Privacy Policy

Who we are

BoothSettle provides Vendor Statement Intelligence for Square. When you use the tool, your shop acts as the data controller for the vendor sales data you upload, and BoothSettle acts as the data processor that handles it on your instructions. See our Data Processing Agreement for details.

Data we collect

• Account data: your email address and a hashed password. Passwords are hashed with PBKDF2 and are never stored or readable in plain text. When you sign up we send a verification email and record whether your address has been confirmed.
• Upload summary: a processed summary of your most recent Square export (the figures needed to produce per-vendor statements). We keep only this summary and do not keep the raw CSV file.
• Anonymous usage events: to understand how the tool is used, we log a small set of product events (for example page views, sign-ups, uploads, and whether a detection rule matched). These events are tied only to a random session identifier and contain no names, email addresses, or personal information about your vendors.
• Minimal technical data: basic logs and security signals (such as timestamps and request metadata) needed to operate the service and prevent abuse.

How we use your data

We use your data only to run and improve the service: to create and authenticate your account, to verify your email address, to generate vendor statements from your upload, to measure how the tool is used through anonymous events, to keep the service secure, and to respond to your requests. We do not sell your data, we do not share it for cross-context behavioural advertising, and we do not use it for advertising.

Legal basis

Where GDPR applies, we process account data and upload summaries to perform our contract with you (Article 6(1)(b)) and rely on our legitimate interests (Article 6(1)(f)) for security, fraud prevention, and service reliability. Where CCPA and other US state privacy laws apply, we act as a service provider and do not "sell" or "share" your personal information as those terms are defined by law.

Data retention

We keep only the summary of your latest upload. Each new upload overwrites the previous one, so at any time the database holds a single processed summary per account. Account data is kept while your account is active. Anonymous usage events are not linked to your account and are retained only to measure and improve the service. When you delete your account, we remove your account data and upload summary, subject to short-lived backups and any records we must keep by law.

Sub-processors and hosting

We run on Cloudflare (Workers, Pages, and a D1 database hosted in the European Union), which stores your account data and your latest upload summary and acts as our sub-processor. We use Resend to send transactional email, such as address verification and account notifications; to do this, Resend processes your email address on our behalf. Both providers process data on our behalf under their own data protection commitments. Payments are not active today and we do not use a payment provider. If we add paid plans in the future, we will update this policy and our list of sub-processors before that happens.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can delete your account and its data from within the tool or by contacting us. US residents may also request that we disclose the categories of personal information we collect and may exercise their rights without discrimination. To make a request, email privacy@boothsettle.com.

Security

We use encryption in transit, hashed credentials, access controls, and minimal data retention to protect your information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Contact

Questions about this policy or your data? Email privacy@boothsettle.com or use our contact page.