Data Processing Agreement
BoostGood Data Processing Agreement
Version: 2.5
Effective date: 19 August 2026
Last updated: 19 August 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between:
- Controller: The organization subscribing to the BoostGood Service ("Client," "Controller," or "you")
- Processor: Except Integrated Sustainability BV, operating the BoostGood platform ("BoostGood," "Processor," "we," or "us")
This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and governs the processing of personal data by BoostGood on behalf of the Controller in connection with the Service. It should be read alongside the BoostGood Privacy Policy v2.5, which describes the two-plane data architecture in full.
Architecture note. BoostGood operates on a two-plane model. The central plane (portal, billing, account management) is operated by BoostGood and is the subject of this DPA. The tenant plane (your dedicated VPS running LibreChat, Nextcloud, n8n, and the knowledge base) is your own server: you are both controller and operator of that server. BoostGood's role there is infrastructure provider, and our access to it is constrained as described in Section 4. This distinction changes what counts as GDPR "processing by the processor" and what does not.
1. Definitions
1.1. "Personal Data" means any information relating to an identified or identifiable natural person, as defined in GDPR Article 4(1).
1.2. "Processing" means any operation performed on Personal Data, as defined in GDPR Article 4(2).
1.3. "Central Plane" means the BoostGood-operated portal, billing system, account management infrastructure, and any other systems hosted centrally by BoostGood.
1.4. "Tenant Plane" means the dedicated virtual private server (VPS) provisioned for the Controller, on which the Controller's applications run. The Controller is the operator of the Tenant Plane.
1.5. "Sub-Processor" means any third party engaged by BoostGood to process Personal Data on behalf of the Controller in connection with the Central Plane.
1.6. "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
1.7. "Service" means the BoostGood AI agent ecosystem platform as described in the Terms of Service.
1.8. "Supervisory Authority" means the competent data protection authority, in particular the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
2. Subject Matter and Duration
2.1. Subject matter. This DPA governs BoostGood's processing of Personal Data in the Central Plane on behalf of the Controller. It does not govern data that the Controller stores on the Tenant Plane, over which the Controller exercises independent control as operator of that server.
2.2. Duration. This DPA remains in effect for the duration of the Agreement, plus the 90-day archive period following termination, plus any additional period required to delete or return Personal Data in accordance with Section 12.
2.3. Termination. This DPA automatically terminates when BoostGood no longer processes Personal Data on behalf of the Controller.
3. Scope of Processing: Two Planes Explained
3.1. Central Plane: what BoostGood processes on your behalf
BoostGood processes the following Personal Data in the Central Plane on behalf of the Controller:
- Account information: names, email addresses, organization details, hashed passwords, and user roles for accounts in the BoostGood portal
- Billing and order data: billing addresses, order records, plan selections, payment method details (processed by Stripe), and invoice records
- Platform health metrics: CPU load, memory use, disk use, uptime, container status, and error events collected from the Tenant Plane. These metrics contain no conversation content and no file content; they describe machine state only
- Usage and credit accounting: login timestamps, session activity, AI model selections, token counts, and credits charged. Credit accounting records the fact and size of a request; it does not store message content
- Support communications: tickets, emails, and messages between the Controller and BoostGood
- Knowledge-base metadata (not content): file name, size, owner identifier, and processing status for documents managed via the portal. Document content lives on the Tenant Plane
- Technical data: IP addresses, browser type, and session identifiers associated with portal access
The Central Plane is hosted on infrastructure operated by Contabo GmbH (Munich, Germany) whose data centre for this service is in Singapore. Personal Data in the Central Plane is therefore stored and processed in Singapore.
Beta caveat: portal-native agent conversations. Some agents can be used directly inside the BoostGood portal (the "quick chat" panel on the dashboard). For these in-portal agents, conversation text is currently stored in BoostGood's central database. This is the one category of conversation content held centrally today. We are working to remove this after beta. See also Section 3.7 of the Privacy Policy v2.5.
3.2. Tenant Plane: data the Controller operates independently
The conversations, files, documents, and application data held in LibreChat, Nextcloud, n8n, and the knowledge base live on the Controller's dedicated VPS. BoostGood does not collect, store, or process this data in the Central Plane, and keeps no copy of it. The Controller is the operator of the Tenant Plane and is responsible for its lawful use. Two limited technical interactions are disclosed honestly:
- AI query routing: when a user submits a query to an AI model, the query text is transmitted from the Tenant Plane to the relevant third-party model provider (see Section 9 and Section 10). This transmission passes through our gateway only for routing and credit metering; we do not retain the content
- Infrastructure access during beta: see Section 4.3
Because the Controller operates the Tenant Plane independently, this DPA does not govern data held there. The Controller is responsible for its own GDPR compliance in respect of that data, including providing appropriate notices to its own users.
4. Access to the Tenant Plane
4.1. Infrastructure actions without entering the system
Two actions are unilateral and occur at the infrastructure level, without logging into your server or reading its contents:
- Suspend access, for non-payment or at your request. This is a status change; your data is untouched.
- Delete the server, for non-payment after notice, a legal requirement, or your request. Deletion destroys the server through the hosting provider's controls. We do not read its contents to delete it.
4.2. Support access is granted by the Controller and is time-limited
When the Controller wants BoostGood to look at its system to help with a problem, the account administrator switches on a support session from the portal settings. This generates a time-limited token (24 hours by default, up to 7 days maximum) that authorizes support actions on the Tenant Plane. The Controller can end the session at any time, revoking the token immediately. Without an active session that the Controller has enabled, support-level access to the Tenant Plane is refused.
4.3. Beta caveat on retained administrative access
Beta caveat. During the beta period, BoostGood retains a technical administrative access path to each Tenant Plane for provisioning, automated health metrics, and emergency support. In practice this means (a) a shared administrative SSH key used by our provisioning and monitoring systems, and (b) automated health checks that read machine metrics (not content) on a schedule. We use this to set up each server, keep it healthy, and resolve issues quickly during the early period.
Our committed direction for general availability is to move health metrics to a push model (the Tenant Plane reports to us rather than us reaching in) and then remove the standing administrative key, so that after beta the only way into a running Tenant Plane is a support session the Controller grants. We describe the current state honestly here rather than claim an absolute we cannot yet back in code. See also Section 4.3 of the Privacy Policy v2.5.
5. Obligations of the Processor
BoostGood shall:
5.1. Process Personal Data in the Central Plane only as necessary to provide the Service and as described in Section 3.1, unless required by EU or Dutch law.
5.2. Ensure that authorized personnel are bound by confidentiality obligations.
5.3. Implement and maintain technical and organizational measures appropriate to the risk, as described in Annex B.
5.4. Engage Sub-Processors only in accordance with Section 9.
5.5. Assist the Controller in responding to data subject rights requests under GDPR Chapter III, in respect of Central Plane data.
5.6. Assist the Controller in complying with GDPR Articles 32 to 36.
5.7. At the Controller's choice, delete or return all Central Plane Personal Data after termination, per Section 12, and delete copies unless retention is required by law.
5.8. Make available information reasonably necessary to demonstrate compliance, and support audits per Section 11.
5.9. Immediately inform the Controller if an instruction infringes the GDPR or other applicable data protection law.
6. Obligations of the Controller
The Controller shall:
6.1. Ensure a lawful basis for processing instructed under this DPA.
6.2. Provide data subjects with appropriate privacy notices per GDPR Articles 13 and 14, including for the Controller's use of the Tenant Plane.
6.3. Be solely responsible for the accuracy, quality, and legality of Personal Data provided to the Central Plane.
6.4. Be responsible for GDPR compliance on the Tenant Plane, including data stored by or for the Controller's users.
6.5. Provide processing instructions that comply with applicable law.
6.6. Assess whether BoostGood's security measures are appropriate for the Personal Data in question.
7. Data Breach Notification
7.1. BoostGood shall notify the Controller without undue delay, and within 72 hours of becoming aware, of a Data Breach affecting Central Plane Personal Data.
7.2. The notification shall include, to the extent available: (a) a description of the breach, including categories and approximate number of data subjects affected; (b) contact details for further information; (c) likely consequences; and (d) measures taken or proposed to address the breach.
7.3. Where full information is not immediately available, BoostGood shall provide it in phases without undue delay.
7.4. BoostGood shall cooperate with the Controller in investigating, mitigating, and remediating the breach. Notification shall not be construed as an acknowledgment of fault.
7.5. The Controller is independently responsible for detecting and responding to breaches on the Tenant Plane.
8. Data Subject Rights
8.1. BoostGood shall assist the Controller in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) in respect of Personal Data held in the Central Plane. Because most working data lives on the Tenant Plane, which the Controller operates, the Controller can also export or delete much of that data directly.
8.2. BoostGood shall forward to the Controller, promptly and without acting on them, any requests BoostGood receives directly from data subjects relating to Personal Data held on the Tenant Plane.
9. Sub-Processors
9.1. General authorization. The Controller provides general written authorization for BoostGood to engage Sub-Processors to carry out specific processing activities in the Central Plane, as described in Annex C.
9.2. Current Sub-Processors. The current list of Sub-Processors is set out in Annex C of this DPA.
9.3. Notification of changes. BoostGood shall inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors at least 30 days before engaging the new Sub-Processor, giving the Controller the opportunity to object.
9.4. Right to object. If the Controller objects to a new Sub-Processor on reasonable data protection grounds, the parties shall discuss the concerns in good faith. If no resolution is reached, the Controller may terminate the affected portion of the Service or the Agreement.
9.5. Sub-Processor agreements. BoostGood shall impose on each Sub-Processor the same data protection obligations as set out in this DPA by written contract, and remains fully liable to the Controller for each Sub-Processor's performance.
9.6. AI model providers and the Tenant Plane. AI model providers listed in Annex C receive query text when a user selects a given model. This transmission is made from the Tenant Plane through the BoostGood gateway for routing and credit metering only. The content is not retained by BoostGood. The Controller can control which AI models are available to its users.
10. International Data Transfers
10.1. Personal Data in the Central Plane is hosted in Singapore, which is outside the EEA and not covered by an EU adequacy decision. This transfer is safeguarded as set out in 10.2(a). BoostGood does not transfer Central Plane Personal Data to any other country outside the EEA except under the safeguards in this Section.
10.2. For transfers to Sub-Processors outside the EEA, the following safeguards apply:
- (a) Singapore (Contabo GmbH, control-plane hosting): This transfer is safeguarded by the European Commission's Standard Contractual Clauses, concluded with Contabo GmbH through its customer portal together with an Article 28 data processing agreement, on 19 August 2026.
- (b) United States (Anthropic, OpenAI, Stripe, Google, Amazon Web Services, fal.ai): Standard Contractual Clauses (SCCs) pursuant to Commission Decision 2021/914, and EU-U.S. Data Privacy Framework certification where the recipient holds one. Checked against the Data Privacy Framework participant list on 11 August 2026: Stripe, Google and Amazon are certified; Anthropic and OpenAI are not, and their transfers rest on SCCs. fal.ai's data processing addendum, incorporated by reference into its terms of service, puts SCCs Module 2 (controller to processor) in place, incorporated and deemed executed; read 11 August 2026.
- (c) China (Moonshot AI, Alibaba Cloud, DeepSeek): Standard Contractual Clauses (SCCs) and a transfer impact assessment are being put in place and are not yet concluded. Qwen (Alibaba Cloud), Kimi (Moonshot AI) and DeepSeek can be selected on every account, new and existing; BoostGood does not refuse a model on the Controller's behalf. Under clause 9.6 the Controller decides which of these models its users may select.
10.3. BoostGood is carrying out transfer impact assessments for transfers to countries not covered by an adequacy decision. None is concluded at the date of this version. The Controller may request the current status, and a copy of each assessment once it is complete.
10.4. The use of DeepSeek and other optional AI models is at the Controller's discretion. If the Controller does not enable a model, no data is transferred to that provider.
11. Audit Rights
11.1. BoostGood shall make available information reasonably necessary to demonstrate compliance with this DPA for Central Plane processing.
11.2. The Controller (or a mandated independent auditor bound by confidentiality) may audit BoostGood's processing, subject to: (a) 30 days' written notice; (b) audits during business hours without unreasonable disruption; (c) Controller bears audit costs; (d) once per 12 months unless a Data Breach or Supervisory Authority requires more; (e) auditor signs a confidentiality agreement first.
11.3. BoostGood may satisfy audit requests by providing certifications, audit reports, or other compliance evidence.
11.4. If an audit reveals non-compliance, BoostGood shall promptly take corrective action at its own expense.
12. Data Deletion and Return
12.1. Upon termination of the Agreement, BoostGood shall:
- (a) Continue to store the Controller's Personal Data from the Central Plane in an archived state for 90 days, to allow the Controller to request export
- (b) Upon request from the Controller during the 90-day archive period, export and return all Personal Data in a structured, commonly used, and machine-readable format
- (c) After the 90-day archive period, permanently delete all Personal Data from the Central Plane within 30 days
12.2. For data on the Tenant Plane, the Controller's server is archived for 90 days after termination and then destroyed. Because the Controller operates the Tenant Plane, the Controller may also request early export or deletion.
12.3. Exceptions to deletion. BoostGood may retain:
- (a) Billing records for 7 years from the transaction date, as required by Dutch tax law (Algemene Wet inzake Rijksbelastingen), with personal identifiers minimized to the extent possible
- (b) Any Personal Data that BoostGood is required to retain by EU or Dutch law
12.4. BoostGood shall provide written confirmation of deletion upon request from the Controller.
13. Liability
13.1. Each party's liability under this DPA is subject to the limitations of liability set out in the Agreement.
13.2. Both parties acknowledge their respective obligations under GDPR Article 82 regarding the right of data subjects to compensation for damage suffered as a result of a GDPR infringement.
13.3. The Controller is solely liable for compliance in respect of the Tenant Plane, which the Controller operates independently. BoostGood accepts no liability for the Controller's processing activities on the Tenant Plane.
Annex A: Description of Processing
| Element | Description |
|---|---|
| Subject matter | Provision of the BoostGood AI agent ecosystem platform (Central Plane only) |
| Duration | Duration of the subscription agreement plus 90-day archive period |
| Nature of processing | Collection, storage, retrieval, transmission (to AI model providers for routing), deletion |
| Purpose of processing | User authentication and account management; billing and payment processing; platform health monitoring (metrics only); usage and credit accounting; support communications; transactional email; AI query routing and credit metering |
| Categories of data subjects | Employees, contractors, and agents of the Controller who are authorized users of the BoostGood portal |
| Types of Personal Data (Central Plane) | Names, email addresses, organization details, hashed passwords, user roles, billing addresses, order records, payment tokens (via Stripe), platform health metrics (no content), usage event logs, IP addresses, support communications; portal-native agent conversation text (beta only) |
| Types of Personal Data (Tenant Plane, not processed by BoostGood) | Conversation content, uploaded files and documents, knowledge-base content, application data in LibreChat/Nextcloud/n8n and their databases. The Controller is the operator of this data. |
| Sensitive data | None processed intentionally in the Central Plane. The Controller is responsible for any special category data on the Tenant Plane under GDPR Article 9. |
Annex B: Technical and Organizational Measures
BoostGood implements the following technical and organizational measures to protect Personal Data in the Central Plane:
B.1. Data Isolation
- Each Controller receives a dedicated VPS for the Tenant Plane; no data is shared between Controller environments
- Central Plane data is logically separated by tenant identifier
- Network-level isolation between VPS instances
B.2. Encryption
- All data in transit is encrypted using TLS 1.2 or higher
- Data at rest is encrypted at the filesystem level on all servers
- Backups are encrypted before storage
B.3. Access Control
- Administrative access to Central Plane infrastructure is restricted to authorized BoostGood personnel
- SSH key-based authentication is required for server access; password authentication is disabled
- User authentication uses hashed passwords (bcrypt or equivalent)
- Role-based access control applied within the portal
- Principle of least privilege applied to all administrative access
- Access to the Tenant Plane requires either a support session token granted by the Controller or, during beta, the provisioning system key (see Section 4.3)
B.4. Network Security
- Firewall rules restrict access to necessary ports only (22, 80, 443)
- Regular security updates and patching of operating systems and software
- Monitoring for unauthorized access attempts
- DDoS mitigation through hosting provider infrastructure
B.5. Backup and Recovery
- Regular automated backups of Central Plane data
- Backups are encrypted and stored separately from production systems
- Tested recovery procedures
B.6. Incident Management
- Documented incident response procedures with breach notification within 72 hours (Section 7)
- Post-incident review and remediation
B.7. Personnel and Vendor Management
- Confidentiality obligations for all personnel with access to Personal Data; access on a need-to-know basis
- Written data processing agreements with all Sub-Processors; security assessment before engagement and periodic compliance review
B.8. Data Minimization
- Only data necessary for the specified purposes is processed in the Central Plane
- AI model providers receive only the query text needed to generate a response; no account or billing data is shared
- Personal identifiers are minimized in retained billing records after account termination
- Health metrics contain no conversation content or file content
Annex C: Sub-Processor List
The following Sub-Processors are authorized to process Personal Data on behalf of the Controller in connection with the Central Plane. The Sub-Processor list is current as of the effective date shown at the top of this DPA. Changes will be communicated in accordance with Section 9.3.
| Sub-Processor | Location | Processing activity | Personal Data categories | Transfer safeguard |
|---|---|---|---|---|
| Contabo GmbH | Singapore (Contabo data centre). Contracting entity per Contabo's published Terms and Conditions is Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany (AG Munich HRB 180722). The network operator of the Singapore host is Contabo Asia Private Limited (AS141995). | Control-plane hosting: the BoostGood admin panel, the LLM gateway, the PostgreSQL database, the boostgood.eco Wagtail website and the self-hosted Plausible analytics all run on a single Contabo server whose data centre is in Singapore | Every category of platform-side personal data: portal account name, email and hashed credentials; order and billing identity (name, email, phone, postal address, VAT number); billing-contact details; administrative and security logs including IP addresses; transactional email delivery log; agent chat message content; usage records | Singapore has no EU adequacy decision. This is a Chapter V transfer. Contabo GmbH's Terms and Conditions offer, via the customer portal, an Article 28 agreement on data processing supplemented by EU Standard Contractual Clauses for any server location outside the EU. Tom executed that agreement, together with EU Standard Contractual Clauses, through the Contabo customer portal on 2026-08-19. An Article 46 safeguard is now in place for this transfer. |
| Infomaniak Network SA | Switzerland | Tenant VPS hosting (OpenStack), domain registration and DNS | The tenant's entire dedicated server, including all application data on it; domain registrant contact details | EU adequacy decision for Switzerland |
| Stripe Payments Europe Ltd. / Stripe Inc. | Ireland (EU) / United States | Payment processing and subscription billing | Name, email, billing address, VAT number, payment method tokens, transaction records | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Scaleway SAS | France (EU) | Transactional email delivery for the BoostGood portal | Recipient email address, subject and body of transactional email | Within the EEA |
| Amazon Web Services (SES) | Ireland (EU) unless configured otherwise, with US parent | Outbound email sending from a tenant's own provisioned platform | Recipient email addresses and email content generated by the tenant's platform | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Anthropic PBC | United States | AI model inference (Claude) | Prompt and response text submitted to the model | Standard Contractual Clauses |
| OpenAI Ireland Ltd. / OpenAI LLC | Ireland (EU) / United States | AI model inference (GPT) | Prompt and response text submitted to the model | Standard Contractual Clauses |
| Google LLC (Gemini API) | United States and global | AI model inference (Gemini) | Prompt and response text submitted to the model | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Mistral AI SAS | France (EU) | AI model inference | Prompt and response text submitted to the model | Within the EEA |
| Alibaba Cloud (DashScope, Qwen models) | Singapore (dashscope-intl endpoint), operator incorporated in China | AI model inference (Qwen) | Prompt and response text submitted to the model | SCCs and transfer impact assessment being put in place; not yet concluded |
| Moonshot AI (Kimi models) | China | AI model inference (Kimi) | Prompt and response text submitted to the model | SCCs and transfer impact assessment being put in place; not yet concluded |
| DeepSeek | China | AI model inference (optional) | Prompt and response text submitted to the model | SCCs and transfer impact assessment being put in place; not yet concluded |
| fal.ai | United States | AI image generation | Image prompt text, and any source image submitted for image-to-image generation | Standard Contractual Clauses, Module 2 (controller to processor), incorporated and deemed executed |
| Plausible Analytics (self-hosted by BoostGood) | Singapore (BoostGood's own server, hosted on Contabo, analytics.boostgood.eco) | Website analytics for boostgood.eco | Page URL, referrer, country, browser and operating system. No cookies. The visitor IP address is used to compute a daily-rotating hash and is not stored. | Not a transfer to a third party; Plausible is self-hosted by BoostGood. The server it runs on is the Singapore control-plane host, disclosed in the Contabo GmbH row above. |
| Google (Fonts API) | United States | Serving web fonts to visitors of boostgood.eco | Visitor IP address and browser user agent, transmitted to Google when the page loads | EU-U.S. Data Privacy Framework |
| European Commission (VIES) | European Union | Validating a VAT number entered on the order form | VAT number and country code; the service returns the registered name and address | Within the EEA |
Notes:
- AI model Sub-Processors receive query text only when a user selects the corresponding model. No account information, billing data, or other Central Plane Personal Data is transmitted to AI model providers.
- The use of each AI model is optional and under the Controller's control.
- VPS hosting providers host the physical infrastructure. They do not have access to application data, which is encrypted at rest.
Except Integrated Sustainability BV
hello@boostgood.eco
boostgood.eco