BoostGood Privacy Policy

Version: 2.5
Effective date: 19 August 2026
Last updated: 19 August 2026

This Privacy Policy explains how Except Integrated Sustainability BV ("BoostGood," "we," "us," or "our") handles personal data when you use the BoostGood platform ("Service"). It is provided under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), in particular Articles 13 and 14.

---

1. Data Controller

The data controller for the processing described here is:

Except Integrated Sustainability BV
Registered in the Netherlands
Contact: hello@boostgood.eco
Website: boostgood.eco

For questions or requests about your personal data, contact us at hello@boostgood.eco.

2. Two data planes: what this means for your privacy

BoostGood is built so that your working data stays with you. Understanding the architecture is the clearest way to understand this policy, so we describe it in plain terms.

2.1. Your dedicated server (your data)

When you order BoostGood, we provision a dedicated virtual private server (VPS) that is yours. The applications you use day to day run on that server: the chat and AI tools, the file storage (Nextcloud), automation (n8n), the knowledge base, and their databases. Everything those applications hold lives on your server:

• Your prompts, queries, and AI conversations
• Files and documents you upload
• Knowledge-base document content
• Anything your users create inside those applications

BoostGood does not collect, process, or store this data, and keeps no copy of it. It does not pass through our central systems in the ordinary course of using the Service. Two exceptions are honest and worth stating: (a) when you send a query to a third-party AI model, the query text is transmitted to that model provider to generate a response (Section 6); and (b) during beta we retain a technical access path to your server for provisioning and support, described in Section 3.3.

2.2. The BoostGood portal (data we do hold)

Separately from the applications on your server, the BoostGood portal is the account and control surface we operate centrally. To run it, we hold a limited set of data at our end. This is listed in full in Section 3.

The portal, your account and billing records, and our central database run on a server located in Singapore, operated by Contabo GmbH. Because Singapore is outside the European Economic Area, we describe this transfer and its safeguard in Section 7.

3. Personal Data We Hold

3.1. Account and order information

• Full name
• Email address
• Telephone number, where you give one
• Organization or company name
• VAT number and VAT country, for business orders
• Postal address: street, city, postal code and country
• Account credentials (passwords stored in hashed form only)
• Role within the organization (for example administrator or user)

The VAT number you enter is checked against VIES, the European Commission's public VAT register, so that we charge the right tax. VIES returns the registered name and address held against that number.

3.2. Billing and payment information

• Order details and plan selection
• Payment method details (processed and stored by Stripe; we do not store full card numbers)
• Invoices and payment records

3.3. Platform health metrics (no content)

To keep your server running and to alert you before something breaks, we collect operational metrics: CPU load, memory use, disk use, uptime, service and container status, and error events. These metrics contain no prompts, no conversations, and no file content. They describe the health of the machine, not what you do on it.

3.4. Usage and credit accounting (no message content)

• Login timestamps and session activity
• AI credit consumption: which model was used, token counts, and credits charged
• Feature usage at the level of counts and events

Credit accounting records the fact and size of a request so we can meter it. It does not store the text of your messages.

3.5. Support communications

Support tickets, emails, and messages you send us, and our replies.

3.6. Knowledge-base metadata (not content)

For knowledge-base documents managed through the portal, we hold metadata only: file name, size, owner, and processing status. The document content itself lives on your server, not ours.

3.7. Portal-native agent conversations

3.8. Technical data

• IP address
• Browser type and version
• Operating system and device type

3.9. Administrative and security logs

We keep a log of administrative and security-relevant actions in the portal: who did what, when, from which IP address, with which browser, and whether the action succeeded or was refused. We use this to investigate security incidents and to reconstruct what happened when something goes wrong. These logs contain email addresses and IP addresses. They do not contain the content of your conversations or your files.

3.10. Website visits, analytics and cookies

The boostgood.eco website sets only the cookies needed to make it work, such as the one that keeps you signed in and the one that remembers your language. We do not use advertising or tracking cookies.

We measure how the website is used with Plausible Analytics, which we run on our own server. Plausible sets no cookies and stores no IP addresses. It records the page visited, the referring site, the country, and the browser and operating system. Your IP address is used only to compute a hash that changes every day and is then discarded, so a visitor cannot be recognised from one day to the next. No third party receives this data.

The website loads two typefaces from Google Fonts. When your browser requests them, Google receives your IP address and browser details. We are moving these fonts onto our own server, which removes that transfer.

4. Access model: customer-controlled access

BoostGood is designed so that entering your running system is something you control, not something we do at will.

4.1. What we can do without entering your system

Two actions are unilateral, and both happen at the infrastructure level without logging into your system or reading its contents:

• Suspend your access, for non-payment or at your request. This is a status change on our side; your data is untouched.
• Delete your server, for non-payment after notice, a legal requirement, or your request. Deletion destroys the server through our hosting provider's controls. We do not read its contents to delete it.

4.2. Support access is granted by you, and is time-limited

When you want us to look at your system to help with a problem, you switch on a support session from your portal settings. This generates a time-limited token (24 hours by default, up to 7 days) that authorizes support actions on your server. You can end the session at any time, which revokes the token immediately. Without an active session that you enabled, support-level actions on your server are refused.

4.3. Beta caveat on retained access

5. Purposes and Legal Bases

Purpose	Data used	Legal basis (GDPR Art. 6(1))
Providing and operating the Service and your server	Account info, health metrics, usage data	Contract (b)
Authentication and account management	Account info, technical data	Contract (b)
Billing and payment processing	Billing and order info	Contract (b) / Legal obligation (c)
Routing AI queries to third-party models you choose	Prompt text you submit	Contract (b)
Keeping the platform healthy, secure, and fixing bugs	Health metrics, technical data, error events	Legitimate interest (f)
Providing support when you request it	Support communications; system access only during a session you grant	Contract (b)
Communicating with you about the Service	Account info (name, email)	Legitimate interest (f) / Contract (b)
Complying with legal obligations	Billing info, account info	Legal obligation (c)
Marketing communications, where you opt in	Name, email	Consent (a)

Where processing relies on legitimate interest, we balance it against your rights and do not use it to override them. Where it relies on consent, you may withdraw consent at any time by contacting hello@boostgood.eco, without affecting processing carried out before withdrawal.

6. Sub-Processors

We use the following third parties to deliver the Service. Each processes data only for the purpose shown. AI model providers receive only the query text you choose to send them; they do not receive your account or billing data.

Sub-Processor	Purpose	Data processed	Location	Status
Contabo GmbH	Control-plane hosting: the BoostGood admin panel, the LLM gateway, the PostgreSQL database, the boostgood.eco Wagtail website and the self-hosted Plausible analytics all run on a single Contabo server whose data centre is in Singapore	Every category of platform-side personal data: portal account name, email and hashed credentials; order and billing identity (name, email, phone, postal address, VAT number); billing-contact details; administrative and security logs including IP addresses; transactional email delivery log; agent chat message content; usage records	Singapore (Contabo data centre). Contracting entity per Contabo's published Terms and Conditions is Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany (AG Munich HRB 180722). The network operator of the Singapore host is Contabo Asia Private Limited (AS141995).	In use
Infomaniak Network SA	Tenant VPS hosting (OpenStack), domain registration and DNS	The tenant's entire dedicated server, including all application data on it; domain registrant contact details	Switzerland	In use
Stripe Payments Europe Ltd. / Stripe Inc.	Payment processing and subscription billing	Name, email, billing address, VAT number, payment method tokens, transaction records	Ireland (EU) / United States	In use
Scaleway SAS	Transactional email delivery for the BoostGood portal	Recipient email address, subject and body of transactional email	France (EU)	In use
Amazon Web Services (SES)	Outbound email sending from a tenant's own provisioned platform	Recipient email addresses and email content generated by the tenant's platform	Ireland (EU) unless configured otherwise, with US parent	In use
Anthropic PBC	AI model inference (Claude)	Prompt and response text submitted to the model	United States	In use
OpenAI Ireland Ltd. / OpenAI LLC	AI model inference (GPT)	Prompt and response text submitted to the model	Ireland (EU) / United States	In use
Google LLC (Gemini API)	AI model inference (Gemini)	Prompt and response text submitted to the model	United States and global	In use
Mistral AI SAS	AI model inference	Prompt and response text submitted to the model	France (EU)	In use
Alibaba Cloud (DashScope, Qwen models)	AI model inference (Qwen)	Prompt and response text submitted to the model	Singapore (dashscope-intl endpoint), operator incorporated in China	In use
Moonshot AI (Kimi models)	AI model inference (Kimi)	Prompt and response text submitted to the model	China	In use
DeepSeek	AI model inference (optional)	Prompt and response text submitted to the model	China	In use
fal.ai	AI image generation	Image prompt text, and any source image submitted for image-to-image generation	United States	In use
Plausible Analytics (self-hosted by BoostGood)	Website analytics for boostgood.eco	Page URL, referrer, country, browser and operating system. No cookies. The visitor IP address is used to compute a daily-rotating hash and is not stored.	Singapore (BoostGood's own server, hosted on Contabo, analytics.boostgood.eco)	In use
Google (Fonts API)	Serving web fonts to visitors of boostgood.eco	Visitor IP address and browser user agent, transmitted to Google when the page loads	United States	In use
European Commission (VIES)	Validating a VAT number entered on the order form	VAT number and country code; the service returns the registered name and address	European Union	In use

We are putting written data processing agreements in place with each sub-processor under Article 28 GDPR. Where an agreement is not yet signed we say so rather than imply otherwise, and we update this page as each one is completed.

7. International Data Transfers

7.1. Singapore (BoostGood portal and database, Contabo)

The BoostGood portal, your account and billing records, our administrative and security logs, and our central database run on a server operated by Contabo GmbH (Welfenstrasse 22, 81541 Munich, Germany) whose data centre is in Singapore. Your account information is therefore processed in Singapore. The European Commission has not issued an adequacy decision for Singapore, so this transfer requires a safeguard under Chapter V of the GDPR.

Contabo offers, through its customer portal, an agreement on data processing supplemented by the European Commission's Standard Contractual Clauses for server locations outside the EU. We have concluded that agreement, so this transfer is covered by the Standard Contractual Clauses adopted by the European Commission.

7.2. Switzerland (Infomaniak)

Your dedicated server is hosted in Geneva, Switzerland. The European Commission has decided that Switzerland provides an adequate level of data protection, so no additional safeguard is required for this transfer.

7.3. United States (Anthropic, OpenAI, Google, Stripe, fal.ai, Amazon Web Services)

Protected by the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise by Standard Contractual Clauses adopted by the European Commission. We checked the Data Privacy Framework participant list on 11 August 2026 rather than assume: Stripe, Google and Amazon are certified; Anthropic and OpenAI are not, so those two transfers rest on Standard Contractual Clauses alone. Our contract for OpenAI is with OpenAI Ireland Ltd.; OpenAI then moves the data on to the United States under those same clauses. fal.ai, used for AI image generation, publishes a data processing addendum that its terms of service incorporate by reference. We read it on 11 August 2026: it puts Standard Contractual Clauses in place, Module 2, controller to processor, and it requires fal.ai to delete your data when the agreement ends. It can be selected by every BoostGood account, and if you select it your image prompt and any source image you submit are sent to fal.ai in the United States.

7.4. China (Moonshot AI, Alibaba Cloud, DeepSeek)

Three of the AI model providers in our catalogue operate from China, or from a Singapore endpoint by a company incorporated in China. If you select one of those models, the text of your query is sent there. China has no adequacy decision from the European Commission, and a Chinese operator can be compelled to disclose data to state authorities in ways that have no equivalent in EU law.

Kimi (Moonshot AI), Qwen (Alibaba Cloud) and DeepSeek can be selected by every BoostGood account, new and existing. Which AI models you use is your choice, and BoostGood does not switch a provider off on your behalf. We have not concluded Standard Contractual Clauses or a transfer impact assessment for any of the three, and we state that here rather than leave them quietly selectable. Mistral processes in France and is the EU-only option among our AI providers. Mistral's own agreement would otherwise let it train its models on what we send it, so on 11 August 2026 we switched training off on the BoostGood account and set retention there to 30 days, the shortest Mistral offers. Those are settings we control rather than terms of the contract, so we re-check them whenever we review this policy. Your administrator can restrict which models your users may choose, from the model settings in your portal.

7.5. Data minimization for AI providers

Only the conversation content needed to generate a response is sent to a model provider. Your account information and billing data are never shared with AI model providers.

8. Data Retention

Data category	Retention	Rationale
Account information	Active subscription + 90 days	Service delivery and post-termination export window
Data on your server (prompts, conversations, files, KB content)	Held by you on your server; archived 90 days after termination, then destroyed	It is your data on your server
Portal-native agent conversations (Section 3.7)	Removed when the tenant is purged, at the latest after the 90-day archive	Deleted with the account on purge
Health metrics and usage accounting	Active subscription + 90 days	Operations and troubleshooting; no content
Billing records	7 years from the transaction	Dutch tax law (Algemene Wet inzake Rijksbelastingen)
Personal data after purge	Permanently deleted	PII scrubbed on purge after the 90-day archive; only minimized billing records remain

After termination, your data is archived for 90 days, during which you may request an export. After that period, personal data is permanently deleted, except billing records retained for the legally required period with identifiers minimized.

Our retention policy for the administrative and security logs described in section 3.9 is 90 days. We are implementing the automatic deletion that enforces it; until that is in place these logs are held longer, and we would rather say so than imply a deletion that does not yet happen.

9. Data Subject Rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)). Because most of your working data lives on your own server, you can also export or delete much of it directly.

To exercise any right, contact hello@boostgood.eco. We respond within 30 days, extendable by up to 60 days for complex requests, in which case we tell you within the first 30 days. We may verify your identity before acting, to protect your data against unauthorized access.

Today these requests are handled by our team by hand rather than by a button in the portal. Write to hello@boostgood.eco and we will confirm receipt, verify your identity, and act within 30 days. We are building self-service export and deletion into the portal and will say so here when it ships.

10. Right to Lodge a Complaint

If you believe our processing violates the GDPR, you may complain to a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in your country of residence.

11. Security

Each customer runs on a dedicated, network-isolated server. Data is encrypted in transit and at rest. Passwords are stored hashed. Access to your running system is controlled as described in Section 4. We keep audit logs of administrative actions and follow a documented incident-response process.

12. Changes to this Policy

We may update this policy as the Service evolves, in particular to remove the beta caveats in Sections 3.7 and 4.3 once the underlying changes ship. Material changes will be notified by email or in the portal, and the version and effective date above will be updated.

Version 2.1 corrects the list of sub-processors and hosting providers to match the systems actually in use, states which AI providers are switched off, and adds the sections on administrative logs, cookies and website analytics that version 2.0 omitted.

Version 2.2 corrects Section 7. Version 2.1 said that Kimi, Qwen and fal.ai could not be selected on accounts created from 10 August 2026 and that such requests were refused before reaching the provider. That restriction was reversed on 11 August 2026: every model in our catalogue is available to every account, because which models you use is your decision, not ours. Version 2.2 also stops implying that Anthropic and OpenAI hold EU-U.S. Data Privacy Framework certifications; we checked the participant list and they do not, so those transfers rest on Standard Contractual Clauses. No sub-processor was removed from this policy.

Version 2.3 corrects one sentence in Section 7.2 published earlier the same day. It said fal.ai had no data processing agreement. fal.ai does publish one, incorporated by reference into its terms of service; what we have not confirmed is the transfer safeguard that addendum provides, which is what 2.3 now says.

Version 2.4 records three things established on 11 August 2026: fal.ai's addendum was read and puts Standard Contractual Clauses in place; training was switched off and retention set to 30 days on our Mistral account; and our OpenAI contract is with OpenAI Ireland Ltd., which moves data on to the United States under the same clauses.

Version 2.5 discloses that the BoostGood portal, account, billing and log data are hosted in Singapore by Contabo, and states the safeguard for that transfer: Standard Contractual Clauses concluded through Contabo's customer portal on 19 August 2026.

13. Contact

Questions about this policy or your data: hello@boostgood.eco.