ReviewBoost
Legal

Privacy Policy

Last updated · October 13, 2026

Short version: we collect the minimum we need to run your orders, we don't sell your data, and you can delete your account at any time. The long version is below.

1. Who we are

ReviewBoost (“ReviewBoost”, “we”, “our”, or “us”) is an independent marketing-services platform operated by its owner-operator. This Privacy Policy explains how we handle personal information when you use reviews.voltstrike.app and any related subdomains (collectively, the “Service”).

For the purposes of the EU General Data Protection Regulation (“GDPR”) and the UK Data Protection Act 2018, ReviewBoost is the data controller of the personal data described below.

2. Data we collect

We collect only what we need to run the Service.

2.1 Account data

  • Email address — from your Google account at sign-in, or from the registration form.
  • Google OAuth subject ID — an opaque identifier Google assigns to your account; we never see your Google password.
  • Password hash — if you sign up with email + password, we store a scrypt hash. We never store the password itself.
  • Account timestamps — created-at, last login.
  • Consent record — version of our Terms you accepted on sign-up.

2.2 Localisation

  • Country (ISO alpha-2) — derived from your IP via your CDN's country header, or from your Accept-Language header.
  • Preferred language — one of EN / TR / DE / ES / FR; stored on your account if signed in, or in a cookie if not.

2.3 Order data

  • Package you purchased, quantity, price in USD, amount charged in your local currency.
  • Stripe checkout session ID and payment intent ID (we never see or store your card number).
  • Marketplace listing URL you submit after payment, so we can fulfil the campaign.
  • Delivery progress counters and timestamps.
  • A per-unit log of the real purchases placed on your listing (buyer-side time stamps, placement identifiers, confirmations). These purchases are completed through the marketplace's native payment flow and are independently verifiable on the marketplace's own ledger; our log is for evidence, dispute defence, and billing reconciliation only.

2.4 Technical data

  • IP address — for rate limiting, abuse prevention, and security logs. Stored with the session row and in event logs for up to 90 days.
  • User-Agent — only when a security event is logged (failed login, OAuth error).

2.5 What we do NOT collect

  • We do not use advertising cookies, pixels, or trackers.
  • We do not collect card numbers, bank details, or billing addresses — Stripe handles payment data directly.
  • We do not read, scrape, or analyse the content of your marketplace listings beyond verifying the URL format.

3. How we use your data

  1. Create and manage your account.
  2. Process your purchases via Stripe and send you receipts.
  3. Fulfil the promotion packages you ordered.
  4. Show prices in your local currency and the Service in your preferred language.
  5. Keep the Service secure (rate limiting, fraud and abuse detection).
  6. Comply with legal obligations (tax, accounting, lawful requests).
  7. Reply to your support requests.

We do not use your personal data for advertising, profile selling, or any purpose outside of running the Service you paid for.

If you are in the EU/EEA or UK, our legal bases for processing are:

  • Contract (Art. 6(1)(b)) — to deliver the Service you purchased.
  • Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, product improvement.
  • Legal obligation (Art. 6(1)(c)) — tax records, accounting, lawful requests from authorities.
  • Consent (Art. 6(1)(a)) — only where we explicitly ask (e.g. before setting a non-essential cookie, if we ever add one).

5. Third-party processors

We share the minimum necessary with a short list of carefully chosen processors:

5.1 Google LLC (sign-in)

If you choose “Continue with Google”, Google processes your sign-in and shares your email, Google subject ID, and email-verified flag with us via the OAuth 2.0 code flow. We only request the openid and email scopes. See Google's Privacy Policy.

5.2 Stripe, Inc. (payments)

All payments are handled by Stripe. When you check out, you're briefly on a Stripe-hosted page where you enter your card details — those details never touch our servers. Stripe sends us back a session ID, the amount paid, and your currency so we can mark your order as paid. See Stripe's Privacy Policy.

5.3 open.er-api.com (currency rates)

We fetch USD→EUR exchange rates from the public open.er-api.com endpoint. This call is server-to-server; it contains no personal data.

5.4 Hosting provider

The Service runs on standard cloud infrastructure. The provider processes network traffic and stores encrypted backups of our database. We have a Data Processing Agreement in place.

5.5 CDN provider

Static assets and incoming requests are routed through a CDN that provides TLS termination, DDoS protection, and the country header we use for localisation. The CDN sees your IP address and request metadata; we have a DPA in place.

6. Cookies

We use the smallest possible set of cookies. All of them are first-party.

  • rb_sess (or __Host-rb_sess in production) — HttpOnly session token. Expires after 30 days.
  • rb_csrf — companion CSRF token (double-submit pattern). Expires with the session.
  • rb_locale — your preferred language. Expires in 1 year.
  • rb_country — detected country code (used only for currency display). Expires in 1 year.
  • gstate / gafter — short-lived OAuth state cookies set only while a Google sign-in is in flight. Deleted immediately after.

All of these are strictly necessary under the ePrivacy Directive — the Service cannot function without them — so no banner is shown. We do not use any analytics, advertising, or third-party tracking cookies.

7. Data retention

  • Account data — kept while your account is active. Deleted within 30 days of account closure, except where we must keep it longer (e.g. tax law in your country).
  • Orders and invoices — kept for 10 years for accounting purposes (standard retention period for EU VAT invoices).
  • Session rows — automatically expire after 30 days of inactivity.
  • Security event logs — IP + error metadata retained for up to 90 days, then purged.

8. Your rights

Under GDPR, UK data protection law, and the California Consumer Privacy Act (CCPA), you have the right to:

  • Access — ask for a copy of the data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — ask us to delete your account and personal data (subject to the retention rules above).
  • Portability — receive a machine-readable export of your data.
  • Restriction / objection — limit how we process your data, or object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time.
  • Non-discrimination (CCPA) — we will not refuse service or charge you differently for exercising your rights.

To exercise any of these rights, email privacy@reviewboost.app from the address on your account. We respond within 30 days. You also have the right to lodge a complaint with your national data-protection authority (for EU residents, see the EDPB list).

9. Security

  • All traffic uses TLS 1.2+ with modern ciphers.
  • Passwords are stored as scrypt hashes (N=32768) — never in plain text, never recoverable.
  • Session tokens are stored as SHA-256 hashes in the database; the raw token exists only in your browser cookie.
  • Sensitive fields are encrypted at rest with AES-256-GCM; the key lives only in a secrets manager, never in the database.
  • We follow the principle of least privilege for all internal access and keep audit logs of administrative actions.
  • We do our own security reviews before every deploy and run automated dependency scanning.

No service can promise perfect security, but if we ever suffer a breach that affects your data, we will notify you and the relevant data-protection authority within 72 hours, as required by GDPR Art. 33–34.

10. Children

The Service is not directed at children. You must be at least 18 years old to create an account. If we discover that we have inadvertently collected personal data from someone under 18, we will delete it promptly. If you believe a minor has created an account, email privacy@reviewboost.app.

11. International transfers

Our processors (Stripe, Google, our hosting and CDN providers) are headquartered in the United States and may process your data outside the EEA/UK. Where that happens, we rely on the European Commission's Standard Contractual Clauses (2021) and, where applicable, the EU–US Data Privacy Framework. You can request a copy of our transfer safeguards by emailing us.

12. Changes to this policy

If we make a material change, we will update the “Last updated” date at the top and notify active users by email at least 14 days before the change takes effect. Continuing to use the Service after a change means you accept the updated policy.

13. Contact

Data controller contact details:

For general support, reach us on Discord (link in the site footer).

TermsPrivacyRefund
← Back to home