Who is responsible for your data
Boostkit is run by Matt West, trading as Boostkit through West Media Limited (company number 15405002, VAT number GB511032558, registered office 29 Prospect Road, Southborough, Tunbridge Wells, England, TN4 0EN). In this notice "I" means Matt West acting for West Media Limited. My registration number with the Information Commissioner's Office is ZC079857.
Who is responsible depends on who you are.
If you sign in to Boostkit
You are a client of mine, or a member of a client's staff. For the details of your own account (your name, your email address, your sign-ins and what you do in the app) West Media Limited is the controller: I decide how that data is used and I am responsible for it.
If you are a customer of a business that uses Boostkit
The business you dealt with is the controller of your data. It decides what to collect about you, why, and how long to keep it, and its own privacy notice applies. West Media Limited is its processor: I hold and handle the data on that business's instructions, to provide the CRM to it, and for no purpose of my own.
You can send a request about your data to the business or to me. If it comes to me, I pass it to the business and help it reply.
What is collected
About people who sign in
- Your name and email address, and a profile picture if your sign-in method supplies one.
- Which client accounts you can open and what your role allows you to do in each.
- Records of your sign-ins, including the device, browser and IP address, kept by the sign-in service.
- An audit log of significant actions, such as deleting records, exporting contacts or changing who has access.
- Anything you send me through the app, such as a feature request.
About a client's customers
What a client keeps in its account is up to that client. The CRM is built to hold:
- Contact details: name, email address, phone number, address, company, and the tags, notes and extra fields the client adds.
- Bookings: the service, the staff member, the time, the status, and whether a deposit was paid.
- Messages: the emails and texts exchanged with the business through the CRM, and whether each was delivered.
- Calls: when you ring a business number that the business has set up here, the number you rang from, the time, how long the call lasted and whether it was answered or missed. Calls are never recorded, and nothing said on them is kept.
- Enquiries and leads: the answers given on a form, a website enquiry or a Facebook lead form, and where the lead came from.
- Sales records: the opportunities, tasks and notes the business keeps about its dealings with you.
- Invoices and payments: what was billed, what was paid and when. Card details are never held in the CRM.
- Reviews: reviews of the business, the business's replies, and whether you were asked for a review.
- Marketing choices: whether you have unsubscribed from the business's emails.
About visitors to public pages
The booking, form, invoice and unsubscribe pages, and the pages you are reading now, can be opened without an account. They collect only what you type into them, with two additions. When you accept or decline an estimate, the time, the email address the estimate was sent to, and the IP address and browser type your browser reports are recorded with your answer, so the business has a record of what was agreed. When you pay through a payment link, your name, email address, phone number and any delivery address you give are kept with the order so the business can fulfil it; your card details go to Stripe and never reach Boostkit. The hosting provider keeps technical logs of requests, which include IP addresses. There is no analytics or advertising tracking on any page.
Telling people from automated programs
To stop automated programs filling a business's diary or sending it junk, the booking pages, forms, payment link pages, estimates and the chat window can run a check from Cloudflare called Turnstile before anything is sent. When it is switched on, your browser loads a script from Cloudflare (challenges.cloudflare.com), which runs in a small frame on the page. Most people see nothing; a few are asked to tick a box. Cloudflare receives your IP address, technical details of your browser and connection, and the address of the page the check ran on. It is not sent anything you type into the page. Cloudflare answers only whether the visitor looks like a person. I keep a note that a check was passed, with nothing about you in it, for no more than two hours. Cloudflare also uses what it receives to improve its own detection of automated programs, under its Turnstile privacy addendum. I rely on my legitimate interest, and my clients', in keeping these pages free of abuse.
About the chat button on a client's website
A client can put a chat button from Boostkit on its own website. It is not a live chat. If you send a message through it, I store the name, email address, phone number and message you give, for that business, so that it can reply to you later by email, phone or text. The button loads one small script from Boostkit, sets no cookies, keeps nothing in your browser and does not track you. When you open the chat, its window may also run the Cloudflare check described above. Nothing is recorded unless you send a message, and I do not record which page you were on, only which website the message came from. Sending a message is not agreement to marketing.
What it is used for, and the lawful basis
Where West Media Limited is the controller (people who sign in)
- To give you access to the right accounts and keep them secure. Lawful basis: performance of my contract with the client, and my legitimate interest in keeping the service secure.
- To keep an audit log, so that a client and I can see who did what. Lawful basis: legitimate interest in security and accountability.
- To tell you about changes to the service and answer your requests. Lawful basis: performance of the contract, and legitimate interest in supporting clients.
- To keep business and tax records. Lawful basis: legal obligation.
Where the client is the controller (its customers)
The client decides the purposes and the lawful basis, and must tell its customers about them in its own privacy notice. A client typically uses the CRM to take and manage bookings, answer enquiries, send confirmations and reminders, issue invoices, and send marketing to people who have agreed to it. I process that data only to provide the CRM to that client and on its instructions.
I do not use anyone's personal data for advertising of my own and I do not sell it. No decision with a legal or similarly significant effect is made about anyone by automated means.
Google user data
A client can connect a Google account to Boostkit. The app asks Google only for the access each feature needs, the person connecting sees Google's own consent screen first, and nothing is read until they agree.
What is accessed
- Reviews and posts
- The Business Profile accounts and locations the person can manage (name, town and postcode), and for the location they choose: its reviews (the reviewer's display name, star rating, comment, date and any existing reply) and Google's own average rating and review count for that location.
- Permission requested: Google Business Profile (business.manage)
- Business Profile phone numbers
- For the location a client has chosen, the main phone number and any additional phone numbers on its profile, read when someone opens the Phone settings, and written back only when a person at the business, or I on their behalf, choose new numbers and confirm.
- Permission requested: Google Business Profile (business.manage), the same permission as above
- Search and website figures, for clients who ask
- For a client who asks me to include it, the totals for that client's own Search Console site and Google Analytics property: for each day, clicks, impressions, average position, sessions, active users and key events, and the top search queries and pages, the sources visitors came from and the pages they landed on over the latest 28 days. These are read through my own Google account, which the client adds as a user on its property, and not through a sign-in by the client. Later, if a client asks, advertising performance for that client's own advertising account (what was spent and the results) in the same way, which I will describe here before it starts.
- Permission requested: Search Console (webmasters.readonly) and Google Analytics (analytics.readonly), both read only, held by my own Google account
- Calendar
- The names of the staff member's calendars, and for the calendars they choose: when each event starts and ends and whether it marks them as busy. Event titles are read only if the staff member switches that on, and are shown only to them.
- Permission requested: Calendar events (calendar.events) and the calendar list, read only (calendar.calendarlist.readonly)
- Signing in
- Where signing in with Google is offered and you choose it: your name, email address and profile picture.
- Permission requested: Basic profile (openid, email, profile)
How it is used
- Reviews are shown to the business inside its own account so it can read and reply to them. A reply is sent to Google only when a person at the business writes and sends it.
- If a business chooses to show reviews on its own website, the review widget displays reviews from its Business Profile: the reviewer's name as it appears on Google, their star rating, the words of the review, its date and any reply from the business, with Google's own rating and review count. These are already public on Google. Unless the business sets it otherwise, the widget shows the business's reviews automatically, newest first, including new ones as they arrive; the business can set a lowest star rating, leave out reviews with no words and hide single reviews. A business can instead choose each review itself, confirming that its writer has agreed. A review edited or deleted on Google is changed or removed on the website at the next sync. If a review of yours is shown on a business's website and you want it taken off, ask the business or use the data deletion page.
- Posts are published to the business's Business Profile only when the business writes and schedules them.
- Phone numbers on a Business Profile are changed only when a person at the business, or I at its request, choose the new numbers and confirm them on a screen that shows the old and the new side by side. Only the phone numbers are sent to Google.
- Search and website figures are shown on the client's own Marketing screen, to the people the client has given access to its account. They are totals only. No personal data from Search Console or Analytics is stored, none of it is added to a customer's record, and I do not ask Google for anything about an individual visitor.
- Busy times from a calendar stop customers booking a staff member when they are not free. Events on the person's own calendar are read only as busy times. They are never copied into a customer's record.
- Appointments made in the CRM are written to the calendar the staff member picks. The event shows the time of the appointment, the service and the customer's first name, or only the word "Appointment" if the staff member chooses to keep details private. No contact details, prices or notes are written to the calendar.
- Sign-in details identify you and match you to the accounts you were invited to.
How it is stored
- The access and refresh tokens Google issues are kept on the server so the connection keeps working. They are never shown in the app.
- A copy of the business's reviews (the reviewer's display name, star rating, comment, date and any reply) is kept in its account and read again from Google several times a day while the connection is working. No copy is kept for more than 30 days without being read from Google again: a daily clean-up deletes any that has gone 29 days. Every copy is deleted at once when the business removes the Google connection. The rating and review count shown for Google are Google's own figures for the location, kept and deleted on the same terms: nothing is worked out from the copies. Reviews the business types in itself are not Google data and stay until the business deletes them.
- For each review a business chooses for its website or hides from it, I keep Google's identifier for that review and, for a chosen one, the time the business confirmed the reviewer's agreement, so the choice survives a copy being deleted and read again. The review itself is kept only as described above. Where a business switches on a summary of its reviews, the summary is kept with the date it was written and shown beside the reviews it was written from. If the reviews shown then change, it stays on show marked with its date until a new one is written, and is taken down at once when none of the reviews it was written from is still shown. It is deleted when the business switches it off, when the Google connection is removed, when no copy is left of the reviews it was written from, and in any case before it is 30 days old; where the widget is still in use a new one is written first.
- Busy times are kept as a start and an end. Event titles are kept only where the staff member has switched that on.
- The Search Console and Analytics totals above are the client's own website data and are kept as daily figures for as long as the client uses the feature. They are deleted when the client asks me to unlink the property, or the account is closed. The phone numbers on a Business Profile are read when the screen is opened and are not stored; the only record kept is a line in the account's audit log saying that numbers were updated.
- All of it sits in the same database as the rest of the client's account, in Europe (Ireland).
How it is shared
Google user data is not sold, and is not transferred to anyone except the providers listed under who else handles the data, who host the app and its database so that these features can work. It is seen by the client's own staff in their account. I look at a client's account only to set it up or support it, with that client's agreement, or where needed for security or to comply with the law.
Limited use
Boostkit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Google user data is used only to provide and improve the features described here, which are visible in the app.
- It is not used for advertising of any kind, including retargeting, personalised or interest-based advertising.
- It is not transferred or sold to advertising platforms, data brokers or information resellers.
- It is not used to develop, improve or train generalised artificial intelligence or machine learning models.
- It is not used to assess creditworthiness or for lending.
Removing access
A client can remove a connection at any time under Settings, Connections (or Settings, Calendars for a staff calendar). Removing it deletes the stored tokens. You can also remove Boostkit's access from your Google Account at myaccount.google.com/connections. To have data that was already copied deleted, see the data deletion page.
Microsoft calendar data
A staff member can connect an Outlook or Microsoft 365 calendar instead of, or as well as, a Google one. It works the same way and the same rules apply.
- What is requested: permission to read and write calendar events (Calendars.ReadWrite) and to keep the connection working without signing in again (offline_access).
- What is read: the names of the person's calendars, and when the events on the calendars they choose start and end. Those events are read only as busy times and are never copied into a customer's record. Titles are kept only if the staff member switches that on, and are shown only to them.
- What is written: each appointment, with its time, the service and the customer's first name, or only the word "Appointment" if the staff member chooses to keep details private.
- The tokens Microsoft issues are kept on the server and never shown in the app. Microsoft calendar data is not sold, not used for advertising and not used to train artificial intelligence models.
- Removing the calendar under Settings, Calendars deletes the tokens and the busy times read from it.
Facebook and Meta data
A client can connect a Facebook account so that Boostkit can publish to its Facebook Page, receive the leads from its lead ads and, if the client switches it on, receive and answer the messages people send the Page. The person connecting sees Facebook's own permission screen first and chooses which Page to connect.
What is accessed
- Page posts
- The Pages the person manages (name, category and identifier), and an access token for the Page they choose.
- Permissions requested: pages_show_list, pages_read_engagement, pages_manage_posts
- Lead ads
- The lead forms on the chosen Page (name and status), and each lead those forms collect: the answers the person gave, when, and which form and advert it came from.
- Permissions requested: leads_retrieval, pages_manage_metadata, pages_manage_ads, ads_management
- Messenger and Instagram inbox
- The messages people send the client's Facebook Page on Messenger and, when an Instagram professional account is linked to that Page, the direct messages people send that account. For each sender: the identifier Meta assigns them for that Page or account, the name or username Meta provides, and Meta's links to any pictures or files they send.
- Permissions requested: pages_messaging, pages_manage_metadata, instagram_basic, instagram_manage_messages, business_management, and the Human Agent feature
- The client's WhatsApp Business account and number, the messages people send that number with the name they show on WhatsApp, Meta's reference for any picture, voice note or file they send, the delivery reports for messages the client sends, the client's message templates with WhatsApp's verdict on each, and the number's health as Meta reports it: its display name review, quality rating and daily limit. For a number that stays on the client's WhatsApp Business app: once, the contact names and up to six months of chat history that app holds, and afterwards the messages the client sends from the app.
- Permissions requested: whatsapp_business_management, whatsapp_business_messaging
The lead ads and messaging permissions are requested only when a client chooses to connect lead ads or to switch messaging on. Boostkit does not read the personal profile, friends, private messages or photos of the person who connects, and it does not create or change adverts.
How it is used, stored and shared
- Posts are published to the Page only when the business writes and schedules them.
- Each lead becomes a contact in the account of the business that ran the advert, so the business can reply to the person who asked. The lead is kept as it arrived, alongside the contact.
- The Page access token is kept on the server so the connection keeps working. It is never shown in the app.
- Meta data is used only to provide these features to the client who connected the Page. I do not sell it or use it for advertising of my own, it is not combined with another client's data, and it is not used to train artificial intelligence models.
- It is shared only with the providers listed under who else handles the data, who host the app and its database.
Messenger and Instagram messages
If a client switches on messaging for a Facebook Page, Boostkit receives the messages people send that Page on Messenger, and the direct messages people send the Instagram professional account linked to it, and sends the replies the client's staff write. For each person who writes I store the identifier Meta assigns them for that Page or account, the name or username Meta provides, the text of their messages and Meta's links to any pictures or files they send. The links are Meta's and stop working after a short time; I do not copy the files. I store nothing about the person's friends, posts or other conversations, and I never match them to an existing customer record by name: a member of the client's staff does that by hand. A reply is sent only when a member of the client's staff writes it. Nothing is sent automatically, and replies follow Meta's rules on how long after a person's last message a business may reply. If a message is deleted on Messenger or Instagram, Meta tells Boostkit and the stored text and links are removed. Messages that arrive while a client's account is paused or closed are not kept.
If a client connects its WhatsApp Business number, Boostkit receives the messages people send that number and, once I have switched sending on for that client, sends the messages its staff write and the messages its own automations are set up to send. The messages pass through Meta, which runs WhatsApp. For each person who writes I store their phone number, the name they show on WhatsApp if they are new to the client, the text of their messages, when they last wrote, and Meta's reference for any picture, voice note or file they send. I do not fetch or copy those files. A person is matched to an existing customer record by phone number only, and an existing record is never changed by what arrives.
A client can connect a number that is already in use on the WhatsApp Business app and keep using the app beside Boostkit. Within 24 hours of connecting, Boostkit asks the app, once, for its contact names and up to six months of its chat history, which Meta sends only if the person connecting chooses to share it. The history is copied into closed, read conversations. For each person in it I store their phone number, the text of the messages and when they were sent, and Meta's reference for any picture, voice note or file, which I do not fetch. A person is matched to an existing customer record by phone number only, and an existing record is never changed. A person with no record gets a new one without starting any automation. The contact names are kept only to name those people, make no record on their own, and are deleted when the number is disconnected. Nothing in the history records that anyone agreed to WhatsApp messages and it does not start the 24 hours in which a free reply is allowed; if a person's last keyword in it was STOP, they are recorded as opted out. Afterwards, messages the client sends from its own app are recorded in the conversation as sent by the client and are never sent again, and a message that Meta says was edited or deleted is changed or removed here to match. Boostkit also reads the number's display name review, quality rating and daily limit from Meta to show them to the client and to tell the client when it needs attention, and keeps a number that does not stay on the app registered for sending and receiving.
WhatsApp allows a free reply only within 24 hours of a person's last message; after that only a message template WhatsApp has approved can be sent. A person who replies STOP, or asks the client not to message them, is sent nothing further on WhatsApp until they reply START, and that opt-out is kept against the phone number even if the customer record is deleted, so the number is not messaged again by mistake. Outside those 24 hours a template is sent only to a person whose agreement to WhatsApp messages the client has recorded, with how and when they agreed, and a marketing template needs that agreement at any time. Messages that arrive while a client's account is paused or closed are not kept.
An agreement to WhatsApp messages is recorded in one of three ways: a member of the client's staff records it and says how the person agreed; the person ticks a consent box on one of the client's forms here, which is never ticked for them; or the person comes through an enquiry form or lead advert that the client has told Boostkit asks for that agreement, in the client's own words. For a lead advert, that is only when the advert's own consent question or tick box was ticked. With each agreement I keep where it came from, the wording the person agreed to as it stood at the time, and when. An agreement is never recorded for a number that has opted out, and never by importing records or changing them in bulk. A template that carries a picture is sent with a picture the client hosts itself: I keep only its link, and WhatsApp fetches the picture.
Phone calls
If a client attaches a business phone number to its account, calls to that number come to Boostkit through Twilio, which runs the number. Boostkit tells Twilio to pass each call to the client's own phones, and, if a client has switched it on, to text the caller when nobody answers. For each call I store the phone number it came from, the number it was made to, when it began, how long the call lasted when it was answered, and whether it was answered or missed. I do not record calls, there is no voicemail, and nothing that is said is heard or kept by Boostkit. If a phone the call is passed to sends it to its own voicemail, the call is logged as answered, because the network cannot tell the difference. A caller who withholds their number is logged with no number and nothing else is done.
A call from a number the client already has is added to that person's record as a line in their conversation, saying it was answered or missed. A call from a number the client does not know creates a new contact with only that number, in the same way as a text from a stranger. A missed call can start one of the client's own automations. A missed-call text is sent only if the client has written it, to a UK mobile by default, and never to a number that has replied STOP; it is a reply to a call the person chose to make, not marketing, and only one goes to the same caller in an hour. Calls that arrive while a client's account is paused or closed are not forwarded or kept.
Sending conversions to Meta
Nothing is sent to Meta about a client's customers by default. A client that advertises with Meta can choose to add a step, "Send conversion to Meta", to one of its automations. The step tells that client's own Meta dataset that a lead arrived or a later stage was reached, using credentials the client supplies. The client does this as controller and on its own instruction: it is responsible for having a lawful basis and for telling its customers in its own privacy notice.
The step sends only:
- a standard, neutral event name, such as Lead, Schedule or Purchase;
- the time of the event and an identifier for it, and a value and currency where the client includes one;
- the Facebook lead identifier, where the person came from a Facebook lead form;
- these contact details, each hashed with SHA-256 before it leaves the CRM: email address, phone number, first and last name, town or city, postcode, country, and the contact's internal identifier;
- where the person enquired through the client's own website and that website passed them on: Meta's own browser identifiers for that visit (known as fbc and fbp), the browser's user agent, and the address of the website, without the page.
Hashing is pseudonymisation, not anonymisation: Meta can match a hash to an account it already holds, which is the purpose of sending it. The step never sends form or assessment answers, custom fields, tags, the name of a service or treatment, appointment details, notes or the text of messages. An event name that contains the name of a service or treatment is refused.
Removing access and deleting data
A client can remove the connection under Settings, Connections, which deletes the stored token. You can also remove Boostkit from your Facebook account under Settings and privacy, Settings, Business integrations. The data deletion page explains how to ask for data received from Facebook to be deleted.
Health and other sensitive information
Some of my clients are clinics. A booking for a treatment, an answer on an enquiry form or a note on a record can say something about a person's health, which the law treats as special category data.
- The clinic is the controller of that information. It needs its own lawful basis and condition for holding it, and must explain this to its customers.
- I handle it only to provide the CRM to that clinic. It stays inside that clinic's account, which only the people the clinic has given access to, and I when I am supporting the account, can open.
- I never sell it and never use it for advertising. By default nothing about a customer is sent to Google, Meta or any other advertising service.
- If a clinic switches on the "Send conversion to Meta" step described under Facebook and Meta data, Meta is told that an event such as a lead or a purchase happened, with hashed contact details. Form and assessment answers, service and treatment names, appointment details, notes and messages are never sent, and an event name that names a service or treatment is refused, because Meta's terms forbid sending health information. Meta can still learn that a person it recognises is a customer of that clinic, so the clinic must decide whether that is appropriate and tell its customers.
- An appointment written to a staff member's own Google or Microsoft calendar shows its time, the service and the customer's first name unless the staff member sets it to private, in which case it says only "Appointment".
- Emails and texts a clinic sends through the CRM pass through the email and text providers listed below in order to be delivered.
Who else handles the data
I use the providers below to run Boostkit. Each handles personal data only to provide its service to me. Some are used only when a client switches the feature on or connects the account.
- Convex
- The database and server functions. Everything in a client's account is stored here.
- Where: Europe (Ireland)
- Vercel
- Hosts the app and serves its pages.
- Where: London for the app's server functions; pages are delivered through Vercel's network
- Clerk
- Sign-in for clients and their staff: names, email addresses and sign-in records.
- Where: United States
- Stripe
- Card payments for deposits and invoices. The client is the merchant on its own Stripe account, and card details go to Stripe, never to the CRM. When a card payment is refunded or disputed, the amount, the date and the bank's stated reason are recorded against that payment.
- Where: Stripe's own locations
- Resend
- Sends and receives email for a client, when email is set up.
- Where: Resend's own locations
- Twilio
- Sends and receives text messages for a client, when texting is set up. Also runs a client's business phone numbers and passes calls to the client's own phones, when a number is attached. Calls are not recorded.
- Where: Twilio's own locations
- Business Profile and Calendar, when a client or staff member connects them. When I add a client, the business name I type is sent to Google Places to find the business, and its name, address, phone number, website and opening hours are read from its public listing to fill in the form. Only Google's place identifier and the phone number and address I confirm are kept. A business can instead have its review widget show Google's own selection of its reviews: each time that widget is viewed my server asks Google Places for the business's rating, review count and up to five reviews, shows them with the Google Maps logo and keeps none of it. The reviewers' photos in that widget are loaded from Google by the visitor's own browser, so Google receives that browser's IP address as it would on any page showing Google content. Google Maps features and content are subject to the Google Maps Additional Terms of Service (https://maps.google.com/help/terms_maps/) and the Google Privacy Policy (https://policies.google.com/privacy).
- Where: Google's own locations
- Anthropic
- The Ask Boostkit assistant, only where it is switched on for a client. It is sent the question and the records it looks up to answer it: names, contact details, dates, statuses and amounts. Notes, messages, form and lead answers, custom fields, tags, review text, task details, appointment notes, the service on a booking, opportunity titles and lost reasons, invoice lines and automation content are withheld unless the client switches on "Let the assistant read sensitive details". It changes nothing until a person presses Confirm, and acts with that person's own permissions. Separately, where a client switches on a drafting helper, Anthropic is sent only what that helper needs: for a suggested reply to a review, the words and star rating of that review and the business's name, never the reviewer's name; for the summary a business can switch on for a review widget, which is off unless it does, the words and star ratings of the reviews that widget shows and the business's name, never a reviewer's name, sent at most once a day and only when those reviews have changed, with the summary shown on the business's website marked as written by AI; for a draft social post or email, the short brief a member of staff types. A person reads and sends every draft; nothing is posted by itself. Anthropic does not use this data to train its models.
- Where: United States
- Meta
- Facebook Pages, lead ads, Messenger and Instagram messages, and WhatsApp messages, which Meta carries, when a client connects them. Also receives conversion events with hashed contact details, only where a client switches that step on for its own Meta account.
- Where: Meta's own locations
- Microsoft
- Outlook or Microsoft 365 calendar, when a staff member connects one.
- Where: Microsoft's own locations
- Cloudflare
- Turnstile, the check that tells people from automated programs on booking pages, forms, payment link pages, estimates and the chat window, when it is switched on. It receives the visitor's IP address, technical details of their browser and connection and the address of the page. It is not sent what a visitor types, or anything from a client's account.
- Where: Cloudflare's own locations
A client can also create an API key for its own account and connect its own tools, such as an AI assistant. Those tools can then read and change that client's data. That is the client's choice and the client is responsible for the tools it connects.
I may also disclose data where the law requires it, or to professional advisers where needed to establish or defend a legal claim.
Transfers outside the UK
Client account data is stored in Ireland. Several of the providers above are based in the United States or use systems there, so some personal data, such as sign-in details and the contents of emails and texts being delivered, is handled outside the UK.
Where that happens, the transfer is covered by a safeguard that UK data protection law accepts: UK adequacy regulations for the country or scheme concerned, or the International Data Transfer Addendum in the provider's data processing terms. You can ask me for more detail about the safeguard used for a particular provider.
How long data is kept
- A client's account data is kept for as long as that client uses Boostkit. Inside an account, the client decides how long to keep its customers' records and can delete them at any time.
- When a client stops using Boostkit, I delete its account and everything in it within 90 days, unless the client asks for a copy first.
- Tokens for a connected Google, Facebook or Microsoft account are deleted when the connection is removed. Removing a staff calendar also deletes the busy times read from it.
- Copies of Google reviews are deleted when the Google connection is removed, and no copy is kept for more than 30 days without being read from Google again.
- If you send a request through the form on the data deletion page, your name, email address and what you wrote are kept so that I can act on it and show that I did.
- A booking that is waiting for a deposit is held for 15 minutes and released if the payment is not made.
- The record of a call (the number, time, length and outcome) is kept with the customer's record and deleted with it. There is no recording to keep.
- Your sign-in account is kept until your access is removed and you or the client ask for it to be deleted.
- Records I must keep by law, such as my own invoices to clients, are kept for the period the law requires.
How data is protected
- Every connection to the app is encrypted in transit.
- Access is by invitation to a verified email address, and each person has a role that limits what they can see and do.
- Every request to read or change data is checked on the server against the accounts the person is allowed to open, so one client cannot reach another client's data.
- Tokens and secrets for connected services are kept on the server and are never shown in the app.
- Card details are entered on Stripe's pages and never reach the CRM.
- Significant actions are recorded in an audit log the client can read.
Your rights
Under UK data protection law you can ask to:
- see the personal data held about you and get a copy of it;
- have it corrected if it is wrong;
- have it deleted;
- have its use restricted, or object to its use;
- receive data you provided in a form you can take elsewhere;
- withdraw consent where consent is the basis, such as for marketing messages.
If you are a customer of a business that uses Boostkit, the quickest route is to ask that business, because it is the controller. You can also write to me at matt@boostkit.io and I will pass your request to the business and help it respond. If you sign in to Boostkit, write to me directly. Requests are answered within one month, and there is no charge.
If you are unhappy with how your data has been handled, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
Children
Boostkit is a tool for businesses. It is not directed at children and is not meant to be used by anyone under 18. A client may hold details of a customer who is under 18 where its own services allow it; the client is responsible for doing so lawfully.
Changes to this notice
If the way Boostkit handles personal data changes, this notice is updated before the change takes effect and the date at the top changes with it. If Boostkit is ever to use Google or Facebook data in a new way, the people who connected those accounts are told and asked to agree first.
Contact
Questions about this notice, and requests about your data, go to matt@boostkit.io, or by post to Matt West, West Media Limited, 29 Prospect Road, Southborough, Tunbridge Wells, England, TN4 0EN.