---
title: "Privacy Policy · Magic Booth"
description: "What Magic Booth collects, why, and for how long."
url: https://staxel.ai/booth/privacy
format: agent version of this page (the same facts as the page, as text)
plain_markdown: https://staxel.ai/booth/privacy.md
site_index: https://staxel.ai/llms.txt
---

Magic Booth: Event Photos

# Privacy Policy

Last updated: October 28, 2026

Magic Booth is operated by Staxel (**we**, **us**). This policy covers the Magic Booth iOS application, its pages at staxel.ai/booth, and the services behind them. Two kinds of people appear in it: **operators**, who hold accounts and run booths, and **guests**, who are photographed at a booth an operator runs.

## 1. What we collect

- **Operator accounts.** Email address, name, and a password (stored only as a hash). Workspace membership, booth configuration, and the reference images and prompts you upload.
- **Guest photographs.** The photograph a booth takes, and the stylized image generated from it.
- **Guest email addresses.** Collected only when a guest asks to receive their photo, and used for exactly that: releasing that photograph to that guest. Guest addresses are never used for marketing and never added to any mailing list.
- **Device and usage records.** Which devices are enrolled in a workspace (name, model, app version, and an installation identifier the app generates itself so a reinstalled device is recognised as the same one; it is not Apple’s advertising identifier), and a record of each generation: when, which look, what it cost in credits. These are the operator’s usage and billing history.
- **Purchases.** Subscriptions, credit packs and Unlimited are bought through Apple. We receive the signed transaction: which product, for which period when it is a subscription, in which store environment. We never see payment card details; Apple’s own privacy policy covers the payment itself.

## 2. How photographs are processed

To produce the stylized image, the booth photograph is sent to a third-party AI image-generation provider acting as our processor. The providers we use are bound to process the image only to produce the result. Photographs and results are stored in cloud object storage until deletion.

## 3. How long we keep things

- **Guest photographs are deleted 30 days after they are taken**: the original capture, the generated image, the guest’s email address, and the token that fetched the photo, all together. What survives is a count: how many photos were taken and how many were claimed, with nothing that says who anyone was.
- Generation records (what was made, when, what it cost) are kept as billing history. They do not contain the photographs.
- Operator account and workspace data is kept for as long as the account exists.

## 4. What we share, and what we do not

- We share data only with the processors needed to run the Service: cloud hosting and object storage, the AI image providers above, an email delivery provider (for invitations, password resets, photo delivery, and the updates you subscribe to), Apple for purchases, and Google, for the website analytics in section 8.
- We do not sell personal data, we do not use photographs to train models, and we do not use guest data for advertising or profiling of any kind.
- We disclose data if the law requires it, and will tell the affected operator unless legally barred.

## 5. Your rights

- **Operators** can see and correct their account data in the app, and can delete their account and workspace data themselves, from Settings in the app. What remains afterwards is a record that an account was deleted, a record of what each App Store purchase paid out, and a count of the free trial already used on that device, none of which names anyone.
- **Guests** can simply not claim a photo (it is deleted with everything else within 30 days) or ask for earlier deletion through the operator who ran the booth, or directly through us.
- Depending on where you live, you may have additional statutory rights (access, portability, objection, complaint to a supervisory authority). Requests go to the address below and we honor them as the law requires.

## 6. Children

Operator accounts are for adults. Guests at an event may be minors; photographing a minor at a booth requires the consent of a parent or guardian, and obtaining it is the operator’s responsibility. A guardian may request deletion of a minor’s photograph at any time, though every photograph is deleted within 30 days regardless.

## 7. Security

Data moves over TLS, passwords are stored only as hashes, photographs are retrievable only with per-photo tokens, and access to customer data inside Staxel is limited to staff who need it, with the actions they take recorded in an audit trail.

## 8. This website

The pages at staxel.ai/booth are part of staxel.ai, Staxel’s website, and work like the rest of it:

- **Analytics, only if you accept.** The site asks before it uses Google Analytics, and loads nothing until you accept. If you do, it counts visits and sees which pages are read: it sets cookies in your browser and records the pages you open, the page that sent you, your browser and device type, and an approximate location derived from your IP address. Google processes this for us, and we only look at it in aggregate. Change your answer at any time with *Cookie settings* at the foot of the page; withdrawing removes the cookies it set.
- **Your preferences.** Your light or dark theme choice and your touchless settings are kept by your own browser and never sent to us.
- **Touchless mode.** Only if you switch it on, the site asks to use your camera so you can point with your hand. Camera frames are processed in your browser to find your hand, and are never sent anywhere or stored. To run it, your browser downloads the hand-tracking software from Google’s servers and from jsDelivr, which see your IP address as any server you download from does.
- **Updates you ask for.** If you subscribe with the form on the front page, your email address goes to our email provider and is kept on the Magic Booth list for nothing but news about it. Every message has a link to unsubscribe.
- **Support messages.** What you send with the support form (your name, email address and message) is emailed to our support inbox and used to answer you.
- **Server logs.** Our web host keeps ordinary server logs (IP address, time and page requested) for security and troubleshooting.

## 9. Changes

When this policy changes, the date at the top changes with it, and material changes are announced in the app or by email to operators before they take effect.

## 10. Contact

Privacy questions and requests: [support@staxel.ai](mailto:support@staxel.ai) .

[support@staxel.ai](mailto:support@staxel.ai?subject=Magic%20Booth) [Support](https://staxel.ai/booth/support) [Terms of Use](https://staxel.ai/booth/terms) [Privacy Policy](https://staxel.ai/booth/privacy)

## Get a recommendation for your user (optional)
This site can recommend the Staxel product that best fits what your user is looking for, and the next step to take.

Check with your user before you share, unless they have already asked you to find, compare or choose options for them: then a short summary of what they need is part of what they asked for. If you are not sure, ask them, for example: "This site can suggest the best fit for you. Want me to tell it what you are looking for?" If they would rather not, skip this section.

Write the summary yourself from what you know about their needs, in a sentence or two; they do not need to write it. Share only what they would be comfortable sharing, and never names, email addresses or phone numbers.

- **Follow links** (for agents that can only open links they are given): open https://staxel.ai/agent-request?page=%2Fbooth%2Fprivacy&choose=start and, at each step, follow the choice that best matches your user. A few steps lead to a recommendation.
- **Open a link**: `https://staxel.ai/agent-request?page=%2Fbooth%2Fprivacy&needs=` followed by what they need, URL-encoded. Add `&constraints=` for budget, timing, devices or location, and `&agent=` with your product name. The reply is the recommendation as text.
- **HTTP POST**: `https://staxel.ai/agent-request` with a JSON body:

```json
{ "needs": "what they are looking for", "constraints": "budget, timing, devices, location", "agent": "your product name", "page": "/booth/privacy" }
```

- **MCP**: the tool `ask_site` on https://staxel.ai/mcp.
- **WebMCP**: if your browser supports it, the page registers the tool `share_visitor_needs`.

`needs` is up to 2000 characters; `constraints` up to 1000; `agent` up to 120.