Privacy Policy

This Privacy Policy explains how BOOSTPAD BUSINESS SOLUTIONS (OPC) PRIVATE LIMITED ("BoostServ") collects, uses, and protects your personal data when you use boostserv.io.

01. Data Controller

BOOSTPAD BUSINESS SOLUTIONS (OPC) PRIVATE LIMITED

Plot No 211, Okhla Phase 3, Road 1,
Okhla Industrial Estate, New Delhi,
South Delhi – 110020, Delhi, India

CIN: U62011DL2025OPC443429

GSTIN: 07AANCB2883L1Z4

privacy@boostserv.io

02. Data We Collect

Account data

Name and email address
Password, stored only as a salted scrypt hash — never in plain text (omitted if you sign in with Google)
Two-factor authentication secret (TOTP) and backup codes, encrypted at rest
Session tokens used to keep you logged in on your devices

If you sign in with Google

When you choose "Sign in with Google", Google shares the following information with BoostServ under the openid, email, and profile OAuth scopes:

Your Google account ID (a stable internal identifier)
Your full name
Your email address (and whether Google has verified it)
Your profile picture URL

Scope of access: BoostServ does not access your Gmail, Google Drive, Google Contacts, Calendar, or any other Google service. The scopes we request are sign-in only — they grant identity verification, not access to your Google data. You can revoke this access at any time at myaccount.google.com/permissions.

Billing data

Billing name, billing address, country
Registered company name (for B2B invoices)
GSTIN for Indian business customers (optional, for GST input-tax credit)
Subscription plan, term purchased, and payment status
Invoice metadata (FY-scoped invoice number, payment reference, CGST/SGST/IGST split)

We never store card details. Full card, UPI, net-banking, and bank data is handled directly by our payment processors (Razorpay and PayPal) on their own PCI-DSS compliant infrastructure. We only receive a payment reference and the fact that the payment succeeded — never the card number, CVV, or UPI handle.

Setup & product data

The IP address assigned to you.
Domains you add and DNS records configured
Mailbox metadata (addresses, quotas, display names)
Mailbox passwords, encrypted reversibly so you can retrieve them
Operational logs
IP addresses of your logins (for security and fraud prevention)
User-agent strings
Audit trail of state-changing actions (domain added, mailbox created)

03. Mailbox Access & Message Content

BoostServ processes message content needed to send campaigns and display or manage replies through the features you use. Connecting an account involves the permissions shown by your provider. Message content is private customer data; review those permissions before connecting a mailbox.

Abuse investigations

If we receive a formal abuse report (phishing, malware, etc.) we may access specific messages solely to investigate the reported violation, as permitted by our Acceptable Use Policy.

04. How We Use Your Data

To provide and operate the Service
To process payments and issue invoices
To authenticate logins and prevent unauthorized access
To send transactional emails (account, billing, service notifications)
To investigate abuse reports and comply with legal obligations
To send occasional product updates — you may opt out from your account settings

06. Sub-processors

We use the following third-party providers to operate the Service. Each is bound by its own data-protection commitments:

Cloudflare, Inc. (USA) — Authoritative DNS
Chargebee Inc. (USA) — subscription billing and invoicing
Razorpay Software Private Limited (India) — payment processing for customers paying in INR (UPI, cards, net banking) and for international customers paying in USD by card
PayPal Holdings, Inc. (USA) — payment processing for international customers paying in USD via PayPal wallet or card
Resend Inc. (USA) — transactional email delivery (signup confirmations, password resets, invoice receipts, renewal reminders)
Google LLC (USA) — account sign-in and eligible connected Google email accounts. Mailbox access depends on the permissions you grant when connecting an account. Google Analytics is used on the marketing website only when optional analytics are enabled.
Microsoft Clarity — optional marketing-website analytics, enabled through your privacy choices.
Freshworks — processing enquiries you submit to our contact form, and optional website marketing/chat functionality when you enable marketing.

Current list available at privacy@boostserv.io. We notify customers by email at least 30 days before adding a new sub-processor.

07. International Data Transfers

Because our sub-processors are located in multiple countries, your personal data may be transferred to and stored in jurisdictions outside your country of residence — including the United States and the European Union. We rely on Standard Contractual Clauses (SCCs) and equivalent safeguards where required to protect transfers.

08. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you
Correction — ask us to correct inaccurate or incomplete data
Deletion — ask us to delete your data (subject to legal retention requirements)
Export — receive a copy of your data in a portable format
Withdrawal of consent — where we process on consent, you may withdraw at any time
Complaint — lodge with your data protection authority (India: Data Protection Board under DPDP Act 2023; EU: your national supervisory authority; UK: ICO)

Response time

Email privacy@boostserv.io to exercise any right. We respond within 30 days.

09. Retention

Account & setup data — deleted within 30 days of cancellation
Billing records & invoices — retained for 7 years as required by Indian tax law (Income Tax Act, GST Act)
Security & audit logs — retained for 12 months
Abuse investigation data — retained only as long as necessary, up to 2 years

10. Security

Passwords are hashed with salted scrypt (never stored or transmitted in plain text)
All traffic to and from the Service is encrypted with TLS 1.2 or higher
Two-factor authentication (TOTP) is available on every account
Admin access is limited to a small number of authorized personnel
Regular security reviews and dependency audits

Breach notification

No internet service can be made perfectly secure. We will notify affected users promptly (within 72 hours where required by law) of any confirmed breach of personal data.

11. Cookies

The marketing website uses necessary preferences and optional analytics and advertising attribution. Optional website scripts are off until you enable the relevant category through Privacy choices. These controls do not prevent essential account functions or processing a contact enquiry you submit.

Session cookies (set by better-auth) — keep you logged in across pages. Expire 7 days after last activity.
NEXT_LOCALE — remembers the market you select (India or International). An explicit market selection can be stored for up to one year.
CSRF-protection cookies — short-lived tokens used to protect account actions from cross-site request forgery.
Analytics & attribution tags — Google Analytics and Microsoft Clarity use the analytics category. Meta Pixel, advertising attribution and the Freshworks marketing/chat widget use the marketing category. Rejected optional categories are not loaded by this marketing website.
boostserv_privacy_v1 — first-party browser storage records your analytics and marketing preferences for up to 180 days. You can change them through Privacy choices. Withdrawing a category stops future website tracking for that category; it does not automatically delete records already held by a provider.

12. Children

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email privacy@boostserv.io and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 15 days in advance. The "Last updated" date at the top of this page reflects the latest revision.

14. Contact