Privacy Policy

Effective date: September 26, 2026

Last updated: September 26, 2026

1. Who we are

This Privacy Policy explains how the individuals currently operating the Boothmap project (the "Boothmap team," "Boothmap," "we," "us," or "our") collect, use, disclose, and protect personal information when you use our website, software, and related services during this pre-incorporation period.

Boothmap is not yet incorporated. There is no company named "Boothmap Inc." (or similar) acting as the current operator. We intend to form a company under the laws of British Columbia, Canada. When that company is formed, we may transfer or assign operation of the Service and related personal-information handling to that company, and we will update this Policy (and provide notice where required).

• Website: https://boothmap.io
• Privacy contact: privacy@boothmap.io
• Legal contact: legal@boothmap.io

Until we incorporate and publish a registered office mailing address, please send privacy requests to privacy@boothmap.io. Privacy matters are handled by the Boothmap team.

If the operator identity, corporate name, or registered address changes (including on incorporation), we will update this Policy.

2. Scope

This Policy applies to personal information we collect through:

1. Our website at boothmap.io and related pages;
2. The Boothmap SaaS application (accounts for event organisers and authorized users);
3. Interactive floor-plan embeds served via our CDN (for example, snippets from cdn.boothmap.io) on organiser websites;
4. Checkout and payment flows we facilitate for booth sales on behalf of organisers (typically via Stripe); and
5. Support, email, and other communications with us.

Important roles. Boothmap provides software and payment rails. Event organisers use Boothmap to design floor plans, price booths, embed maps, and sell booths. When an organiser collects or uploads vendor or attendee information, or sells a booth, the organiser is generally the organization that decides why that information is collected. In those cases we act as a service provider / processor for the organiser. This Policy describes our own practices as Boothmap; organisers may have their own privacy notices for vendors and buyers.

This Policy is written primarily for Canadian privacy expectations (including principles under PIPEDA and British Columbia's PIPA, as applicable) and is intended to be usable for visitors and customers in the United States. A short note on other laws appears in Section 15.

Closed beta. If you participate in Boothmap's invite-only closed beta or early access, your personal information is handled under this Policy.

3. Personal information we collect

"Personal information" means information about an identifiable individual. The categories we may collect depend on how you interact with Boothmap.

3.1 Account and profile information (organisers and authorized users)

• Name, email address, password or authentication credentials
• Organization / company name, role, and contact details
• Account preferences and settings

3.2 Billing and commercial contact information

• Billing name, email, and address
• Tax or business identifiers you choose to provide
• Records of subscriptions, invoices, and fee arrangements

Payment cards. Booth checkout and related payments are processed by Stripe. Boothmap does not receive or store full payment card details — including full primary account numbers (PAN), CVV/CVC, or full card numbers. Card data is collected and handled by Stripe only, according to Stripe's terms and privacy notice. We may receive limited payment metadata from Stripe (for example, payment or charge identifiers, last-four digits where Stripe provides them, status, and amount) as needed to operate the Service and calculate platform fees.

3.3 Event, map, and booth metadata

• Event names, dates, venues, and related descriptions
• Floor plans, booth layouts, pricing, availability, and map configuration
• Content you upload or create in the product (logos, images, text labels)

This content may include personal information if you choose to include it (for example, a vendor contact name on a booth).

3.4 Vendor / buyer information in checkout flows (minimized)

When a vendor or booth purchaser ("buyer") purchases a booth through a Boothmap-facilitated checkout for an organiser's event, checkout typically runs through the organiser's Stripe account. Buyer contact details (name, email, phone) are typically collected by Stripe and/or the organiser, not stored as a full buyer dossier in Boothmap systems.

What Boothmap prefers to retain is thin transactional metadata needed to calculate, invoice, and audit our platform fee and to run the Service, such as:

• Transaction / order identifiers
• Organiser, event, and booth identifiers
• Amount, currency, and timestamp
• Fee rate and fee amount (when a platform fee applies)
• Stripe payment, charge, or transfer identifiers (and similar payment-status metadata)

We do not aim to retain buyer name, email, or phone in Boothmap systems when checkout is via the organiser's Stripe account, unless a specific product feature requires it — and if so, only as long as needed for that feature.

The organiser is the merchant of record for the booth sale. Boothmap is not the seller of the booth. How the organiser uses buyer information after checkout is governed by the organiser's practices and any agreement between the organiser and the buyer. See also Section 6.2 and our Terms of Service.

3.5 Usage, device, and log data

• IP address, browser type, device type, operating system
• Pages and features used, approximate timestamps, referrer URLs
• Error logs and diagnostic information
• Embed load and interaction metrics for maps hosted or served by us

3.6 Cookies and similar technologies

We and our service providers may use cookies, local storage, pixels, or similar technologies on our site and embeds. See Section 12.

3.7 Support and communications

• Messages you send to support or legal/privacy contacts
• Call or meeting notes if you contact us by phone or video
• Feedback and survey responses

3.8 Information we do not intentionally collect

We do not intentionally collect sensitive personal information (such as government ID numbers, health information, or precise geolocation of individuals) unless you voluntarily provide it and we have a clear need. Please do not upload such information into maps or support tickets unless necessary.

4. How we use personal information (purposes)

We use personal information to:

1. Provide the Service — create and manage accounts; host and display floor plans and embeds; enable booth listing and checkout flows; operate CDN delivery of map snippets;
2. Process payments and fees — facilitate Stripe Connect-style payments to organisers; calculate, invoice, and audit Boothmap platform fees using transactional metadata (not full card details); prevent fraud and abuse;
3. Communicate — send transactional messages (account, security, billing, product notices); respond to support requests;
4. Improve and secure — monitor performance, debug, analyze aggregate usage, maintain security, and develop features;
5. Comply with law — meet legal, tax, accounting, and regulatory obligations; respond to lawful requests;
6. Marketing (with appropriate consent) — where permitted, send product updates or marketing about Boothmap. Canadian commercial electronic messages are sent in line with CASL (consent and unsubscribe). You can withdraw marketing consent at any time without affecting essential service messages.

We do not use personal information for purposes that are incompatible with those above without additional notice or consent where required.

5. Consent and withdrawing consent

We collect, use, and disclose personal information with consent where required, or as otherwise permitted by applicable law (for example, where needed to provide a service you requested, or to meet a legal obligation).

Consent may be express (for example, checking a box or submitting a form) or implied where it is reasonable in the circumstances (for example, providing an email address to receive a password reset).

Withdrawing consent. You may withdraw consent to certain uses (such as marketing) by:

• Using unsubscribe links in marketing emails;
• Updating account preferences where available; or
• Contacting privacy@boothmap.io

Withdrawal does not affect processing that is required to operate your account, complete a transaction, or meet legal obligations. If you withdraw consent needed to provide the Service, we may need to close or limit your account.

6. How we share personal information

We do not sell personal information for money. See Section 11 regarding California "sale" / "share" concepts and advertising.

We may disclose personal information to:

6.1 Service providers / processors

Companies that help us host, operate, secure, communicate, and improve Boothmap, under contractual obligations to use the information only for providing services to us. Categories include:

6.2 Organisers (for their events)

When you buy a booth or interact with an organiser's map/checkout, order and contact information collected in that flow is generally available to that organiser (via Stripe and/or the organiser's own systems), who is the seller and merchant of record. Boothmap minimizes buyer personal information it retains (see Section 3.4) and is not a party to the booth sale contract between organiser and buyer.

6.3 Legal and safety

We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Boothmap, our users, or the public.

6.4 Business transfers and incorporation

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and notice where required. This includes assignment or novation to a British Columbia company formed to operate Boothmap after incorporation, with notice where required.

6.5 With your direction

We may share information when you ask us to (for example, integrating with a tool you choose).

Organiser-uploaded lists. If an organiser uploads or imports vendor lists or other personal information into Boothmap, the organiser is responsible for having a lawful basis to do so. We process that information to provide the Service to the organiser and do not use it for our own unrelated marketing.

7. Cross-border storage and processing

Personal information may be stored or processed in Canada and/or the United States, and in other countries where our service providers operate (including Stripe, as described in Stripe's documentation).

When personal information is transferred outside the province or country where you reside, it may be subject to the laws of those other jurisdictions, including lawful access by foreign courts, law enforcement, and national security authorities.

We use contractual and organizational measures appropriate to the sensitivity of the information when engaging processors that handle personal information across borders. We will update this Policy with more specific primary storage regions as our infrastructure is finalized.

8. Retention

We retain personal information only as long as needed for the purposes described in this Policy, including to:

• Provide the Service and maintain accounts;
• Meet legal, tax, and accounting requirements;
• Resolve disputes and enforce agreements; and
• Maintain security and prevent fraud.

Typical retention approach (subject to legal requirements):

• Account and organiser billing data: for the life of the account, then up to about 7 years afterward for backup, dispute, tax, and legal purposes
• Fee / transaction metadata (transaction ids, organiser/event/booth ids, amounts, currency, timestamps, fee rate/amount, Stripe payment/charge ids — not full buyer contact dossiers): up to about 7 years, consistent with financial and tax recordkeeping needs
• Buyer name / email / phone: typically not retained by Boothmap when checkout is via the organiser's Stripe account; if a feature requires temporary retention, only as long as needed for that feature, then deleted or de-identified
• Logs and analytics: routinely about 90 days, and up to about 12 months when needed for security investigations
• Support tickets: typically up to about 2 years after ticket closure, or longer if tied to an unresolved dispute

When retention is no longer required, we delete or de-identify personal information in a manner appropriate to the systems involved, subject to residual copies in backups that are overwritten on schedule.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction. Measures may include access controls, encryption in transit, least-privilege practices, and monitoring.

No method of transmission or storage is completely secure. You are responsible for keeping account credentials confidential and for using strong authentication where available.

10. Breach notification

If we experience a privacy or security incident involving personal information, we will assess the risk of harm and notify affected individuals and regulators as required by applicable law (including, where applicable, Canadian requirements regarding breaches that create a real risk of significant harm, and any applicable U.S. state notice laws).

11. Your rights

11.1 Canadian rights (access, correction, and related)

Subject to applicable law (including PIPEDA and, where applicable, B.C. PIPA), you may request to:

• Access personal information we hold about you;
• Correct inaccurate or incomplete personal information;
• Withdraw consent for certain optional uses (see Section 5);
• Ask questions about our privacy practices.

We may need to verify your identity and may refuse or limit a request where permitted by law (for example, privilege, or information that would reveal another person's personal information). Organisers who control vendor data should generally handle access requests from their vendors; we will reasonably assist organisers where we process that data for them.

To exercise rights: email privacy@boothmap.io.

11.2 California and other U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law (such as under the CCPA/CPRA framework), you may have additional rights, which can include:

• Right to know / access categories and specific pieces of personal information;
• Right to delete;
• Right to correct;
• Right to opt out of "sale" or "sharing" of personal information (as those terms are defined under California law, including for certain cross-context behavioral advertising);
• Right to limit use of sensitive personal information (if applicable);
• Right to non-discrimination for exercising privacy rights.

Sale / share stance. We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising as those activities are commonly understood, based on our current practices (we do not use advertising pixels).

If we later add advertising or analytics technologies that constitute a "sale" or "share" under California law, we will update this Policy and provide a required opt-out mechanism (for example, a "Do Not Sell or Share My Personal Information" link or equivalent).

If Boothmap becomes a "business" under CCPA/CPRA or similar state laws in a way that requires additional disclosures, we will update this Policy with the required details (such as categories collected, sources, purposes, and response timelines).

11.3 Complaints

You may contact us first at privacy@boothmap.io. You may also have the right to complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or another applicable regulator.

12. Cookies and tracking

We use cookies and similar technologies in layers:

1. Essential — required for security, authentication, load balancing, and core Service features (including reliable delivery of embeds). These do not require optional consent in the same way as non-essential cookies.
2. Preferences / functional — remember settings.
3. Analytics — we do not currently use third-party analytics cookies or tools. We will update this Policy if that changes.
4. Advertising — we do not currently use advertising cookies or pixels. We will update this Policy if that changes.

Where non-essential cookies require meaningful consent under applicable law, we will obtain it before setting them. Practices will follow the laws that apply to the audiences we target.

You can control cookies through browser settings. Blocking essential cookies may break login, checkout, or embeds.

Embeds on organiser sites. When an organiser embeds a Boothmap map on their website, our CDN/scripts may set or read technologies needed to render the map and record basic technical logs. The organiser's site may have additional tracking that is outside our control.

13. Children

Boothmap is a business-oriented service for event organisers and booth sales. It is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where that higher age is required by applicable law).

If you believe we have collected personal information from a child, contact privacy@boothmap.io and we will take appropriate steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date. If changes are material, we will provide additional notice as required by law (for example, email to account holders or an in-product notice). Continued use of the Service after the effective date of changes constitutes acceptance where permitted by law.

15. Other laws (short note)

This Policy is Canada-first and U.S.-ready. If Boothmap later targets individuals in the European Economic Area, United Kingdom, or other regions with GDPR-style rules, we will provide additional notices, lawful bases, and transfer mechanisms as required and update this Policy accordingly.

16. Contact us

For privacy questions, access or correction requests, or complaints:

• Privacy: privacy@boothmap.io
• Legal: legal@boothmap.io
• Website: https://boothmap.io

Until incorporation, email is the primary contact channel. A British Columbia registered office mailing address will be listed here after incorporation.

Boothmap — boothmap.io