BoostGood Privacy Policy

Version: 2.7
Effective date: 10 October 2026
Last updated: 10 October 2026

This Privacy Policy explains how Except Integrated Sustainability BV ("BoostGood," "we," "us," or "our") handles personal data when you use the BoostGood platform ("Service"). It is provided under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), in particular Articles 13 and 14.

---

1. Data Controller

The data controller for the processing described here is:

Except Integrated Sustainability BV
Registered in the Netherlands
Contact: hello@boostgood.eco
Website: boostgood.eco

For questions or requests about your personal data, contact us at hello@boostgood.eco.

2. Two data planes: what this means for your privacy

BoostGood is built so that your working data stays with you. Understanding the architecture is the clearest way to understand this policy, so we describe it in plain terms.

2.1. Your dedicated server (your data)

When you order BoostGood, we provision a dedicated virtual private server (VPS) that is yours. The applications you use day to day run on that server: the chat and AI tools, the file storage (Nextcloud), automation (n8n), the knowledge base, and their databases. Everything those applications hold lives on your server:

• Your prompts, queries, and AI conversations
• Files and documents you upload
• Knowledge-base document content
• Anything your users create inside those applications

BoostGood does not collect, process, or store this data, and keeps no copy of it, in backups or otherwise (Section 2.3). It does not pass through our central systems in the ordinary course of using the Service. Two exceptions are honest and worth stating: (a) when you send a query to a third-party AI model, the query text is transmitted to that model provider to generate a response (Section 6); and (b) during beta we retain a technical access path to your server for provisioning and support, described in Section 3.3.

2.2. The BoostGood portal (data we do hold)

Separately from the applications on your server, the BoostGood portal is the account and control surface we operate centrally. To run it, we hold a limited set of data at our end. This is listed in full in Section 3.

The portal, your account and billing records, and our central database run on a server located in Singapore, operated by Contabo GmbH. Because Singapore is outside the European Economic Area, we describe this transfer and its safeguard in Section 7.

2.3. Backups

Backups of your server are your choice, made in the portal: on your own server (the default), in S3-compatible storage that you own, or no backup. A scheduled job on your server encrypts them (restic, AES-256), writes them straight to the place you chose, and removes old ones according to the schedule shown in the portal. BoostGood keeps no copy of your backups, on its central systems or in its own backups. Our platform derives the encryption key and writes it to your server so the job can run. If you use your own storage, the access details you enter are stored encrypted in our database only to set up your server, and are deleted when you choose another option. If you choose no backup, nothing is backed up, and data that is lost or deleted on your server cannot be recovered.

We back up our own platform separately. Every night the portal database and the services on our central server are copied to local backups on that server in Singapore and to an encrypted offsite copy at Scaleway in Paris. These platform backups hold the data described in Section 3 that we keep at our end, including portal-native agent conversations (Section 3.7), technical records of your backups (time, size, status and snapshot identifiers, never their content) and the encrypted access details of your own backup storage. They are not backups of your server.

3. Personal Data We Hold

3.1. Account and order information

• Full name
• Email address
• Telephone number, where you give one
• Organization or company name
• VAT number and VAT country, for business orders
• Postal address: street, city, postal code and country
• Account credentials (passwords stored in hashed form only)
• Role within the organization (for example administrator or user)

The VAT number you enter is checked against VIES, the European Commission's public VAT register, so that we charge the right tax. VIES returns the registered name and address held against that number.

3.2. Billing and payment information

• Order details and plan selection
• Payment method details (processed and stored by Stripe; we do not store full card numbers)
• Invoices and payment records

3.3. Platform health metrics (no content)

To keep your server running and to alert you before something breaks, we collect operational metrics: CPU load, memory use, disk use, uptime, service and container status, and error events. These metrics contain no prompts, no conversations, and no file content. They describe the health of the machine, not what you do on it.

3.4. Usage and credit accounting (no message content)

• Login timestamps and session activity
• AI credit consumption: which model was used, token counts, and credits charged
• Feature usage at the level of counts and events

Credit accounting records the fact and size of a request so we can meter it. It does not store the text of your messages.

3.5. Support communications

Support tickets, emails, and messages you send us, and our replies.

3.6. Knowledge-base metadata (not content)

For knowledge-base documents managed through the portal, we hold metadata only: file name, size, owner, and processing status. The document content itself lives on your server, not ours.

3.7. Portal-native agent conversations

3.8. Technical data

• IP address
• Browser type and version
• Operating system and device type

When you visit boostgood.eco, the portal or our API, the web server on our central host writes one line per request to an access log. Each line holds the full IP address (we do not shorten or anonymise it), the date and time, the address requested including any parameters in it, the response status and size, the page you came from, and your browser's identification string. We use these logs to keep the service running, to find and block abuse, and to investigate security incidents (legitimate interest, Section 5). We do not use them for analytics, profiling or advertising. They are deleted automatically after about two weeks (Section 8). They can be read only by BoostGood administrators with administrative access to the central host and by the automated tools we run there.

The operating system of the central host also records the IP addresses of SSH sign-in attempts and blocked network connections in its own logs. These are kept for between a few days and about five weeks (Section 8).

3.9. Administrative and security logs

We keep a log of administrative and security-relevant actions in the portal: who did what, when, from which IP address, with which browser, and whether the action succeeded or was refused. We use this to investigate security incidents and to reconstruct what happened when something goes wrong. These logs contain email addresses and IP addresses. They do not contain the content of your conversations or your files.

3.10. Website visits and cookies

The boostgood.eco website sets only the cookies needed to make it work, such as the one that keeps you signed in and the one that remembers your language. We do not use advertising or tracking cookies.

We do not run any website analytics tool.

The typefaces on the website are served from our own server; your browser does not request them from Google.

4. Access model: customer-controlled access

BoostGood is designed so that entering your running system is something you control, not something we do at will.

4.1. What we can do without entering your system

Two actions are unilateral, and both happen at the infrastructure level without logging into your system or reading its contents:

• Suspend your access, for non-payment or at your request. This is a status change on our side; your data is untouched.
• Delete your server, for non-payment after notice, a legal requirement, or your request. Deletion destroys the server through our hosting provider's controls. We do not read its contents to delete it.

4.2. Support access is granted by you, and is time-limited

When you want us to look at your system to help with a problem, you switch on a support session from your portal settings. This generates a time-limited token (24 hours by default, up to 7 days) that authorizes support actions on your server. You can end the session at any time, which revokes the token immediately. Without an active session that you enabled, support-level actions on your server are refused.

4.3. Beta caveat on retained access

5. Purposes and Legal Bases

Purpose	Data used	Legal basis (GDPR Art. 6(1))
Providing and operating the Service and your server	Account info, health metrics, usage data	Contract (b)
Authentication and account management	Account info, technical data	Contract (b)
Billing and payment processing	Billing and order info	Contract (b) / Legal obligation (c)
Sending agent requests to the provider of the model that handles them, chosen by you or set as the default	Prompt, conversation context, retrieved knowledge excerpts	Contract (b)
Keeping the platform healthy, secure, and fixing bugs	Health metrics, technical data, error events	Legitimate interest (f)
Providing support when you request it	Support communications; system access only during a session you grant	Contract (b)
Communicating with you about the Service	Account info (name, email)	Legitimate interest (f) / Contract (b)
Complying with legal obligations	Billing info, account info	Legal obligation (c)
Marketing communications, where you opt in	Name, email	Consent (a)

Where processing relies on legitimate interest, we balance it against your rights and do not use it to override them. Where it relies on consent, you may withdraw consent at any time by contacting hello@boostgood.eco, without affecting processing carried out before withdrawal.

6. Sub-Processors

We use the following third parties to deliver the Service. Each processes data only for the purpose shown. AI model providers receive the prompt, the conversation context and any retrieved knowledge excerpts whenever their model handles a request, as set out in Section 7.4; they do not receive your account or billing data.

Sub-Processor	Purpose	Data processed	Location	Status
Contabo GmbH	Control-plane hosting: the BoostGood admin panel, the LLM gateway, the PostgreSQL database and the boostgood.eco Wagtail website all run on a single Contabo server whose data centre is in Singapore	Every category of platform-side personal data: portal account name, email and hashed credentials; order and billing identity (name, email, phone, postal address, VAT number); billing-contact details; administrative and security logs including IP addresses; transactional email delivery log; agent chat message content; usage records	Singapore (Contabo data centre). Contracting entity per Contabo's published Terms and Conditions is Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany (AG Munich HRB 180722). The network operator of the Singapore host is Contabo Asia Private Limited (AS141995).	In use
Infomaniak Network SA	Tenant VPS hosting (OpenStack), domain registration and DNS	The tenant's entire dedicated server, including all application data on it; domain registrant contact details	Switzerland	In use
Stripe Payments Europe Ltd. / Stripe Inc.	Payment processing and subscription billing	Name, email, billing address, VAT number, payment method tokens, transaction records	Ireland (EU) / United States	In use
Scaleway SAS	Transactional email delivery for the BoostGood portal; encrypted offsite storage of BoostGood's platform backups (Object Storage, Paris)	Recipient email address, subject and body of transactional email; the platform backups, encrypted (Section 2.3)	France (EU)	In use
Amazon Web Services (SES)	Outbound email sending from a tenant's own provisioned platform	Recipient email addresses and email content generated by the tenant's platform	Ireland (EU) unless configured otherwise, with US parent	In use
Anthropic PBC	AI model inference (Claude)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	United States	In use
OpenAI Ireland Ltd. / OpenAI LLC	AI model inference (GPT, image models)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates and, for its image models, the image prompt	Ireland (EU) / United States	In use
Google LLC (Gemini API)	AI model inference (Gemini)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	United States and global	In use
Mistral AI SAS	AI model inference (Mistral)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	France (EU)	In use
Alibaba Cloud (DashScope, Qwen models)	AI model inference (Qwen)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	Singapore (dashscope-intl endpoint)	In use
Moonshot AI Pte. Ltd. (Kimi models)	AI model inference (Kimi)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	Singapore	In use
DeepSeek	AI model inference (DeepSeek)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	China	In use
fal.ai	AI image generation (FLUX and other image models)	Image prompt text, and any source image submitted for image-to-image generation, sent whenever its model handles a request (chosen by the customer or set as the default)	United States	In use
European Commission (VIES)	Validating a VAT number entered on the order form	VAT number and country code; the service returns the registered name and address	European Union	In use

We are putting written data processing agreements in place with each sub-processor under Article 28 GDPR. Where an agreement is not yet signed we say so rather than imply otherwise, and we update this page as each one is completed.

7. International Data Transfers

7.1. Singapore (BoostGood portal and database, Contabo)

The BoostGood portal, your account and billing records, our administrative and security logs, and our central database run on a server operated by Contabo GmbH (Welfenstrasse 22, 81541 Munich, Germany) whose data centre is in Singapore. Your account information is therefore processed in Singapore. The European Commission has not issued an adequacy decision for Singapore, so this transfer requires a safeguard under Chapter V of the GDPR.

Contabo offers, through its customer portal, an agreement on data processing supplemented by the European Commission's Standard Contractual Clauses for server locations outside the EU. We have concluded that agreement, so this transfer is covered by the Standard Contractual Clauses adopted by the European Commission.

7.2. Switzerland (Infomaniak)

Your dedicated server is hosted in Geneva, Switzerland. The European Commission has decided that Switzerland provides an adequate level of data protection, so no additional safeguard is required for this transfer.

7.3. United States (Stripe, Amazon Web Services)

Protected by the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise by Standard Contractual Clauses adopted by the European Commission. We checked the Data Privacy Framework participant list on 11 August 2026: Stripe and Amazon are certified. AI model providers in the United States are covered in Section 7.4, in the same form as every other AI model provider.

7.4. AI model providers

When an agent answers, the prompt, the conversation context (earlier messages, the agent's instructions and any memories it recalls) and any retrieved knowledge excerpts are sent to the provider of the model that handles the request. This holds for every model, whether chosen by you or set as the default. The same applies when an AI feature of an installed app, such as BGTrack or a coding agent, sends a request through our gateway.

Each agent runs on the default model of its agent type until you select another model for it. On 10 October 2026 the default is DeepSeek V4 Flash (DeepSeek) for most agent types, Gemini 2.5 Flash (Google) for the Homepage Developer and FLUX Schnell (fal.ai) for the Image Generator. You can change the model of each agent in your portal. If the provider of an agent's model does not answer, the request can be passed to a failover model of another provider in the table below, and the same data is then sent to that provider. The Setup Assistant, which guides a new account through setup, runs on models we set and does not follow the agent model setting: on 10 October 2026 Claude Sonnet 5 (Anthropic), with Mistral AI and then DeepSeek as failover.

The table lists every provider in our model catalogue on 10 October 2026, in the same form for each: what is sent, where the provider processes it, and the transfer mechanism with its status. Each model has its own terms, set by its provider; the model list in your portal (Settings, AI Models) links them and shows, for every provider, whether its terms allow training on what is sent.

Provider	What is sent	Processing location	Transfer mechanism and status
Anthropic PBC	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	United States	Standard Contractual Clauses, in the provider's standard API terms. Status: in place (read 11 August 2026).
OpenAI Ireland Ltd. / OpenAI LLC	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates and, for its image models, the image prompt	Ireland (EU) / United States	Standard Contractual Clauses, in the provider's standard API terms. Status: in place (read 11 August 2026).
Google LLC (Gemini API)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	United States and global	EU-U.S. Data Privacy Framework, Google LLC certified. Status: in place (participant list checked 11 August 2026).
Mistral AI SAS	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	France (EU)	None needed: processing within the EEA. Status: not applicable.
Alibaba Cloud (DashScope, Qwen models)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	Singapore (dashscope-intl endpoint)	Standard Contractual Clauses and a transfer impact assessment. Status: not yet concluded.
Moonshot AI Pte. Ltd. (Kimi models)	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	Singapore	Standard Contractual Clauses and a transfer impact assessment. Status: not yet concluded.
DeepSeek	Prompt, conversation context and retrieved knowledge excerpts, sent whenever its model handles a request (chosen by the customer, set as the default, or as failover). The provider also processes the response its model generates	China	Standard Contractual Clauses and a transfer impact assessment. Status: not yet concluded.
fal.ai	Image prompt text, and any source image submitted for image-to-image generation, sent whenever its model handles a request (chosen by the customer or set as the default)	United States	Standard Contractual Clauses, Module 2 (controller to processor), in the provider's data processing addendum. Status: in place (read 11 August 2026).

Retention and training settings can differ per account. On our Mistral account we switched training off and set retention to 30 days on 11 August 2026; these are account settings rather than contract terms, so we re-check them whenever we review this policy.

7.5. Data minimization for AI providers

What is sent to a model provider is what its model needs to answer: the prompt, the conversation context and any retrieved knowledge excerpts (Section 7.4). Your account information and billing data are never shared with AI model providers.

8. Data Retention

Data category	Retention	Rationale
Account information	Active subscription + 90 days	Service delivery and post-termination export window
Data on your server (prompts, conversations, files, KB content)	Held by you on your server; archived 90 days after termination, then destroyed	It is your data on your server
Backups of your server (if you chose a backup)	Kept on your server or in your own storage, per the schedule shown in the portal; BoostGood holds no copy	Recovery of your server (Section 2.3)
BoostGood platform backups	Local copies 28 days; the offsite copy keeps 7 daily, 4 weekly and 3 monthly snapshots, so up to about 3 months	Recovery of the portal (Section 2.3); data deleted from the portal remains in these backups until they expire
Portal-native agent conversations (Section 3.7)	Removed when the tenant is purged, at the latest after the 90-day archive	Deleted with the account on purge
Health metrics and usage accounting	Active subscription + 90 days	Operations and troubleshooting; no content
Administrative and security logs (Section 3.9), including the transactional email delivery log	90 days, then deleted automatically (the deletion runs every day)	Investigating security incidents and faults
IP address and browser string stored on AI usage records	Removed after 90 days; the usage record itself (tokens, credits, cost) is kept for 7 years	The tax retention duty covers the usage figures, not the caller's address
Web server access logs (Section 3.8)	About two weeks: one file per day; the last 14 daily files plus the current day are kept, older ones are deleted	Operations and handling of abuse
Operating-system logs of the central host: SSH sign-in attempts and firewall events (IP addresses)	Between about 5 days (system journal, limited by size, currently about five days) and about 5 weeks (weekly rotated text logs, 4 previous weeks kept)	Security
Billing records	7 years from the transaction	Dutch tax law (Algemene Wet inzake Rijksbelastingen)
Personal data after purge	Permanently deleted	PII scrubbed on purge after the 90-day archive; only minimized billing records remain

After termination, your data is archived for 90 days, during which you may request an export. After that period, personal data is permanently deleted, except billing records retained for the legally required period with identifiers minimized.

The deletion of the administrative and security logs runs automatically every day. Backups of the central database contain these logs as they were on the day of the backup, so a log entry deleted after 90 days stays in those backups until they are replaced: 28 days for the copies kept on the central host itself and up to about three months for the encrypted offsite copy (7 daily, 4 weekly and 3 monthly snapshots).

9. Data Subject Rights

Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)). Because most of your working data lives on your own server, you can also export or delete much of it directly.

To exercise any right, contact hello@boostgood.eco. We respond within 30 days, extendable by up to 60 days for complex requests, in which case we tell you within the first 30 days. We may verify your identity before acting, to protect your data against unauthorized access.

Today these requests are handled by our team by hand rather than by a button in the portal. Write to hello@boostgood.eco and we will confirm receipt, verify your identity, and act within 30 days. We are building self-service export and deletion into the portal and will say so here when it ships.

10. Right to Lodge a Complaint

If you believe our processing violates the GDPR, you may complain to a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in your country of residence.

11. Security

Each customer runs on a dedicated, network-isolated server. Data is encrypted in transit using TLS. Provider API keys, connector tokens, tenant gateway keys and server access keys are stored in our database as AES-256-GCM encrypted values; the platform holds the key. Backups of your server and the offsite copy of our platform backups are encrypted (restic, AES-256). We have not enabled disk or volume encryption on our central host or on tenant servers, the local copies of our platform backups are not encrypted, and the database connection inside the central host does not use TLS. Passwords are stored hashed. Access to your running system is controlled as described in Section 4. We keep audit logs of administrative actions and follow a documented incident-response process.

12. Changes to this Policy

We may update this policy as the Service evolves, in particular to remove the beta caveats in Sections 3.7 and 4.3 once the underlying changes ship. Material changes will be notified by email or in the portal, and the version and effective date above will be updated.

Version 2.1 corrects the list of sub-processors and hosting providers to match the systems actually in use, states which AI providers are switched off, and adds the sections on administrative logs, cookies and website analytics that version 2.0 omitted.

Version 2.2 corrects Section 7. Version 2.1 said that Kimi, Qwen and fal.ai could not be selected on accounts created from 10 August 2026 and that such requests were refused before reaching the provider. That restriction was reversed on 11 August 2026: every model in our catalogue is available to every account, because which models you use is your decision, not ours. Version 2.2 also stops implying that Anthropic and OpenAI hold EU-U.S. Data Privacy Framework certifications; we checked the participant list and they do not, so those transfers rest on Standard Contractual Clauses. No sub-processor was removed from this policy.

Version 2.3 corrects one sentence in Section 7.2 published earlier the same day. It said fal.ai had no data processing agreement. fal.ai does publish one, incorporated by reference into its terms of service; what we have not confirmed is the transfer safeguard that addendum provides, which is what 2.3 now says.

Version 2.4 records three things established on 11 August 2026: fal.ai's addendum was read and puts Standard Contractual Clauses in place; training was switched off and retention set to 30 days on our Mistral account; and our OpenAI contract is with OpenAI Ireland Ltd., which moves data on to the United States under the same clauses.

Version 2.5 discloses that the BoostGood portal, account, billing and log data are hosted in Singapore by Contabo, and states the safeguard for that transfer: Standard Contractual Clauses concluded through Contabo's customer portal on 19 August 2026.

Version 2.6 states where backups are kept. Backups of your server are kept on your server or in storage you own, and BoostGood no longer keeps a copy of them; before this version they were also written to our central backup system in Singapore, with an offsite copy at Scaleway in Paris. Version 2.6 also describes our own platform backups and how long data stays in them, and lists Scaleway's role in storing them. Version 2.6 also removes the website analytics tool (Plausible) and the web fonts service (Google Fonts) from Section 3.10 and from the list of sub-processors in Section 6: we switched the analytics tool off, and the typefaces are now served from our own server.

Version 2.7 states what is sent to AI model providers: when an agent answers, the prompt, the conversation context and any retrieved knowledge excerpts go to the provider of the model that handles the request, whether you chose that model or it is the default, and Section 7.4 names the defaults. Earlier versions said a provider received data only when you selected its model; agents run on a default model you do not have to pick, so that was not accurate. Section 7.4 now lists every AI model provider in the same form, in place of the sections that grouped providers by country.

On 10 October 2026 we corrected Section 8: the 90-day deletion of administrative and security logs, which this policy previously described as still being built, runs every day. We also added the web server access log to Section 3.8 and its retention to Section 8. The version number is unchanged.

On 10 October 2026 we removed the website analytics tool (Plausible) and the web fonts service (Google Fonts) from Section 3.10 and from the list of sub-processors in Section 6: we switched the analytics tool off, and the typefaces are now served from our own server. The version number is unchanged.

On 10 October 2026 we corrected Section 8: the 90-day deletion of administrative and security logs, which this policy previously described as still being built, runs every day. We also added the web server access log to Section 3.8 and its retention to Section 8. The version number is unchanged.

13. Contact

Questions about this policy or your data: hello@boostgood.eco.