Privacy Policy

Last updated: 14 August 2026

Logibooth is software for running 360° photobooth experiences. It is operated by Deucks Pty Ltd, an Australian company (“Logibooth”, “we”, “us”). Independent event operators run the booths. This policy explains what we collect, why, where it goes, and what choices you have. It applies worldwide — whether you run booths with our app, stood in front of one at an event, or just visited our website.

Our two roles

If you are an operator (you installed the app and run events), we decide how your account data is handled, so we are the data controller (in US state-law terms, the “business”) for it. This policy applies to your account directly.

If you are a guest (you used a booth at an event), the operator who ran the booth decides what is collected and why. They are the data controller for your clip and your contact details. We store and process that data on their instructions, as their processor (in US state-law terms, their “service provider”). The consent screen at the booth names both parties. For anything about why data was collected at a specific event, the operator is the right first contact — but you can always contact us too, and we will help or pass the request on.

What we collect

From operators

• Account details: name, email, profile photo, and sign-in identity (Google, Apple, or email and password).
• Business profile you choose to add: business name, description, website, social handles, service area, timezone.
• Onboarding answers (how often you run events, what you use the app for, your region) — used only to set up sensible defaults and understand our customers.
• Your projects and event settings, client details you enter, branding files, and music you upload.
• Subscription status via Apple's App Store or Google Play and RevenueCat. The only identifier we share with RevenueCat is a random account ID. We never see your card details.
• Paired device records: an app-generated random ID (not a hardware identifier), the device's name, battery level, and app version — so multi-device events work.
• Crash reports and basic diagnostics to keep the app reliable. We do not use behavioural analytics or advertising SDKs.

From guests, on the operator's instruction

• The 360° videos captured at the booth. These are recordings of you — treat them as personal data; some laws treat video of identifiable people as sensitive.
• Only if the operator turns on a request and you agree: your name and an email address or phone number, a social follow action, or a rating/review response. We record what you consented to, when, and which policy version you saw.
• A short-lived technical marker in your browser (localStorage) so you are not asked the same questions twice at one event. It contains no personal details and expires after 7 days.

Consent at the booth is never pre-ticked, and the request for your details does not run unless the operator has a privacy policy in place. We do not run facial recognition or any biometric identification on clips.

Automatically, from everyone

• Standard server logs when you use hosted pages (IP address, browser type, time). For abuse prevention we store only a truncated one-way hash of the IP, not the address itself.
• Our marketing website (logibooth.com) asks before using any cookies. If you tap Accept on the banner, we load Google Analytics, which sets cookies to count visits and, in future, measure our advertising; Google processes this data on our behalf (see Google's privacy policy). If you decline, nothing is loaded and nothing tracks you. Change your mind anytime via "Cookie settings" in the footer. Fonts are self-hosted either way.

Details you enter about other people

Operators can note a client's contact details on an event and collect guest details at the booth. When you enter someone else's details, you are responsible for having the right to do so — tell them, and point them to this policy. We process those details only to run your events, and we delete them with the event's retention setting or on request.

What we use it for, and our legal bases

• Providing the service — accounts, capture, processing, hosting, sharing, support (contract; for guests, the operator's instructions).
• Guest contact requests — your consent, collected at the booth. You can withdraw it at any time by contacting the operator or us.
• Payments and entitlements — contract and legal obligation.
• Reliability, security and abuse prevention — legitimate interests (crash reports, rate limiting, access controls).
• Legal compliance — responding to lawful requests and keeping records we are required to keep.

We do not use personal data for automated decisions with legal or similarly significant effects, and we do not use it to train AI models.

Sharing links are public by design

When a clip is shared, it gets a long, unguessable link (also shown as a QR code). Anyone who has that link can view and download the clip — that is what makes sharing at events instant. Links are not listed publicly or indexed by us, but a link, once shared, can be re-shared. If you want a clip taken down, ask the operator or use our data deletion page. A clip often shows more than one person — anyone who appears in a clip can ask for it to be removed, not just the person who recorded or shared it.

Who we share data with

We share personal data only with the providers below, only so the service works. We do not sell personal data, we do not share it for cross-context behavioural advertising, we do not use guest contact details for our own marketing, and we show no ads. Operators can export the guest details collected at their own events; once exported, the operator is responsible for that copy.

• Google Cloud / Firebase — database, sign-in, file storage, and our backend functions.
• Cloudflare — video storage and worldwide delivery.
• RevenueCat — subscription management (receives a random account ID only).
• Apple and Google — sign-in and app-store billing.
• A managed message queue — coordinates cloud video processing (receives clip and account identifiers, not contact details).
• Authorities — only where the law requires it, and we will tell you unless legally barred.
• Third-party sites you choose to open — social follow buttons open Instagram or TikTok, store badges open Apple or Google, and some support links pass through a link shortener. Their own privacy policies apply once you are there.

Where we store it, and international transfers

Our primary infrastructure runs in Australia (Google Cloud, Sydney region), and guest contact details are stored there. Video files are stored with Cloudflare in the region closest to the operator — Asia-Pacific, Europe, or North America — so guests download from a nearby server. Because operators and guests are worldwide, data may be processed outside your country. Where a transfer needs safeguards (for example from the EEA, UK, or Switzerland), we rely on our providers' standard contractual clauses and equivalent mechanisms. You can ask us for details of the safeguards that apply to you.

How long we keep it

• Guest contact details and feedback: 30 days after the event by default. Operators can choose up to 365 days per event, and can delete an event's guest data at any time. You can also ask us directly — see data deletion.
• Guest videos and event galleries: for as long as the event's retention setting and the operator's subscription allow. If a subscription lapses, hosted guest pages stop serving immediately and stored media is deleted after a 14-day grace period.
• Operator accounts: until you delete your account in the app (Profile → Legal → Delete account). Deletion removes your account, projects, media, and the guest data collected at your events, except records we must keep for legal reasons (for example billing records).
• Backups and logs expire on a rolling basis and are not used to resurrect deleted data.

Security

Data is encrypted in transit. Access to production systems is limited to people who need it. Clip links use long random identifiers rather than guessable numbers. No online service is perfectly secure, and if a breach ever affects your data we will notify you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask to see the personal data we hold about you, correct it, delete it, get a copy of it, or object to or restrict how it is used. Where processing is based on consent, you can withdraw consent at any time without affecting what happened before. We honour reasonable requests no matter where you live, we do not discriminate against you for exercising your rights, and we will respond within the time your local law sets (and in any case within 30 days for most requests).

• EEA, UK and Switzerland: the rights above come from the GDPR and UK GDPR. You can also complain to your local supervisory authority. For guest data, the operator is the controller — we will pass your request to them and help fulfil it.
• Australia: the Privacy Act 1988 and the Australian Privacy Principles apply. You can complain to us first, and then to the OAIC (oaic.gov.au).
• California and other US states: you have the rights to know, access, correct, delete, and opt out of “sale” or “sharing”. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not use sensitive personal information beyond providing the service, so there is nothing to opt out of. You may use an authorised agent. For guest data we act as the operator's service provider.
• Canada: PIPEDA applies; you may complain to the Office of the Privacy Commissioner.
• Brazil: the LGPD applies, including the rights above and complaint to the ANPD.
• Everywhere else: email us and we will apply the rights above as a baseline.

Extra disclosures for US state laws

In the last 12 months we collected these categories of personal information: identifiers and contact details (names, emails, phone numbers, account IDs); customer records and commercial information (subscription status, event and business settings); audio-visual information (booth clips); andlimited internet activity (server logs, crash reports). We collect them directly from you, from your device, and — for guest data — on the operator's instruction. We use them only for the purposes above, keep them for the periods above, and disclose them only to the service providers above. We have not sold or shared personal information in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

Because we do not sell or share personal information and do not track you across other sites, opt-out signals such as Global Privacy Control or Do Not Track have nothing to switch off — but we treat them as valid opt-out requests regardless. If we refuse a privacy request, we will explain why, and you can appeal by replying to our response; if you are unhappy with the outcome, you can contact your state attorney general or local privacy regulator.

To exercise any right, email [email protected] or use the data deletion page. We may need enough information to find your data (for example the event name and date and the contact detail you entered) and to check the request really comes from you.

Children

Logibooth accounts are for business use; you must be at least 18 to be an operator. The guest contact request is not intended for children under 16, and operators are responsible for making sure filming and any data collection at their events is appropriate and lawful for the audience present. If you believe a child's contact details were submitted, or you are a parent or guardian and want a child's clip removed, email us and we will delete it promptly.

Changes

We will update this page when our practices change and update the “last updated” date above. Material changes affecting guest data will also appear in the consent wording at the booth. If a change materially reduces your rights, we will give notice before it takes effect.

Contact

Privacy questions and requests: [email protected]. We aim to respond within a few business days. Deucks Pty Ltd, Australia, is the entity responsible for this policy.