Privacy Policy

Martinez United LLC operates Booth Command at boothcommand.com. This policy explains what the product collects, how we use it, and who else receives it. It matches how the software works today.

Booth Command is a service for trading-card vendors, show hosts, and collectors. It includes inventory, Show POS, Door POS, vendor check-in, store POS with consignment, public showrooms, collector portfolios and showcases, and price lookups and card scanning.

If you use Booth Command from outside the United States, your information is handled in the United States and in the places where the companies below host their systems.

Account and booth information

• Email address and password. The password is stored by our sign-in provider as a protected credential. We do not see the password itself.
• Display name, booth name, and the plan on the account, including trial dates.
• Team members you invite: email address and role (owner, manager, or staff), plus the invite link.
• A Stripe customer id when you subscribe. Card numbers are entered on Stripe's checkout page. We do not store the card number.
• If you use Google sign-in, the identity Google shares with our sign-in provider, typically an email address and a Google account identifier. That button appears only when we turn it on.

Booth, show, and store records you enter

• Inventory: titles, quantities, cost, asking price, condition, grade, set, barcode, catalog ids, and notes.
• Sales, buys, trades, door tickets, split tenders, sales tax settings, drawer counts, expenses, and booth activity history.
• Show vendors: name, business name, contact name, email, phone, table, and notes.
• Vendor check-in: badge and wristband counts, the time a disclosure was accepted, and a signature stored as pen strokes, not as a public image.
• Door tickets can include a customer name, notes, and an online order number.
• Store customers: name, phone, and email, plus store credit and purchase history you record.
• Consignors: name, phone, email, payout method, and payout handle.
• Pay handles you choose to show buyers, such as a Venmo username, a Cash App cashtag, or a Zelle email, phone, or link.
• A guest-mode PIN, stored as a hash so a tablet can be locked. We do not keep a readable copy of the PIN.
• Messages between vendors on the marketplace, wishlists, and files you import from a spreadsheet.

Photos, scans, and collector records

• Photos you take or upload for inventory, the store, or the marketplace. They are stored with your booth.
• Card photos you submit to Snap card or grade check, when those tools are turned on. Snap card can send the photo to a vision service. Grade check can send it to a vision address we configure, or it can stay on the device.
• Barcodes and cert numbers you scan or type, used to identify a product or a slab.
• Collector folders, holdings, watchlist, condition, grade, and what you paid. Cost stays on the signed-in account.

Device and usage information

• Sign-in session cookies, and a timezone cookie so booth reports line up with your clock.
• Information the browser stores on the device: offline sale drafts, a collector cache, label-printer choices, and similar preferences.
• Scan diagnostics when a scan runs long: your user id, booth id, timing, and a short browser string. Hosting logs can include IP address, browser type, and the page requested.
• On a public shelf request, a one-way hash of the IP address together with the booth and the date, plus the name and phone the guest types. The raw IP address is not stored in that field.

We use this information to:

• Create and secure your account, and send sign-up confirmation and password-reset email.
• Run inventory, shows, door sales, store POS, consignment, check-in, and team permissions.
• Bill the subscription and tell paid features from the free tools.
• Show price estimates and read a card photo when you ask for that.
• Publish a showroom or showcase you have turned on.
• Diagnose scan failures, limit abuse of public shelf requests, and keep the service reliable.
• Respond when you write to us, and meet legal duties.

We do not sell personal information. We do not use customer lists you enter to advertise Booth Command to those customers.

We share information with the companies that run the product. Price and catalog requests send product details, such as a card name, a set, a product id, or a barcode. They do not include your customers' contact details or your password. Card photos are the exception: they go to a vision service only when you use that tool and the key for it is set.

• Supabase. Database, sign-in, password storage, auth email (account confirmation and password reset), and file storage for photos and catalog images we mirror. Team invite links are created in the app. Booth Command does not email those invites.
• Vercel. Hosts the website and runs scheduled catalog jobs. Hosting logs can include IP address, browser type, and pages requested.
• Stripe. Subscription checkout and renewal for Booth Command Paid. Stripe receives the account email, a user id, and the payment method you enter on Stripe's page.
• Google. Optional. If you choose Continue with Google, Google and Supabase Auth handle that sign-in. The button is hidden until we enable it.
• Pokemon Price Tracker. Pokémon card and sealed-product prices, catalog files, and graded sold-price comparisons. Those comparisons are requested from Pokemon Price Tracker with an eBay-comps flag. We do not send your customer list there.
• tcgapi.dev. Price lookups for Magic: The Gathering, Yu-Gi-Oh!, One Piece, and Lorcana, including a near-mint low and a TCGplayer low.
• eBay. The Browse API can receive a sealed product barcode or UPC so we can identify the product. Sold-price comparisons do not call eBay directly.
• UPCitemdb. A second lookup for the same sealed barcode, using their trial endpoint or a user key when one is configured.
• xAI. The default reader for Snap card. A card photo can be sent to api.x.ai so the model can return the name, number, and set. This runs only when that key is set. The address can be pointed at another https reader.
• Grade-check vision. Optional. When both a key and an https address are set, a card photo can be sent to that address for a centering estimate. The code does not name a fixed vendor for this. With the key unset, the estimate stays on the device.
• PSA. A certificate lookup to api.psacard.com exists and is switched off. While it is off, we do not send cert numbers to PSA. If we turn it on, a cert number can be sent so a slab's grade and images can fill in.
• Image hosts your browser loads. Catalog and set images can load from tcgplayer-cdn.tcgplayer.com, images.pokemontcg.io, and images.scrydex.com. Those hosts see the image request, including IP address, the way any image site does. We do not send them your account or your customer list.

Vendor grading-tracker keys for PSA, BGS, CGC, and a generic https tracker can be saved on Settings. They are encrypted before they are stored. The current app does not send those keys to the grading companies.

Files for eBay Seller Hub, Shopify, Whatnot, and Misprint are downloads your browser saves. We do not send those files to the marketplaces. A TCGplayer pricing download is turned off.

We can also share information if the law requires it, if we need to protect Booth Command or its users, or if the business is sold. A buyer would still have to honor this policy for the information they receive.

People on your booth can see the booth records their role allows. An owner sees more than staff. A public showroom shows only what that page is built to show.

Vendors and show hosts decide what to type in about their own customers, consignors, and show vendors. That can include a name, phone, email, a ticket name, a store-credit balance, and a check-in signature. You are responsible for that information. Collect only what you need, and give those people whatever notice the law requires.

We store those records so your booth can run. We process them on your instructions to provide Booth Command. We do not use them to market Booth Command to your customers. If one of those people asks us for access or deletion, we will point them to the booth that entered the record, and we will help that booth answer when we are required to.

A showroom you turn on can show in-stock card names, photos, condition, grade, quantity, and asking price when you leave prices visible. A public shelf can also accept a guest's name and phone as a request for a card. A collector showcase can show a display name. Cost you paid is not part of the public showcase.

You control those pages. Anyone with the link can see what you publish. Pay handles you save can be shown as a QR code. The buyer then pays you in Venmo, Cash App, Zelle, or another app. We do not receive that payment.

Booth Command uses a few cookies and on-device stores. There is no advertising cookie and no separate analytics product.

• Sign-in cookies keep you logged in. Clearing them signs you out.
• A timezone cookie remembers the clock for booth and vendor reports.
• Local storage can hold offline sale drafts, a collector portfolio cache, label-printer and label-layout choices, and navigation preferences. Those stay on the device until the app syncs them or you clear the browser.
• Session storage can remember a guest-mode lockout and a fullscreen flag for that tab.

You can block cookies in the browser. Sign-in and some reports will stop working if you do.

We keep account and booth information while the account is open and you are using the service. Booth activity history is stored with the booth and is not deleted on a timer.

Open shelf requests leave the active list after four hours, or when the show ends, whichever comes first. The row can remain in the booth's history. Scan diagnostic rows are kept for troubleshooting. We have not set a fixed number of days for those logs.

When you ask us to delete the account, we delete or de-identify the personal information we hold, except records we need for security, fraud prevention, a dispute, or the law. Stripe keeps subscription records under Stripe's own policy. Backups can hold a copy until they age out. We do not promise a restore from backup.

Booth records are separated so one booth cannot read another booth's data. Traffic uses HTTPS. Grading-tracker keys are encrypted before they are stored. No method is perfect. Use a unique password, and remove team members who should no longer have access.

You can ask us to:

• Access the personal information we hold about you.
• Correct information that is wrong. You can also edit most booth records in the app.
• Delete your account and the personal information tied to it, subject to the exceptions above.
• Export a copy of the personal information tied to your account in a common format.

The app does not yet have a self-serve delete or export button. Email support@boothcommand.com and we will respond within the time your state's law requires, or otherwise within a reasonable time. We may ask you to confirm that the request is yours.

If you live in a US state that gives privacy rights, including California and other states with similar laws, you can ask us to know, correct, and delete personal information, and to receive a copy of it. Where your state law includes it, you can also opt out of the sale or sharing of personal information and appeal a decision we make on a request.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We will not treat you differently for using these rights.

An authorized agent can submit a request where your state allows it. We may still ask you to confirm the agent is allowed to act for you. If we deny a request and your state gives you an appeal, reply to that decision and we will review it.

Booth Command is for adults running a business or their own collection. You must be 18 or older to create an account. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. Write to us if you believe a child under 13 has given us information.

We can update this policy. The new version will be posted on this page with a new effective date. If a change is significant, we will also try to email account owners at the address on the account.

Privacy questions and rights requests go to Martinez United LLC.

9801 Westheimer Rd
Houston, TX 77042

support@boothcommand.com

The Terms of Service cover the subscription, acceptable use, and liability.