Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Data — name, email address, phone number, date of birth, profile photo
• Profile Data — business name, designation, bio, address, social media links, website URLs
• Section Content — products, services, testimonials, gallery images, FAQs, and other custom section data you add to your profile
• Financial Data — bank account details, UPI IDs (for display on your digital card only; we do not process payments through these)
• Authentication Data — passwords (stored as bcrypt hashes, never in plain text), OAuth tokens
• Support Data — messages, emails, and feedback you send to us

1.2 Information Collected Automatically

• Device Information — device type, operating system, device identifier, browser type
• Usage Data — pages visited, features used, time spent, click patterns
• Analytics Events — profile views, link clicks, QR code scans, template downloads
• Log Data — IP address, access timestamps, referring URLs
• Session Data — login sessions, device IDs, platform (web/android/ios)

1.3 Information from Third Parties

• Google OAuth — name, email, profile picture (when you sign in with Google)
• Razorpay — payment confirmation, subscription status (we do not store your card/bank details)

2. How We Use Your Information

We use the collected information for the following purposes:

• To create and manage your account, workspace, and profiles
• To display your public profile to visitors who access your profile link or QR code
• To process subscriptions and payments via Razorpay
• To provide template browsing, design creation, and download features
• To generate analytics and insights about your profile performance
• To send transactional communications (OTPs, password resets, subscription updates)
• To enforce our Terms of Service and prevent abuse
• To improve the Platform through aggregated, anonymized usage analysis
• To display advertisements (Google AdMob on mobile, AdSense on web) — see Section 5
• To comply with legal obligations and respond to lawful requests

3. Public Profile Data

When you publish a profile, certain information becomes publicly accessible to anyone with your profile link or QR code. This includes:

• Your profile name, business name, designation, bio, and photo
• Contact entries, social links, and bank/UPI details you choose to display
• Section content (products, services, gallery, etc.)
• Reviews and ratings left by visitors

You control what information appears on your public profile. You can unpublish your profile at any time to make it private.

4. Data Sharing & Disclosure

We do not sell your personal data. We share data only in the following circumstances:

• Service Providers — we share data with third-party services that help us operate the Platform (listed in Section 5)
• Legal Requirements — we may disclose data if required by law, regulation, legal process, or governmental request
• Safety & Fraud Prevention — to protect the rights, property, or safety of Boostify, our users, or the public
• Business Transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity
• With Your Consent — when you explicitly authorize sharing (e.g., publishing your profile)

5. Third-Party Services

We integrate with the following third-party services:

Each third-party service operates under its own privacy policy. We encourage you to review their policies: Google Privacy Policy, Razorpay Privacy Policy, Cloudflare Privacy Policy.

6. Cookies & Local Storage

We use the following client-side storage mechanisms:

• localStorage — to store authentication tokens, active account/profile selection, theme preference, and device ID
• Cookies — third-party cookies may be set by Google AdSense for ad personalization

You can clear local storage and cookies through your browser settings. Doing so will log you out and reset your preferences.

7. Data Storage & Security

• Your data is stored on secure servers hosted in data centers with appropriate physical and technical safeguards
• Passwords are hashed using bcrypt (12 rounds) and are never stored or transmitted in plain text
• Authentication uses short-lived JWT access tokens (15 minutes) and rotatable refresh tokens (30 days)
• File uploads are stored on Cloudflare R2 with access controls and presigned URLs
• OTPs expire after 5 minutes and are stored in Redis with automatic deletion
• We use HTTPS/TLS encryption for all data in transit

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

8. Data Retention

• Account data — retained as long as your account is active. Upon account deletion, personal data is deleted within 30 days.
• Profile data — retained until you delete the profile or your account
• Analytics data — aggregated analytics are retained indefinitely; individual event data is retained for 12 months
• Session data — expired sessions are purged periodically
• Payment records — retained for 7 years as required by Indian tax and accounting laws
• Uploaded files — deleted within 30 days of account deletion

9. Your Rights

Under the DPDP Act and applicable laws, you have the right to:

• Access — request a summary of your personal data we hold
• Correction — update or correct inaccurate personal data
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Withdraw Consent — withdraw your consent for data processing at any time (this may affect your ability to use the Platform)
• Nominate — nominate another person to exercise your rights in case of death or incapacity
• Grievance — file a complaint with our Grievance Officer or the Data Protection Board of India

To exercise any of these rights, email us at support@boostify.biz. We will respond within 30 days.

10. Children's Privacy

Boostify is not intended for children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at support@boostify.biz.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, by sending an email notification. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the name and contact details of the Grievance Officer are:

13. Contact Us

For questions or concerns about this Privacy Policy, contact us at:

• Email: support@boostify.biz
• Address: 31/40, Dharapuram Road, Tiruppur District, Tamil Nadu, India — 641604