular reviews of our security practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens (AP) within 72 hours of becoming aware, in accordance with Article 33 GDPR, and will notify affected individuals where required under Article 34 GDPR.

If you believe you have discovered a security vulnerability, please report it to privacy@boothrev.com.

---

9. Your rights under GDPR

As a data subject under the GDPR, you have the following rights, which you can exercise free of charge by contacting data@boothrev.com:

We will respond within one month of receiving your request. We may extend this by two further months for complex or numerous requests, and will notify you accordingly. We may ask you to verify your identity before processing the request.

Complaints

If you believe we have not handled your personal data in accordance with this policy or applicable law, you have the right to lodge a complaint with the Dutch data protection authority:

Autoriteit Persoonsgegevens (AP)
Website: autoriteitpersoonsgegevens.nl
Phone: +31 (0)70 888 85 00

---

10. Children's privacy

BoothRev is a business-to-business (B2B) product intended solely for use by adults in a professional capacity. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact privacy@boothrev.com and we will delete it promptly in accordance with Article 8 GDPR.

---

11. International data transfers

UserINNOV is established in the Netherlands (EEA). Some of our sub-processors are located in the United States. All such transfers are subject to appropriate safeguards under Chapter V GDPR, specifically:

• Standard Contractual Clauses (SCCs) — European Commission Implementing Decision (EU) 2021/914
• Where required, a Transfer Impact Assessment (TIA) has been conducted to assess the legal framework and supplementary measures in the recipient country

A list of our sub-processors and the safeguards applicable to each transfer is available on request at data@boothrev.com.

---

12. Cookies and tracking

The BoothRev web app uses session cookies to maintain your authenticated session. These are strictly necessary cookies and do not require consent under Article 5(3) of the ePrivacy Directive as implemented in the Netherlands (Telecommunicatiewet, art. 11.7a).

The web app also uses our product analytics provider to understand how the Service is used. This provider sets cookies and uses browser storage to recognise you across sessions and is linked to your account (see Section 6, Data sharing and sub-processors, and Section 3.3, Usage and device data). This is not third-party advertising, cross-site tracking, or profiling for marketing purposes — it is used solely to improve the Service, on the legal basis described in Section 4.

The mobile app does not use cookies, but uses the same product analytics linked to your account via the provider's mobile SDK. Session tokens are stored securely in the device's encrypted secure storage (iOS Keychain / Android Keystore).

We do not use:

• Third-party advertising cookies or pixels
• Cross-site tracking
• Analytics that identify you for marketing or advertising purposes

---

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify administrators by email at least 30 days before the changes take effect, and update the "Last updated" date at the top of this page. For material changes that affect your rights, we will seek fresh consent where legally required. Continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

---

14. Governing law

This Privacy Policy is governed by the laws of the Netherlands and the directly applicable GDPR (EU 2016/679). Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the competent courts of the Netherlands.

---

15. Contact us

UserINNOV
The Netherlands
boothrev.com