1. Controller
YOOBOOST SAS, 33 Rue des Ancelyns, 33470 Le Teich, France, RCS Bordeaux 828 369 884. Contact for privacy matters: dimitri@yooboost.com.
2. Data I collect
- Account data: email, name, company, VAT number, country, address, language, timezone, password hash
- Booking data: brief, files you upload, messages, deliverables, reviews
- Payment data: amounts, status, Mollie payment identifiers (card numbers are never stored here)
- Technical data: IP address (hashed), user agent, a first-party device identifier cookie, request logs, audit logs
- Referral data: referral code, clicks, attribution
- Contact form messages and consent choices
3. Why and on what legal basis
- Performing the contract: bookings, payments, invoices, delivery, support
- Legal obligations: invoicing and accounting records
- Legitimate interest: security, fraud and multi-account detection, abuse prevention, service improvement
- Consent: optional cookies and marketing emails, if any
4. Fraud prevention and fingerprinting
To protect the referral programme and payments, I link a first-party cookie identifier, a hashed IP address and browser characteristics to accounts and checkouts, and compare them across accounts. Signals are reviewed before any decision affecting you.
5. Recipients and processors
Mollie B.V. (payments), my hosting provider, and the email server operated for rushlap.com. No data is sold. No advertising networks are used.
6. Retention
Account data is kept while the account exists. Invoices and payment records are kept 10 years (French commercial law). Audit logs, request logs and fraud signals are kept indefinitely by default for security and dispute purposes.
When you delete your account, your user record is pseudonymised (name, email and identifiers are replaced). Bookings, payments, invoices, messages and logs are kept, linked by identifier, and remain visible to the administrator.
7. Your rights
You can access, correct, export and delete your data from your client area or by writing to dimitri@yooboost.com. You may object to processing based on legitimate interest and lodge a complaint with the CNIL.
8. Security
Passwords are hashed with argon2id, connections use TLS, sessions are revocable, administrators use two-factor authentication, and uploaded files are stored privately with signed links.
9. Changes
Changes are published on this page with a new date.