Privacy Policy

The data controller is Boostora, operator of the website boostora.se.

Contact for data protection matters: support@boostora.se.

We collect the following categories of personal data:

• Account information: email address, optional name, language preference
• Order data: the public username or link you provide, quantity, price, timestamp
• Payment data: anonymized IDs from Stripe (we never see your card number)
• Technical data: IP address, browser type, timezone, device
• Communications: content you send to support

• Order processing: to fulfill the contract with you (GDPR art. 6(1)(b)).
• Customer support: to respond to your requests (GDPR art. 6(1)(b)).
• Accounting: to comply with legal requirements (GDPR art. 6(1)(c), Swedish Accounting Act).
• Security and fraud prevention: legitimate interest (GDPR art. 6(1)(f)).
• Marketing: only with your consent (GDPR art. 6(1)(a)). You can withdraw consent at any time.

Your data is only shared with the following trusted subprocessors, all of whom have signed data processing agreements with us:

• Stripe — payment processor (USA, under EU–US Data Privacy Framework and SCC)
• Supabase — database service (EU)
• Resend — email delivery (EU)
• Vercel — hosting (EU/USA, SCC)
• Delivery network — only the public username or link you provided, no personally identifiable information

• Account information is retained until you request deletion.
• Order and payment records are retained for 7 years per Swedish accounting law.
• Technical log data is typically deleted within 30 days.
• Support communication is retained for up to 24 months.

Under GDPR, you have the right to:

• Access your personal data (subject access request)
• Have inaccurate data corrected
• Request erasure ("right to be forgotten")
• Restrict processing
• Object to processing
• Receive your data in a machine-readable format (data portability)
• Withdraw consent at any time
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se

Contact support@boostora.se to exercise your rights. We respond within 30 days.

The Service is not intended for persons under 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal data, contact us and we will delete it immediately.

We use only necessary cookies for authentication and language settings. See our Cookie Policy for details.

We may update this policy from time to time. The last-updated date is shown at the top. Material changes are notified to registered users via email.

For questions about this policy or your privacy: support@boostora.se.