Privacy Policy

1. Who we are

The dashboard is run by VOUW B.V., trading as Poem Booth, Krugerplein 4-1, 1091 KX Amsterdam, the Netherlands. Chamber of Commerce (KvK) 80932932, VAT NL861856703B01. We are the controller of the personal data described here.

Questions, requests and complaints: contact@poembooth.com.

2. What the dashboard is

The dashboard is the work tool behind Poem Booth: our team, hub managers and drivers use it to manage bookings of Poem Booth photo booths for events, plan the delivery, support and pickup of the booths, and run the booths themselves. It is used by people who have an account; it is not a consumer app.

3. Personal data we process in the dashboard

• Account data of staff, hub managers and drivers: name, e-mail address, phone number, role and hub.
• Booking data: the customer's company and contact persons (name, e-mail, phone), event name, dates and address, and invoicing details.
• Planning data: which driver does which part of a job, the driver agreement and when it was accepted.
• Photos and texts made at events by the booths, processed to create the portraits and poems guests ask for. Guests are informed about this at the booth and on the page where they download their portrait.

We use this data only to run bookings, plan the work and deliver the service, to invoice, and to meet legal obligations. The legal bases are the performance of a contract, our legitimate interest in running the service, and legal obligations (such as keeping invoices).

4. Google user data (Google Calendar)

A hub manager or super admin can connect a Google account to the dashboard so that the hub's planning appears in a Google Calendar and drivers are invited to their rides. This is optional; nothing is connected unless that person signs in with Google and gives permission.

What we access, with the permission the user gives on Google's consent screen:

• The e-mail address of the connected Google account (scopes openid and email), to show which account is connected.
• Google Calendar (scope https://www.googleapis.com/auth/calendar), used only to: list the calendars the account can write to, so the user can pick one; create a new calendar when the user asks for it; share the chosen calendar read-only with the hub managers and administrators of that hub; create, update and delete the planning events in the chosen calendar, with the driver of a ride as guest; and read the events in the chosen calendar to see whether a planning event was changed or deleted in Google (the dashboard then puts it back) and how the driver answered the invitation.

We do not read, store or use other calendars of the account, and events in the chosen calendar that the dashboard did not create are ignored and not stored.

How we use it: only to keep the hub's planning calendar up to date and to show in the dashboard whether a driver accepted the invitation. The events contain the job (event name, place, times and schedule), the name of the driver and links to the job in the dashboard.

What we store: the connected Google e-mail address; the id and name of the chosen calendar; an OAuth refresh token, encrypted with AES-256-GCM before it is stored; and per planning event its Google event id, the guest's e-mail address and their answer (accepted, declined, maybe or no answer yet).

Sharing: we do not sell Google user data and do not share it with anyone, except: the chosen calendar is shared read-only, by the user's own choice, with the hub managers and administrators of that hub; drivers receive the invitation for their own rides from Google; and our processors store and run the dashboard (see section 6). We do not use Google user data for advertising, do not transfer it to data brokers or information resellers, do not use it to determine credit-worthiness or for lending, and do not use it to develop, improve or train artificial intelligence or machine learning models.

Limited Use: Poem Booth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Retention and deletion: we keep this data for as long as the hub is connected. When the user clicks "Disconnect" in the dashboard, we revoke the token at Google and delete the token, the account e-mail and the stored event data straight away. The events already in the user's Google Calendar stay there, as they are in the user's own account; the user can delete them or the calendar in Google. Access can also be revoked at any time at https://myaccount.google.com/permissions; the dashboard then stops updating the calendar. To have the stored data deleted without using the dashboard, e-mail contact@poembooth.com.

5. How we protect data

All traffic to the dashboard is encrypted (HTTPS). Access is limited by role: drivers see only their own rides, hub managers only their hub. The database enforces these rules itself (row level security). Google tokens are encrypted with a key that is kept separately from the database and are only used by the server; they are never sent to a browser.

6. Processors and where data is kept

• Supabase: database and file storage, in the European Union (Frankfurt, Germany).
• Vercel: hosting of the dashboard; requests may be processed in the United States.
• Google: Google Calendar, when a hub connects it.
• Resend: sending e-mail from the dashboard.
• AI providers that turn guest photos into portraits and poems, only for that purpose.

We have agreements with our processors. When data is processed outside the European Economic Area, this is based on the EU Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep account data while the account exists, booking and planning data for as long as needed to deliver and invoice the service, and invoices for the period the law requires (seven years in the Netherlands). Google user data: see section 4.

8. Your rights

You can ask us for access to, correction or deletion of your personal data, ask us to limit its use, object to it, or ask for a copy in a common format. E-mail contact@poembooth.com; we answer within a month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Changes

We update this policy when the dashboard changes how it uses personal data or Google user data, and change the date at the top. If we change how Google user data is used, we tell the connected users before the change applies.