Privacy Policy

1. Who we are and scope

Boost My Businesses Ltd, registered in England and Wales under Company No. 17313018, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom is the controller of the personal data described in this policy.

We process personal data under the UK GDPR and the Data Protection Act 2018. Where we offer services to, or monitor the behaviour of, people in the European Economic Area, the EU General Data Protection Regulation (EU GDPR) also applies.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• identity and contact data, such as your name, email address, telephone number and business details
• account and authentication data
• billing, subscription and transaction records (payment card details are handled by our payment provider and are not stored in full by us)
• communications, support requests and information submitted through forms, email or calls
• technical and usage data, including IP address, device/browser information, logs and cookie identifiers
• service data, such as call, lead, campaign, workflow and performance data
• for Instagram Growth, account connection data or access tokens, audience settings, activity logs, follower and engagement metrics, and campaign reports

3. Why we use data and our lawful bases

We use personal data only where we have a lawful basis, including:

• contract: to create accounts, deliver services, provide support and manage subscriptions
• legitimate interests: to secure, operate and improve our services, prevent fraud and respond to business enquiries
• legal obligation: to keep tax, accounting and compliance records
• consent: for optional cookies and direct marketing where consent is required; consent may be withdrawn at any time

4. How we share data

We do not sell personal data. We may share it with vetted processors where necessary to provide our services, including hosting, database, communications, analytics, automation, infrastructure and payment providers, and with professional advisers or authorities where required by law.

Processors may act only on our instructions and must protect the data. For Instagram Growth, limited data may be shared with infrastructure providers needed to operate the service.

5. International transfers

Some providers may process data outside the United Kingdom or European Economic Area. Where transfer restrictions apply, we use an applicable adequacy decision or approved contractual safeguards, such as the UK International Data Transfer Agreement/Addendum or EU Standard Contractual Clauses, together with supplementary measures where needed.

6. How long we keep data

We apply the following retention periods unless a longer period is required by law or for a legal claim:

• enquiries and general correspondence: up to 24 months after the last substantive contact
• account, contract and core service records: while the account is active and up to 6 years after the contract ends
• billing, tax and transaction records: 6 years after the relevant financial year or transaction
• Instagram campaign credentials, tokens and operational data: while the service is active and normally deleted or anonymised within 90 days after it ends
• security and access logs: normally up to 12 months
• cookie and analytics data: for the lifetime stated by the relevant cookie or until consent is withdrawn

7. Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls and encrypted transmission. No system can guarantee absolute security.

8. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may request access to, correction or deletion of your data; restriction of or objection to processing; and a portable copy of data you provided. You may withdraw consent at any time and object at any time to direct marketing.

Requests are normally free of charge and answered within one month. You may also complain to the UK Information Commissioner's Office (ICO) or, where the EU GDPR applies, to the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

9. Cookies

We use strictly necessary cookies and local storage for functions such as security, authentication, language and session management. With your consent, we may also use optional analytics or marketing cookies to understand usage and improve our services.

Non-essential cookies should not be set before consent. You can reject or withdraw consent through the available cookie controls and can also manage cookies in your browser; disabling necessary cookies may affect site functionality.

10. Privacy contact

For privacy questions or to exercise your rights, contact our data protection responsible at Boost My Businesses Ltd, registered in England and Wales under Company No. 17313018, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom:

11. Changes to this policy

We may update this policy to reflect changes to our services or the law. We will post the revised version here and highlight material changes where appropriate.