1. Who is responsible
THE PRINT COMPANY BAGSHOT LTD, company number 16904402, trading as Afterbooth, is the controller for account, billing, security, support and website information. Our registered office is 32 High Street, Bagshot, United Kingdom, GU19 5AZ. Contact info@afterbooth.co.uk for privacy enquiries.
For event photographs, recordings and guest details, the photobooth operator or customer normally decides why and how that content is used and is the controller. AfterBooth normally acts as its processor. Guests should contact that operator first where possible. Our Data Processing Terms explain this relationship.
2. Information we handle
- Account details such as name, email, authentication records and preferences.
- Subscription, invoice and transaction status. Stripe receives payment-card details; AfterBooth does not store full card numbers.
- Event originals, processed photographs, booth strips, cover images, audio, watermarks, crop settings and exports.
- Private gallery configuration and activity, including views and downloads. Activity totals are operational records and do not identify a guest by name unless other information supplied by the customer does so.
- Google account label and encrypted access tokens when Drive delivery is connected.
- Technical and security data such as IP address, browser/device details, timestamps, diagnostic identifiers and service logs.
- Messages and other information supplied when you contact us.
3. Purposes and lawful bases
- Contract: create accounts, process events, provide galleries and exports, manage subscriptions and answer service requests.
- Legitimate interests: secure and improve the service, diagnose faults, prevent misuse, maintain records and understand aggregate service performance.
- Legal obligation: retain required tax and accounting records, respond to lawful requests and protect legal rights.
- Consent: where consent is the appropriate basis, including any future optional marketing or non-essential tracking. Consent can be withdrawn.
When we process event content for a customer, we do so on that customer's documented instructions under our contract.
4. Who receives information
We use vetted providers needed to run AfterBooth: Supabase for authentication, database and private object storage; Railway for web hosting and image processing; Stripe for billing; Resend for transactional email; and Google when a customer requests Drive delivery. We may also disclose information to professional advisers, regulators, courts or law enforcement where lawful and necessary, or to a buyer during a genuine business transfer subject to appropriate safeguards. We do not sell personal information.
5. International transfers
Some providers may process information outside the UK. Where UK data-protection law requires it, we rely on an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, together with appropriate technical and organisational measures.
6. Retention
- Event originals, outputs, gallery files and recordings are scheduled for physical deletion seven days after upload.
- Google Drive tokens are kept until the connection is removed, the account is closed or they are no longer required.
- Account records are generally kept while the account remains open and for a reasonable period afterwards.
- Billing and tax records may be retained for the period required by law; security, support and dispute records are kept only as long as reasonably needed for their purpose.
- Short-lived backups and provider logs may persist for a limited period after deletion before rotating out.
7. Security
We use encrypted connections, private storage, signed and expiring media permissions, access controls, restricted server credentials, isolated processing workers and automatic deletion controls. Gallery links contain a secret access key and can also use a six-digit PIN. No online system is completely risk-free, so customers should use a unique password and protect links, PINs, email accounts and devices.
8. Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to processing, and to receive portable data. You may withdraw consent where we rely on it and complain to the Information Commissioner's Office. Email us to exercise a right; we may need to verify your identity and normally respond within one month. If the request concerns event content, we may refer it to the photobooth operator who controls that event.
9. Children
AfterBooth accounts are for adults. Event content may include children where the customer has an appropriate lawful basis and safeguards. Customers must not use AfterBooth to exploit children, infer sensitive traits or perform facial identification. AfterBooth does not provide facial-recognition or person-identification features.
10. Automated processing
The service applies customer-selected crop and watermark settings to event files. This does not make decisions with legal or similarly significant effects about people. Customers can review outputs before delivery.
11. Complaints and updates
Please contact us first so we can help. You may also complain to the UK Information Commissioner's Office through ico.org.uk. We will update the date above when this notice changes and provide reasonable notice of material changes.