Privacy Policy

1. Who we are

This Privacy Policy explains how SuperBoosting ("SuperBoosting", "we", "us" or "our") collects, uses, shares and protects your personal data when you use the SuperBoosting website and services (the "Service").

SuperBoosting is the data controller for the personal data described in this policy. We process personal data under the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD). You can contact us about privacy at any time through our Discord server (see Section 14).

2. Personal data we collect

We only collect the data we need to run the Service:

• Account data: display name, email address, password (stored only as a secure hash), account role, email-verification status, the date you accepted our Terms, and two-factor authentication settings (your authenticator secret, stored in our access-restricted database, and hashed backup codes).
• Booster application and profile data: peak rank, experience description, bio, main game modes, application status and review notes, ratings and completed-order statistics.
• Order data: the service you order (ranks, wins, placements or tournaments), game mode, platform, region, extras, price, the note you add for your booster, order status history, and the booster you requested or who claimed your order.
• Communications: messages and attachments sent in the order chat, reviews and ratings you leave, and messages you send us on Discord.
• Payment data: payment amount, currency, status, Stripe session and payment identifiers, refunds and tips. Your card details are entered directly with Stripe and never reach our servers.
• Payout data (boosters only): payout method and destination you provide, for example a PayPal email address or a crypto wallet address and network, plus payout amounts and status.
• Technical and usage data: session information needed to keep you logged in, IP address and browser information in server logs, and analytics data about how pages are used (see Section 8).

We do not ask for or store your game account password in our database. If you share game login details with your booster in the order chat, they are stored as chat messages, which only you, your booster and our administrators can see.

3. How we use your data and legal bases

• To create and secure your account, verify your email, provide 2FA and let you log in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To take, price, fulfil and support your orders, including order chat, status emails and assigning a booster. Legal basis: performance of a contract.
• To process payments, refunds, tips and booster payouts. Legal basis: performance of a contract and, for accounting and tax records, our legal obligations (Art. 6(1)(c) GDPR).
• To send transactional emails such as verification codes, receipts, password resets and order updates. Legal basis: performance of a contract.
• To review booster applications, show public booster profiles, leaderboards and reviews, and moderate content. Legal basis: performance of a contract and our legitimate interest in running a trusted marketplace (Art. 6(1)(f) GDPR).
• To prevent fraud, chargebacks and abuse, enforce our Terms and keep the Service secure. Legal basis: our legitimate interests and, where applicable, legal obligations.
• To notify our team about new paid orders and tips (internal alerts in our private Discord channel). Legal basis: our legitimate interest in handling orders quickly.
• To understand how the Service is used and improve it with analytics (Google Analytics). Legal basis: your consent, given through our cookie banner (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Information that is visible to others

• Your booster can see your display name, your order details, your note and your order chat. Your client can see the same about the booster assigned to their order.
• Booster public profiles show the booster's display name, peak rank, bio, main modes, ratings, completed orders and reviews.
• Reviews you leave are shown publicly with your display name. Our live activity feed and statistics show orders without your email address.

Your email address is never shown publicly or to other users.

5. Who we share data with

We share personal data only with service providers that help us run the Service, who process it on our instructions under data processing terms, and only as far as needed:

• Stripe (payments, refunds and fraud prevention). Stripe may act as an independent controller for some data under its own privacy policy.
• Resend (delivery of transactional emails).
• Our hosting and infrastructure provider (Emergent), which hosts the application and database.
• Google (Google Analytics, website usage statistics).
• Discord (our community and support server, and internal order alerts to our private team channel, which contain order details and the client's display name, never email addresses).
• Boosters, who are independent contractors, receive the order information they need to complete your order.

We may also disclose data if required by law, to respond to valid requests from public authorities, or to protect our rights, users or the public, for example in fraud investigations.

6. International transfers

Some of our providers, such as Stripe, Google, Resend and Discord, may process data outside the European Economic Area, including in the United States. When this happens, we rely on appropriate safeguards such as the EU–US Data Privacy Framework, where the provider is certified, or the European Commission's Standard Contractual Clauses.

7. How long we keep your data

• Account data: for as long as your account is active. If you ask us to delete your account, we delete or anonymise it within 30 days, except for data we must keep as described below.
• Order, payment, refund, tip and payout records: kept for the period required by Spanish tax and commercial law (generally up to 6 years).
• Order chat messages and reviews: kept while your account exists so order disputes can be resolved, then deleted or anonymised with your account.
• Verification codes, password-reset links and login challenges expire automatically within minutes and are deleted within 24 hours.
• Unverified sign-ups, where the email code was never entered, may be deleted at any time.
• Server logs and analytics data: kept for a limited period. For Google Analytics this is the retention period set in our Analytics account, at most 14 months.

8. Cookies and similar technologies

• Essential session cookie: a secure, HttpOnly cookie that keeps you logged in. Without it, the Service cannot work, so it does not require consent.
• Browser session storage: we temporarily store your price-calculator selection on your device so it is not lost when you log in. It contains no passwords or payment data and is cleared when you close the browser tab.
• Analytics cookies: only if you click Accept in our cookie banner, Google Analytics is loaded and sets cookies (such as _ga) to measure visits and page views in aggregate. If you reject or don't choose, Google Analytics is not loaded. You can change your choice at any time via "Cookie settings" in the footer, which also deletes the analytics cookies.

Full details, including cookie names and durations, are in our Cookie Policy at superboosting.gg/cookies.

9. How we protect your data

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, optional and, for staff and boosters, mandatory two-factor authentication, HttpOnly session cookies, access controls that limit order data to the client, the assigned booster and administrators, and card payments handled entirely by Stripe.

No online service can be 100% secure. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authority as required by the GDPR.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten"), subject to our legal retention duties;
• restrict or object to processing based on our legitimate interests;
• data portability, receiving the data you gave us in a structured, machine-readable format;
• withdraw your consent at any time, for example for analytics, without affecting processing that took place before.

To exercise your rights, contact us on Discord. We may ask you to confirm your identity, for example by writing from or verifying the email address on your account. We will reply within one month, which can be extended by two further months for complex requests.

You also have the right to lodge a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You can also contact the authority in your country of residence.

11. Children

The Service is intended for users aged 18 or over, or 16 and 17 with the consent of a parent or legal guardian, as set out in our Terms of Service. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.

12. Third-party sites and services

The Service links to third-party sites and services, such as Discord, Stripe Checkout and game publishers' websites. Their own privacy policies apply when you use them, and we are not responsible for their practices.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will show the date of the latest version at the top of this page and, for material changes, inform registered users by email or on the Service.