Privacy Policy

Boostt ("we," "us," or "our") operates the Boostt platform accessible at boostt.org (the "Platform"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding that data.

By using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide Directly

• Account information: Name, email address, password (for email signups), and acceptance of terms and conditions.
• Profile information: Display name, biography, profile picture, city, country, and professional details (occupation, specializations, services offered).
• Content you create: Service listings, portfolio items, uploaded images and videos, descriptions, pricing, and availability schedules.
• Communications: Messages you send to other users through the Platform, proposal and quote content, and any correspondence with us.
• Business information: Business name, address, tax identification numbers, and bank account details (collected via Stripe for payouts).

1.2 Information from Third-Party Services

When you connect a third-party account, we collect data from that service as described below:

1.3 Information Collected Automatically

• Location data (IP-based): When you sign up or use the Platform, we use your IP address to detect your approximate location (city, country, timezone) via the ipapi.co service. This data is stored in your account to personalize your experience.
• Location data (GPS, opt-in): With your explicit permission, we may request precise GPS coordinates from your browser to show you nearby creators and services. You can deny or revoke this permission at any time through your browser settings.
• Location coordinates stored: We store detected latitude and longitude (from IP geolocation) and, where applicable, coordinates for places you create (e.g., business locations, service areas). Garmin activity data includes GPS track files and start coordinates.
• Usage data: Pages visited, search queries, location searches (city, category, source), and interactions with the Platform.
• Cookies and session data: We use only strictly necessary cookies: a server-side session cookie for admin features and a temporary CSRF cookie during social login. We do not use tracking, analytics, or advertising cookies. The main application uses browser localStorage with secure authentication tokens (JWT) for login verification. For full details, see our Cookie Policy.

1.4 Identity Verification

For certain features (e.g., receiving payouts), we may require identity verification through our partner Sumsub. This process may collect government-issued ID documents, facial images, and address verification. Sumsub processes this data under their own privacy policy and shares verification results with us.

1.5 Email Verification

When you sign up with email, we verify your email address using the Emailable service to check for deliverability and prevent fraudulent signups. Only your email address is sent to Emailable for this check.

2. How We Use Your Information

We use your information for the following purposes:

• Provide the Platform: Create and maintain your account, display your public profile and portfolio, enable service listings, facilitate communication between users, and process bookings.
• Process payments: Facilitate transactions between buyers and sellers, manage payouts to service providers, calculate applicable taxes, and maintain transaction records.
• Personalize your experience: Show relevant creators, services, and opportunities based on your location, interests, and professional category.
• Communicate with you: Send transactional emails (order confirmations, quote updates, message notifications, payment receipts), and optional marketing communications (which you can opt out of).
• Display social proof: Show follower counts, engagement metrics, and content from your connected social accounts on your public profile to build trust in the marketplace.
• Ensure safety and compliance: Verify user identities, prevent fraud, enforce our terms of service, and comply with legal obligations.
• Improve the Platform: Analyze usage patterns, monitor location search demand, and develop new features.

We do not sell your personal information to third parties. We do not share your data for targeted advertising across other websites or apps.

3. How We Share Your Information

We share your information only in the following circumstances:

• With other users: Your public profile, portfolio, service listings, and messages are visible to other users as part of the Platform's marketplace functionality.
• Service providers: We use third-party services to operate the Platform:
  • Stripe — payment processing, payouts, and tax compliance
  • Amazon Web Services (AWS) — cloud hosting, file storage (S3), and email delivery (SES)
  • Sumsub — identity verification (KYC)
  • OpenFreeMap / Photon / Nominatim — map rendering and geocoding (self-hosted)
  • ipapi.co — IP-based geolocation
  • Emailable — email address verification
• Social platform APIs: When you connect TikTok, Instagram, or Garmin, data flows between the Platform and these services as described in Section 1.2. We do not share your data with these services beyond what is necessary for the integration you authorized.
• Legal requirements: We may disclose your information if required by law, court order, or government request, or to protect the rights, safety, or property of Boostt, our users, or the public.

3.1 Data Controller

Boostt is the data controller — the entity that determines how and why your personal data is processed. We are located in the United States. For contact details, see Section 13.

3.2 Data Processors

The following service providers process personal data on our behalf. We only share the minimum data necessary for each provider to perform its function:

3.3 Government and Law Enforcement Requests

We have not shared user data with government authorities in response to national security requests. If we ever receive such requests, we have the following safeguards in place:

• We review the legality of every request before responding.
• We challenge requests that we believe are unlawful or overly broad.
• We disclose only the minimum information necessary to comply.
• We document all requests, our responses, and the legal reasoning involved.

4. Location Data

Location is central to the Platform's marketplace. Here is exactly how we handle it:

What we collect and store

• IP-based detection (automatic): During signup and certain interactions, we send your IP address to ipapi.co to determine your approximate city, country, country code, timezone, and coordinates. The resulting city, country, coordinates, and timezone are stored in your account.
• Browser GPS (opt-in): If you grant permission, we request precise coordinates from your browser to show nearby results. These coordinates are used for the current session and are not permanently stored in your user profile beyond the detected location fields.
• Places you create: If you pin a business location or service area on the map, those coordinates are stored as part of your place listing.
• Garmin activity locations: If you connect Garmin, activity start coordinates and full GPS track files (GPX) are stored to display route maps.

How we use location data

• Display your profile on the map for potential clients to find you
• Show you creators, services, and opportunities near your location
• Log location search patterns to understand demand (anonymized)
• Display activity routes on maps (Garmin users)

Your controls

• You can deny browser location permission — we will fall back to IP-based detection
• You can change your displayed location at any time in your profile
• You can disconnect Garmin to stop syncing activity location data

5. Social and Fitness Account Data

When you connect a social or fitness account (TikTok, Instagram, or Garmin), the following applies:

• We only request the permissions (scopes) listed in Section 1.2 and only collect data within those scopes.
• The login credentials for each connection (access tokens) are stored securely on our servers to keep the connection active. These credentials are deleted when you disconnect the account.
• You can disconnect any connected account at any time from your profile settings. Disconnecting removes the access tokens and stops further data syncing.
• When you disconnect, your synced social data (profile information, videos, posts, activities) is deleted from our servers. However, data related to active or completed service contracts, orders, payment records, and other information required by law or existing agreements with other users will be retained as described in Section 6.
• We do not post to, modify, or delete content on your connected accounts without your explicit action.
• Data obtained from TikTok is used solely for the purpose of providing and supporting the Platform as described in this policy. We do not sell TikTok user data or use it for targeted advertising across other websites or apps.

Deauthorization Handling

• TikTok: When you disconnect TikTok or revoke access from TikTok's settings, we receive a notification. We immediately delete your stored connection credentials, stop all further data syncing, and delete your synced TikTok profile data and videos. Data tied to active or completed service contracts, orders, or legal obligations is retained.
• Instagram (Meta): We support Meta's automated deauthorization and data deletion processes. When you remove Boostt from your Instagram settings, we automatically delete your connection credentials, stop data collection, and delete your synced Instagram profile data and posts. You can also request automated deletion through Meta, and we will return a confirmation code and status URL. Data tied to active or completed service contracts, orders, or legal obligations is retained.
• Garmin: When you disconnect Garmin from your profile settings, we formally end the connection with Garmin, delete your stored credentials, stop all data syncing, and delete your synced activity data (including GPS tracks and health metrics). Data tied to active or completed service contracts, orders, or legal obligations is retained.

6. Data Retention

• Account data is retained for as long as your account is active.
• If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., financial transaction records).
• Synced social media content (videos, posts, profile data) is deleted when you disconnect the associated account or delete your account.
• Legal retention exceptions: Even after disconnecting a social account or deleting your account, we may retain data that is part of active or completed service contracts, order records, payment receipts, invoices, dispute records, or messages related to transactions. This data is retained because it is subject to our Terms of Service, Stripe's terms, and applicable tax and financial regulations.
• Payment and transaction records may be retained for up to 7 years to comply with tax and financial regulations.
• Uploaded files (images, videos, documents) stored on AWS S3 are deleted when the associated record is deleted.
• Garmin health and fitness data: Activity data, heart rate, GPS tracks, and other fitness metrics are retained only for as long as necessary to provide the Platform's services. When you disconnect Garmin and request deletion, or when you delete your account, all Garmin-related data is removed within 30 days.

6.1 Health and Fitness Data

We recognize that health and fitness data collected through Garmin (including heart rate, calories, activity duration, GPS tracks, and elevation data) is sensitive personal information that requires heightened protection. We apply the following additional safeguards to this data:

• Health and fitness data is only collected with your explicit consent when you connect your Garmin account.
• This data is used solely to display your activities, route maps, and fitness metrics on your profile and service listings.
• We do not share health and fitness data with third parties for advertising, marketing, or profiling purposes.
• We do not use health and fitness data for insurance, employment, or credit eligibility determinations.
• Access to health and fitness data on our servers is restricted to essential Platform operations only.

6.2 Artificial Intelligence Transparency

We do not use data obtained from Garmin Connect (including health, fitness, and activity data) to train artificial intelligence or machine learning models. If we ever introduce AI/ML features that process Garmin-sourced data, we will update this policy and obtain your explicit consent before doing so.

Data from TikTok and Instagram is not used to train AI/ML models. Social media data is used solely for display and portfolio purposes as described in this policy.

7. Data Security

• All data is transmitted over HTTPS (TLS encryption).
• Authentication uses secure tokens with revocation support.
• Login credentials for connected services (TikTok, Instagram, Garmin) are stored on our servers and never exposed to your browser.
• Payment data is processed by Stripe and never stored on our servers — we only store Stripe customer and transaction IDs.
• Identity verification documents are processed by Sumsub and not stored on our servers.
• Files are stored on AWS S3 with access controls.
• Passwords (for email signups) are hashed and never stored in plain text.

8. Your Rights and Choices

You also have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate information via your profile settings or by contacting us.
• Disconnect accounts: Remove any connected third-party account (TikTok, Instagram, Garmin) from your profile settings at any time. Disconnecting deletes your synced data from our servers.
• Opt out of emails: Unsubscribe from promotional emails using the link in any email, or disable notifications in your account settings. Transactional emails (order confirmations, security alerts) cannot be opted out of.
• Location controls: Deny or revoke browser location permission, change your displayed location, or disconnect fitness accounts to stop location data syncing.
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

For Meta (Instagram) Users

You can delete your Instagram-related data by disconnecting your Instagram account in your profile settings or by contacting phaethon@boostt.org. When you disconnect, your Instagram profile data and synced posts are deleted from our servers. We also support Meta's automated data deletion callback and deauthorization callback for processing requests initiated from Instagram's settings. Data tied to service contracts, orders, or legal obligations is retained as described in Section 6.

For TikTok Users

You can delete your TikTok-related data by disconnecting your TikTok account in your profile settings or by contacting phaethon@boostt.org. When you disconnect, your TikTok profile data and synced videos are deleted from our servers. We also support TikTok's deauthorization webhook for processing requests initiated from TikTok's settings. Data tied to service contracts, orders, or legal obligations is retained as described in Section 6.

For Garmin Users

You can delete your Garmin-related data (including activity data, GPS tracks, heart rate, and other fitness metrics) by disconnecting your Garmin account in your profile settings or by contacting phaethon@boostt.org. When you disconnect, we end the connection with Garmin and delete all synced activity data from our servers. Data tied to service contracts, orders, or legal obligations is retained as described in Section 6.

9. International Data Transfers

Your data is stored on servers in the United States (AWS). If you are located outside the United States, your data will be transferred to and processed in the United States. By using the Platform, you consent to this transfer. We ensure that our service providers maintain appropriate data protection safeguards.

10. Children's Privacy

The Platform is not intended for children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If we learn that we have collected data from a child under the applicable age, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at phaethon@boostt.org.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or services (e.g., TikTok profiles, Instagram pages, Stripe payment pages). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, by sending you an email notification. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

We retain prior versions of this Privacy Policy and will provide them upon request. To request a previous version, contact us at phaethon@boostt.org.

13. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, contact us at: