Boft Privacy Notice
Version: 2026-10-28
Last updated: 28 October 2026
About this notice
This notice explains personal-data processing for the international Boft mobile app (the App). It distinguishes confirmed current practices from additional implementation requirements set out near the end. A future requirement is not a claim that the corresponding technical control is already operating in every released app version or connected service.
Who is responsible
SIA Boft, a Latvian limited liability company, registration number 40103957010, registered address Rīga, Matīsa iela 79, LV-1009, Latvia, is the controller for the App’s account, order-preparation and related service processing described here. Contact hello@boft.io or write to that address for privacy enquiries and requests.
Independent local operators sell physical prints. Payment takes place at a kiosk, not in the App. Operators and payment providers may control their own processing under separate notices. Contact hello@boft.io with the kiosk location if you need help identifying an operator. We remain responsible for our own processing.
Information we process
Accounts and sessions. The App supports email, Google and Apple sign-in. Email sign-in uses your email address; Google or Apple sign-in supplies the email address, name and avatar made available by that service. Sign-in sessions record the IP address and device or browser user-agent. A session is valid for seven days and is renewed when used. That validity window is not a deletion period for every related record.
Photographs. The backend receives photographs selected for a print order, not your entire media library. It stores one JPEG per photograph, with no separate server-generated preview. Associated information includes dimensions, capture date, capture coordinates (latitude and longitude) and print settings where supplied. Coordinates can reveal where an image was taken. People depicted in an image may not be the customer; their information comes from the person submitting it.
Orders. Records include order identifiers, print format, photograph count, country, promotional codes and fulfilment details. Reporting includes the terminal and delivery-session identifier, amount, payment and print status, and relevant dates. Orders can contain an email address. Kiosk-only payment does not mean the backend receives no payment-status information.
Analytics and diagnostics. App analytics includes user and device identifiers, product interactions, other usage information, crash reports, performance data and other diagnostics. These data can be linked to your account or device. This describes the App as a whole, not the information received by each individual provider.
The PostHog iOS integration processes app actions, device and app information, operating system, locale, network information, identity status and error diagnostics. It also records approximate location derived from an IP address, including country, city and approximate coordinates. IP anonymisation is enabled, but does not make the remaining identifier-linked analytics anonymous or remove derived location. Session replay is not enabled in the current PostHog project.
Notifications and support. Push notifications deliver app messages to your device. If you contact support, we receive your contact details, message and information you supply about the issue. Please avoid sending unnecessary photographs or sensitive information.
Purposes and legal requirements
Where the GDPR applies, account authentication and processing objectively necessary to prepare and transmit your requested print order rely on performance of our app-service contract with you. A contract with the customer does not itself provide a contractual basis for everyone depicted in a photograph.
For other people depicted, we rely on our legitimate interest in providing the print service requested by the customer, subject to necessity and those people’s rights and interests. Processing special-category personal data requires an additional applicable condition; acceptance of the App Terms does not itself supply it.
Contract-related support relies on performance of the service contract. Other enquiries, security, fault investigation and operational order reporting serve our legitimate interests in responding to enquiries and providing a secure, reliable service, subject to necessity and balancing against individual rights. Binding legal requests rely on the applicable legal obligation. Necessary processing to establish, exercise or defend claims may rely on our legitimate interest in protecting legal rights.
Product analytics helps us understand use and improve the App. Our interest in improvement does not replace consent where applicable law requires it. Service notifications support requested app functions; unrelated promotional messages are not necessary for printing. The implementation requirements below address optional processing. Accepting the App Terms or this notice is not blanket consent to analytics, marketing or international transfers.
Without the information necessary for your chosen sign-in method, that method cannot be used. A selected image and necessary print settings are needed to print that image.
Providers and recipients
Cloudflare, Inc. provides the backend infrastructure. D1 stores account, session, order and photograph metadata. R2 stores JPEG files. Workers Logs records server logs and errors.
ClickHouse in Yandex Cloud receives operational order reporting: order code, terminal delivery-session identifier, country, print format, photograph count, amount, payment and print status, dates and terminal. These records are not anonymous merely because direct contact details are omitted.
Apple and Google support sign-in. DashaMail delivers emails, including one-time sign-in codes. Foursquare receives photograph coordinates, where present, to identify the associated place name. PostHog provides product analytics. Notification-delivery services support delivery of push messages to devices.
The selected kiosk and its operator receive information needed for printing and their fulfilment role. Operators can differ between kiosks in the same country. Independently controlled payment, kiosk-copy and local-sale processing is subject to the relevant operator’s or provider’s own notice. Necessary information may also be disclosed to authorities when legally required, or to professional advisers for a justified legal claim.
Locations and transfer protections
Cloudflare selects D1 and R2 placement automatically. This is not an EU-only storage or access guarantee. The PostHog iOS project uses its EU ingestion endpoint, which does not establish that every support or other access operation is confined to the EU. DashaMail’s standard licence provides for processing in Russia. Yandex Cloud’s standard terms provide for Russian placement unless other available infrastructure is selected. Processing and access may therefore involve countries outside the European Economic Area.
Cloudflare’s standard Self-Serve terms incorporate its Data Processing Addendum, including applicable international-transfer provisions: https://www.cloudflare.com/cloudflare-customer-dpa/. Foursquare’s standard Places API terms incorporate its Global Data Processing Addendum for protected data, including applicable European standard contractual clauses: https://foursquare.com/legal/global-data-processing-addendum/.
These references explain the providers’ standard terms; they do not assert that an additional agreement has been signed for every recipient or establish a transfer mechanism for a different provider. Our implementation requirements below require an applicable lawful mechanism for restricted transfers. You may contact hello@boft.io to request information about processing locations and applicable safeguards, including a copy where legally available and subject to necessary redactions.
Order and photograph deletion
The backend cleanup job runs once a day. Eligible records and files are removed after the relevant period expires; deletion is not promised at an exact minute. Photograph files and order metadata have different lifetimes. The durations below are confirmed. For the 60-day and 1-day rules, this notice adopts order placement as the start event; alignment of the backend clocks with that adopted event is an implementation requirement, not a verified existing setting.
| Data | Deletion rule |
|---|---|
| JPEG files from printed orders | 30 days after printing. Order and photograph metadata, including coordinates, remain until the order is deleted under the rules below. |
| Unconfirmed orders and their photographs | 30 days after the order’s last modification. |
| Confirmed but unpaid orders and their photographs | 60 days. Order placement is the start event adopted by this policy, subject to the implementation requirement above. |
| Empty orders without photographs | 1 day. Order placement is the start event adopted by this policy, subject to the implementation requirement above. |
| Paid orders not yet printed, including photographs | 2 years after the order’s last modification, unless an earlier applicable rule removes them. |
| Any remaining order and its photographs or metadata | Due for deletion no later than 2 years after the order’s last modification, through the daily cleanup job. |
| Account, sign-in sessions and linked login identities | Removed when the account-deletion process completes. |
Cloudflare Workers Logs keeps logs in that service for up to seven days under its published service limits. The application server does not make its own separate database or JPEG backups, but Cloudflare D1 provides automatic rolling database-recovery history of up to 30 days under its standard limits. Deleted database records can remain in that history until the window expires. These limits do not describe separate exports or kiosk copies.
The PostHog project has a one-year product-analytics query window. This is not automatic erasure: older data can remain stored and require separate deletion. Deleting a backend order does not itself establish that a separate ClickHouse report, analytics record, email record or provider copy has been deleted. The additional limits below are implementation requirements, not existing automatic-deletion claims.
Account deletion and privacy requests
You can request account deletion in the App. That process removes the account, sign-in sessions and linked login identities. Orders are not automatically deleted with the account: their account association, email address and any gift details are removed, while remaining records and photographs follow the order schedule. Removing those links does not guarantee anonymity.
The in-app deletion process is unavailable while an associated order has a payment in progress, until payment is completed or cancelled. You can still send a statutory request to hello@boft.io, including a request to erase remaining identifiable data. The app restriction is not a blanket legal exception to erasure. Uninstalling the App does not delete data already held by us or other organisations.
We will receive and assess privacy requests through hello@boft.io, using manual handling where needed. We may request proportionate information to verify identity, identify the relevant records and protect other people’s data. We will coordinate with relevant service providers where required, respond within applicable statutory deadlines, and explain any lawful exception, extension or refusal. A request is not limited to what an in-app control can delete.
Additional implementation requirements
The following are policy requirements we are adopting for product and operational implementation. They are prospective: they do not state that every corresponding setting, deletion routine or consent control is already deployed. We will update this notice as those controls take effect.
Optional analytics that requires consent must remain off until consent is obtained, with a practical way to withdraw it. Where the necessary consent controls are not in place, that optional processing must be disabled rather than treated as necessary for printing. Required permission or consent for optional promotional notifications must be handled separately from core app access.
The target retention limits for identifiable ancillary records are: product-analytics events, 12 months after the event; separate operational order reports, 2 years after the relevant order’s last modification; support correspondence, 12 months after the enquiry is closed; and transactional email-delivery records, 30 days after sending. These limits do not shorten earlier deletion duties or replace the current order and photograph rules. They are not yet presented as active automatic deletion settings. Necessary records for a specific legal obligation or claim may be retained only for that identified reason and applicable period, with restricted access.
Third parties receiving personal data for our app service must provide protection at least equivalent to the protection set out in this notice and required by applicable law and platform requirements. Appropriate arrangements must put that requirement into effect; this is not a claim that every recipient arrangement has already been verified.
Restricted international transfers must have an applicable lawful mechanism and any required supporting measures. If those conditions cannot be met for a data flow, it must be suspended or reconfigured before continuing. Publication of this notice, ordinary acceptance of the App Terms and a provider’s general privacy page do not themselves supply that mechanism.
Access and security
The team accesses backend data through the Cloudflare account and order information through an administration panel. Photograph download links expire after two minutes; expiry controls access rather than deleting the stored file. We must limit access and apply security appropriate to the processing risks. No system is completely secure. We will provide any legally required breach notifications.
Your choices and rights
You can manage available device and notification permissions in your device settings. Changing a permission does not necessarily remove coordinates already submitted with a photograph or approximate location derived from an IP address. Contact hello@boft.io about analytics choices and information already processed.
Depending on applicable law, you may have rights to access and obtain a copy of your data, correct inaccuracies, request erasure, restrict processing, object and receive portable data. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Where we rely on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing and related profiling where the law provides that right. These rights have conditions and exceptions that must be assessed under applicable law.
You may complain directly to a competent data-protection authority, including one in your place of residence, work or alleged infringement where the law permits. Latvia’s Data State Inspectorate provides information at https://www.dvi.gov.lv/en. You do not need our permission to complain.
Children and changes
Children’s use and any required guardian involvement are subject to applicable law. Where an online service offered directly to a child relies on consent, the applicable national consent threshold must be met. A parent or guardian concerned about a child’s information can contact hello@boft.io.
We will update this notice as practices or implementation status change and provide any additional notice required by law. A notice update does not itself authorise a new purpose, replace consent or establish a missing legal safeguard.