Privacy Policy - Data Protection & GDPR Compliance

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Data Controller

The data controller for this website is:

BoostScale AI LLC
5830 E 2ND ST, STE 7000 #30271
CASPER, Wyoming 82609
United States

Email: hello@boost-scale.ai
Phone: +357 97 568163

The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

3. Data Collection on This Website

How do we collect your data?

Your data is collected when you provide it to us. This could, for example, be data you enter in a contact form. Other data is collected automatically or with your consent when you visit the website through our IT systems. This primarily includes technical data (e.g., internet browser, operating system, or time of page access).

What do we use your data for?

Some data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future.

4. Hosting and Content Delivery Networks (CDN)

Vercel Hosting

We host our website with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel automatically collects information about your visit in so-called server log files. These include:

Browser type and version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of server request
IP address

The legal basis for data processing is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in providing, functionality, security, and stability of our website.

Database (Vercel Postgres)

Data from our forms (website audit, newsletter) is stored in a Postgres database provisioned through our hosting provider Vercel and operated by Supabase, Inc. (USA). Supabase processes this data as a data processor. The legal basis is Art. 6 Para. 1 lit. b and f GDPR. The retention periods listed in section 14 apply.

5. Data Transfer to Third Countries

Our service providers Vercel (hosting), Supabase (database), Resend (email delivery), Google (web analytics, only with your consent), and Calendly (appointment booking) are based in the USA or process data in the USA. These transfers rely on the European Commission's adequacy decision for the USA (EU-US Data Privacy Framework) and, where required, on standard contractual clauses.

6. Contact Form and Email Contact

If you send us inquiries via contact form or email, your information from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

The processing of this data is based on Art. 6 Para. 1 lit. b GDPR if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries directed to us (Art. 6 Para. 1 lit. f GDPR).

7. Newsletter (Double Opt-In)

Our newsletter uses a double opt-in process: after you sign up, you receive an email with a confirmation link. We only add your email address to the mailing list once you click that link. Signups that are not confirmed within 30 days are deleted automatically.

We store your email address, your chosen language, the status of your subscription (pending, confirmed, unsubscribed), and the timestamps of signup, confirmation, and unsubscription. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR).

Every newsletter email contains an unsubscribe link. You can use it to withdraw your consent at any time with effect for the future. After unsubscribing you will not receive any further newsletter emails. Your email address remains stored with the status "unsubscribed" so that we can prove and permanently honor your opt-out; on request we delete the record entirely.

8. Website Audit Tool (SEO Audit)

When you request a free website audit, we store your email address and the website URL you submit in order to generate and deliver the report and to follow up with you about our services. The legal basis is Art. 6 Para. 1 lit. b GDPR (delivering the requested analysis) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in initiating business contact).

We do not store your browser's user agent. Your IP address is used solely to limit the number of requests per hour (rate limiting); these records are deleted automatically within 48 hours at the latest. IP addresses and browser data stored together with audit requests before July 2026 are removed by an automated daily job after 90 days at the latest.

Your email address and website URL remain stored until the purpose no longer applies or you request deletion (see section 12). An informal email to hello@boost-scale.ai is sufficient.

9. Email Delivery via Resend

We use the service Resend (Resend, Inc., San Francisco, California, USA) to send our emails (confirmation, newsletter, and audit report emails). Your email address and the contents of the respective email are processed via Resend's servers. Resend processes this data as a data processor.

The legal basis is Art. 6 Para. 1 lit. a GDPR (newsletter) or Art. 6 Para. 1 lit. b GDPR (requested reports and confirmations). Details: https://resend.com/legal/privacy-policy

10. Google Analytics 4

This website uses Google Analytics 4 only if you have given consent via the cookie banner. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyze how the website is used in aggregate. Data may be transferred to servers of Google LLC in the USA.

The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR). Without your consent, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future using the "Reset cookie settings" button on our cookie policy page.

11. Calendly (Appointment Booking)

We use Calendly for appointment booking. The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, GA 30363, USA. When you book an appointment via Calendly, your entered data is stored on Calendly's servers.

Calendly collects IP addresses, browser information, time zone data, and information about your device. The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient appointment management).

Calendly has submitted to the EU-US Data Privacy Framework. Details: https://calendly.com/privacy

12. Your Rights Under GDPR

You have the following rights:

Right to Access (Art. 15 GDPR): You can request information about your stored personal data.
Right to Rectification (Art. 16 GDPR): You can request the correction of incorrect data.
Right to Erasure (Art. 17 GDPR): You can request the deletion of your data, unless legal retention obligations prevent this.
Right to Restriction of Processing (Art. 18 GDPR): You can request restriction of processing.
Right to Data Portability (Art. 20 GDPR): You can request that we provide your data in a structured format.
Right to Object (Art. 21 GDPR): You can object to the processing of your data.
Right to Complain: You have the right to complain to a data protection supervisory authority.

13. Data Security

We use SSL/TLS encryption for data transmission on our website. All data is encrypted during transmission. We take appropriate technical and organizational security measures to protect your data from loss, misuse, or unauthorized access.

14. Storage Duration

Unless specifically stated, personal data is only stored for as long as necessary for the respective purpose. After the purpose ceases to exist, the data will be deleted, unless there are legal retention obligations.

The following specific periods apply:

Rate limiting records (IP addresses): deleted automatically within 48 hours at the latest
IP addresses and browser data stored with audit requests before July 2026: removed after 90 days at the latest
Unconfirmed newsletter signups: deleted automatically after 30 days
Newsletter subscriptions: until you unsubscribe via the unsubscribe link
Email address and website URL from audit requests and contact inquiries: until the purpose is fulfilled or you request deletion

This privacy policy was last updated in July 2026. We reserve the right to change this privacy policy at any time.