GDPR Compliant

Privacy Policy

October 28, 2026

At TFT-Boost (test.tft-boost.net), user privacy and data security are our highest priorities. This Privacy Policy details how we collect, store, and process information.

All personal data is processed in strict compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) and European privacy legislation.

1. Data Controller

The data controller for the service is TFT-Boost.

For any inquiries, requests to exercise your data subject rights, or privacy communications, please contact: support@tft-boost.net.

2. Data Collection and Processing Purposes

We adhere to the data minimization principle (GDPR Art. 5(1)(c)) — collecting solely information essential for secure service provision:

Email address: Account authentication, client dashboard access, fulfillment of orders, and automated transaction updates (GDPR Art. 6(1)(b)).
Order details and history: Coaching parameters, order chat communications, and progress logs (GDPR Art. 6(1)(b)).
Billing & transaction records: Payment status, amount, and timestamp for mandatory accounting and tax compliance (GDPR Art. 6(1)(c)). Payment data (credit cards, BLIK) is processed directly by PCI-DSS certified providers (Stripe, PayPal); we never hold or store raw payment card data.
Anonymous telemetry: Masked IP addresses (/24 subnet) and diagnostic headers to defend against abuse and maintain platform reliability (GDPR Art. 6(1)(f)).

3. Trusted Data Processors (GDPR Art. 28)

To ensure optimal infrastructure security, we partner exclusively with certified data processors complying with European standards:

Encryption & Data Security

All databases are encrypted at rest (AES-256) and in transit (TLS 1.3). We never sell or share user data with advertising networks.

Cloudflare Inc. – edge network, DDoS mitigation, and Cloudflare Workers hosting (EU-U.S. Data Privacy Framework certified).
Turso (ChiselStrike Inc.) – managed customer database located within European Union data centers.
Supabase Inc. – EU-based cloud database for order messaging and telemetry offloading.
Stripe Payments Europe, Ltd. & PayPal (Europe) S.à r.l. – licensed payment institutions (PCI-DSS Level 1 compliant).
Resend Inc. – transactional email dispatch infrastructure.

4. Your GDPR Data Subject Rights

Under the GDPR, you maintain comprehensive rights regarding your personal data:

Right of access: Request confirmation and copies of personal data held (Art. 15).
Right to rectification: Correct inaccurate or incomplete data (Art. 16).
Right to erasure ("Right to be Forgotten"): Request permanent deletion of data (Art. 17).
Right to restriction of processing: Pause data processing under specific circumstances (Art. 18).
Right to data portability: Receive your data in a structured, machine-readable format (Art. 20).
Right to object: Object to processing conducted under legitimate interest (Art. 21).
Right to lodge a complaint with a supervisory authority: You have the right to submit a complaint to your national EU Data Protection Authority.

5. Retention and Security Measures

Account data is retained for the active lifetime of your account or until deletion is requested, subject to statutory statutory limitation and tax requirements (typically 5 years from financial year end).

Administrative access requires multi-factor authentication (2FA). User passwords are protected with modern cryptographic hashing.

6. Contact the Data Controller

For all privacy-related requests or to exercise your rights, email us at: support@tft-boost.net.