Privacy Policy
Effective October 27, 2026 · North Cipher Valley Inc.
Boothrun keeps as little as it can: attendee names and ticket IDs to run an event's booth passport, deleted soon after the event. This policy explains exactly what we collect, why, who can see it, and your rights.
1. Who we are
Boothrun is a booth passport for tech events, available at boothrun.com. It is operated by North Cipher Valley Inc. ("we", "us"), which is responsible for the personal information described in this policy.
Questions or requests about your personal information: privacy@boothrun.com. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
2. Organizers and Boothrun
Event organizers choose to use Boothrun for their event and give us access to their attendee list on their ticketing platform (for example, by adding a Boothrun account to their event team). For attendee information, the organizer decides why it is collected; we process it to run the booth passport for that event, and we only use it for that event.
For staff accounts (organizers, booth staff, the swag desk) and for visitors to boothrun.com, we decide how information is used, as described below.
3. What we collect
From the event’s ticketing platform (Bevy today; Eventbrite and Luma are planned), for each registered attendee:
- first and last name, attendee or ticket ID, and ticket type;
- the list we receive may also include email addresses and check-in status. We do not store emails or check-in status, and we never show emails to booth staff or sponsors.
While the event runs:
- booth visits: which booth scanned a ticket, when, and which staff account scanned it;
- swag claims, raffle entries and raffle draws (including winners);
- a log of every scan attempt (including rejected ones) for troubleshooting and statistics.
For staff who sign in:
- your email address, name and profile picture from Google when you choose “Continue with Google”, or your email address when you use an email sign-in link;
- the role and booth an organizer assigned to you, and the email the organizer used to add you.
When you visit boothrun.com:
- a ticket code you type or scan on the passport page, used only to look up that ticket’s progress;
- standard technical logs kept by our hosting provider (such as IP address, browser type and the pages requested), used for security and reliability.
We do not use advertising, tracking pixels or third-party analytics, and we do not sell personal information.
4. How we use it
- to record booth visits and show attendees their progress;
- to work out who has earned the event’s rewards, hand out swag once, and run fair, recorded raffle draws;
- to give organizers their event’s progress and give booths visit counts;
- to sign staff in, decide what each person may see and do, and keep the service secure;
- to answer questions and requests you send us.
We do not use event data to build profiles, for marketing, or across events.
5. Who can see what
- Attendees: anyone with your ticket code can see your first name and your booth progress on the passport page. Treat your ticket code like your ticket.
- Booth staff: when they scan your ticket, your first and last name and your progress.
- The swag desk: your name, progress, the booths you still need to visit, and whether you collected swag.
- Organizers of the event: all of the above for their event, including raffle results and exports of their event’s progress.
- Sponsors: visit counts for their booth. We do not give sponsors attendee lists or contact details.
6. Service providers and where data is stored
We use these providers to run Boothrun. They process information only on our instructions:
- Supabase: database and sign-in. Our databases are hosted in Canada (Central).
- Vercel: website hosting and delivery. It may process requests in the United States and other countries.
- Google: sign-in with your Google account.
- The event’s ticketing platform (Bevy, and later Eventbrite or Luma): the source of the attendee list.
Because some providers operate outside Canada, information may be processed in other countries, where it may be accessible to authorities under local law. We may also disclose information when required by law.
7. Information from Google
When you continue with Google, we request only your basic profile: name, email address and profile picture. We use it only to sign you in and show who is signed in. We do not use it for advertising, do not sell it, and do not let people read it except to support you, keep the service secure, or comply with the law.
Boothrun’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8. Cookies and browser storage
Boothrun does not set advertising or tracking cookies. When staff sign in, we keep a sign-in token in your browser’s local storage so you stay signed in; signing out removes it. The sign-in process briefly stores a security code in your browser, which is removed once sign-in finishes.
9. How long we keep it
- Attendee information, booth visits, swag claims, raffle records, scan logs and staff assignments for an event are deleted within 30 days after the event ends. Organizers can export their event’s progress before then.
- Staff sign-in accounts are deleted when you ask, or after 12 months without use.
- Hosting logs are kept by our providers for a short period under their own retention settings.
- Deleted information can remain in encrypted backups until those backups expire on their regular schedule.
10. How we protect it
All traffic uses encrypted connections (HTTPS), and connections to our database must be encrypted. Access is limited by role: booth staff only see their own booth, the swag desk only its event, and organizers only what they run. Our database is not reachable from the public internet except through our own service. We keep the information we store to a minimum.
If a breach of security safeguards creates a real risk of significant harm, we will notify the people affected and report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
11. Your choices and rights
You can ask to access the personal information we hold about you, correct it, or delete it, and you can withdraw consent (for example, by not scanning your ticket at booths). Email privacy@boothrun.com. We reply within 30 days and may need to confirm who you are. If you are an attendee, you can also contact the event organizer.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
12. Children
Boothrun is not directed at children under 13. Event organizers are responsible for the age requirements of their events. If you believe a child’s information was added without the right consent, contact us and we will delete it.
13. Changes to this policy
We will update this page and the effective date when our practices change. For significant changes, we will give notice on boothrun.com before they take effect.
Questions: privacy@boothrun.com