Privacy Policy

This Privacy Policy describes how Q4 Holdings LLC, a Wyoming limited liability company doing business as BoostPPC ("BoostPPC", "we", "us", or "our"), collects, uses, shares, and protects information when you use the BoostPPC website at boostppc.app (the "Site") and the BoostPPC application (the "Service"). The Site and Service together are the "Platform".

This Privacy Policy is intended to give you a clear picture of our practices. If you have questions or want to exercise any of the rights described below, contact us at admin@boostppc.app.

1. Who this applies to

This Policy applies to:

• Visitors to our Site.
• Account holders, including individual Amazon sellers and consultants who manage client accounts.
• End clients of consultants whose data is uploaded to BoostPPC by a consultant account holder. Where a consultant uploads their client's data, the consultant is responsible for ensuring the client has authorized that processing. We act as a data processor with respect to that client data.

2. Data we collect

2.1 Information you provide directly

• Account information: name, email address, password (hashed), account type (seller or consultant), and, for consultants, client account names and identifiers you create within the Platform.
• Billing information: processed by our payment provider Stripe. We receive limited information from Stripe (such as last four digits of card, billing country, subscription status), not full card numbers.
• Communications: the content of emails, support requests, or feedback you send us.

2.2 Amazon data you upload or authorize

• Bulk export files and business reports that you upload, including campaign data, keyword data, search-term data, ASIN-level performance data, sales figures, and advertising spend.
• Amazon Selling Partner API and Advertising API data retrieved on your behalf, once you authorize the connection. We retrieve only the data necessary for the features you use.

2.3 Automatically collected information

• Usage data: pages viewed, features used, timestamps, approximate location derived from IP address, and similar diagnostic information used to operate and improve the Platform.
• Device and browser information: browser type, operating system, device type, language preference.
• Cookies and similar technologies: see our Cookie Policy for details.

2.4 Information we do not collect

We do not collect special categories of personal data (such as health, race, religion, political opinions, biometric data, or precise location data). We do not knowingly collect data about Amazon end-customers (the shoppers buying products from sellers); the data you upload concerns advertising performance and aggregate sales, not individual shoppers.

3. How we use data

We use the information we collect to:

• Provide and operate the Service: authenticate you, process uploads, generate reports and recommendations, send transactional emails (password resets, account notices, weekly summary emails if enabled).
• Manage billing: process subscription payments, handle renewals and cancellations, send invoices and receipts.
• Communicate with you: respond to support requests, send service announcements, send marketing emails (only with consent and only where you can opt out).
• Improve the Platform: analyze aggregated usage to find and fix issues, design new features, and improve performance. Aggregated and anonymized analysis is performed in a way that does not identify you or your clients.
• Comply with legal obligations and protect rights: comply with tax, accounting, and other legal duties; investigate suspected abuse; enforce our Terms of Service; defend legal claims.

We do not sell personal information. We do not share Amazon data you upload with advertisers or data brokers.

4. Legal basis for processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we process your personal data under one or more of the following legal bases:

• Performance of a contract with you (most processing — operating the Service you signed up for).
• Legitimate interests — for example, security monitoring, fraud prevention, and product improvement, balanced against your rights.
• Consent — for optional features such as marketing emails. You can withdraw consent at any time.
• Legal obligation — for tax records, regulatory requests, and similar.

5. How we share data — sub-processors

We share data with the following third parties, who act on our behalf to deliver the Service. Each is a sub-processor with whom we have, or will execute, appropriate data-processing terms.

We do not currently use third-party analytics, error monitoring, or advertising-tracking services. If we add any in the future, we will update this list and notify users where required.

We may also share information:

• With your direction — for example, if you choose to integrate a third-party service with your BoostPPC account.
• In response to legal requests — to comply with a subpoena, court order, or other legal process, subject to applicable law.
• In connection with a business transaction — if Q4 Holdings LLC is involved in a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

6. International data transfers

BoostPPC is operated from the United States, with primary hosting in Germany. If you are outside the United States or the European Economic Area, your data may be transferred to and processed in countries with different data-protection laws than your own.

For transfers from the EEA, the UK, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards required by applicable law. You can request a copy of the relevant safeguards by contacting admin@boostppc.app.

7. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy.

• Active accounts: for as long as your account is active.
• After account deletion: we delete user-facing data promptly. Routine database backups containing your data are retained for up to 90 days and are not actively accessed after deletion; they are overwritten in the normal course of backup rotation.
• Billing records: retained for as long as required by tax and accounting law in our jurisdiction (typically 7 years), separately from active user data.
• Aggregated, anonymized data: may be retained indefinitely, as it can no longer be used to identify you.

You can request deletion at any time by contacting admin@boostppc.app or using the account-deletion control in the Platform when available.

8. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request that we delete your personal data, subject to legal obligations that require us to retain it.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email admin@boostppc.app. We will respond within 30 days, or sooner where required by law.

If you are in the EEA or UK and have an unresolved concern, you have the right to lodge a complaint with your local data-protection authority. If you are in California, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete, and the right not to be discriminated against for exercising those rights.

9. Security

We use commercially reasonable security measures to protect personal data, including:

• Encryption in transit (TLS) for all connections between you, the Service, and our sub-processors.
• Encryption at rest for database storage on Hetzner.
• Hashed passwords (bcrypt) — we do not store plaintext passwords.
• Access controls and audit logging for administrative access to systems holding personal data.
• Routine backup and recovery procedures.

No security measure is perfect. If we become aware of a personal-data breach affecting your data, we will notify you and any relevant authority as required by applicable law, typically within 72 hours of becoming aware.

10. Children

The Platform is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Amazon data — additional notes

Because the Platform processes data related to your Amazon seller account and (for consultants) your clients' accounts, the following additional points apply:

• Ownership. Amazon data you upload or that we retrieve via Amazon's APIs remains your data (or your client's data). We process it on your behalf to provide the Service.
• Amazon's own policies. Your relationship with Amazon, including data export rights and Amazon's privacy obligations to you, is governed by Amazon's own terms and policies, not by us.
• Sub-processing of Amazon data. Amazon data is stored on Hetzner servers and is not shared with SendGrid or Stripe. Aggregated summary emails (e.g. weekly performance summaries) sent via SendGrid do not include raw bulk data — only summarized metrics.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the current version. For material changes, we will notify account holders by email or in-app notice in advance of the change taking effect. Continued use of the Platform after an updated Policy takes effect constitutes acceptance.