Privacy Policy (GDPR)
1. Data controller
The data controller of personal data is BOOSTERS s. r. o., registered office at Krčulova 2, 977 01 Brezno, Slovak Republic, Company ID: 45993670, Tax ID: 2023175935, VAT ID: SK2023175935, registered with the Commercial Register of the City Court Banská Bystrica (the "Controller"). Data-protection contact: info@boosters.sk.
2. Purpose and scope of processing
The Controller processes personal data solely to provide the Feedaro Service, manage user accounts, fulfill legal obligations and protect its legitimate interests (in particular security and abuse prevention). We do not process data for advertising purposes, do not share it with third parties for marketing purposes and never sell it.
3. Categories of processed data
(a) Identification and contact data: email, name (optional), team role. (b) Authentication data: password stored as a salted scrypt hash (never in plaintext), optional TOTP secret for two-factor authentication. (c) Operational data: sessions, IP address, user agent, audit log of security-relevant actions (login, password change, account deletion, etc.). (d) Service usage data: metadata about your projects, feeds and templates necessary for the Service to function. (e) Product feed data you connect to the Service — processed technically for enrichment and distribution to advertising systems.
4. Legal basis
Performance of contract under Art. 6(1)(b) GDPR — necessary for account management and Service operation. Legitimate interest under Art. 6(1)(f) GDPR — security logging, fraud and abuse prevention. Legal obligation under Art. 6(1)(c) GDPR — accounting, VAT and archiving obligations. Consent under Art. 6(1)(a) GDPR — for optional features (e.g. sending newsletters, which we currently do not send).
5. Retention period
Account data is retained for the duration of the Contract. After account deletion the record is marked for deletion (soft-delete) and automatically and irreversibly erased by a cron job after 30 days (hard-delete). Audit log entries are retained for max. 12 months. Data required for accounting and VAT is retained for the periods required by law (10 years). Product feed data is retained while the feed exists in your workspace.
6. Recipients and sub-processors
Data is stored on the Controller's servers hosted by Hetzner Online GmbH (Germany, European Union). Transactional emails (confirmations, password reset, alerts) are delivered by Resend, Inc. (USA — covered by the EU-U.S. Data Privacy Framework). If you explicitly activate AI text enrichment, feed content is processed by Anthropic PBC (USA — processor with appropriate safeguards under GDPR). We never sell data and never share it for marketing purposes.
7. International transfers
Some processors are located outside the EU (USA). Transfers are legally secured through the European Commission's Standard Contractual Clauses (SCC) and/or the processor's participation in the EU-U.S. Data Privacy Framework. Documentation is available on request.
8. Your rights as a data subject
Under GDPR you have the right to: (a) access your personal data (Art. 15), (b) rectify inaccurate data (Art. 16), (c) erasure (right to be forgotten, Art. 17), (d) restrict processing (Art. 18), (e) data portability (Art. 20), (f) object to processing based on legitimate interest (Art. 21), (g) withdraw consent where consent is the legal basis (Art. 7(3)). Exercise your rights by emailing info@boosters.sk; we will reply within 30 days. You also have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk) or your national supervisory authority.
9. Security of processing
The Controller has implemented appropriate technical and organizational measures: TLS/HTTPS for all communication, salted scrypt hashing of passwords, tenant-level data isolation, security monitoring and audit log, regular backups (14 daily + 12 weekly), optional two-factor authentication. In the event of a personal data breach that poses a risk to data subjects, the Controller will notify the competent supervisory authority within 72 hours in accordance with Art. 33 GDPR.
10. Automated decision-making and profiling
The Controller does not carry out automated individual decision-making with legal effects or profiling within the meaning of Art. 22 GDPR.
11. Cookies
The Service uses only essential cookies (session cookie and active project cookie) which do not require consent under the ePrivacy Directive. Details are available in the Cookie Policy.
12. Changes to this document
This document may be updated in response to changes in law or Service functionality. Material changes will be communicated at least 14 days in advance via email or an in-app notice. Historical versions are available on request.
13. Contact
Please send data-protection inquiries to info@boosters.sk. Controller's address: BOOSTERS s. r. o., Krčulova 2, 977 01 Brezno, Slovak Republic.