Privacy Policy

The data controller is Julien Echavidre, sole proprietorship (EI) — SIREN 511 181 778.

Postal address: 4, rue Madame Jan, 44260 Savenay, France.

For any question about this policy or your data, write to hello@boostmy.site. We answer within 30 days, usually much sooner.

We only collect what we need to run the service. Depending on how you use Boost My Site, this includes:

• Account data: your email address, your name if you give it, and a password that we never see in clear text (it is stored as a hash by our authentication provider). You can also sign in with a link sent by email.
• Waitlist data: if you join the waitlist on our public website, your email address and the page you joined from.
• Project data: what you tell us about your business (activity, offers, products, target customers, brand voice, goals) and the content we create for you (plans, articles, pages, emails, images, audits).
• Public website content: when you create a project, we read the public pages of your website once, to understand your business. We only read pages anyone can see on the internet.
• Connected services: if you connect your WordPress site, the application password you give us, stored encrypted. If you connect your Google account, the data described in section 3.
• Conversations: the messages you exchange with your AI employees inside the application.
• Technical data: logs needed for security and to fix errors (date and time, pages requested, error messages, IP address), and the cookies listed in section 11.

We do not collect payment card numbers, sensitive data (health, religion, political opinions…) or data about children, and we ask you not to put such data in your projects.

You can connect a Google account to a project, so that Boost My Site and its AI employees work from your website's real measurements instead of guesses. Connecting is optional, done project by project, and only happens when you click "Sign in with Google" and accept Google's consent screen.

We ask Google for the following access, and use each one only for the purpose stated here:

• Your Google account email address (openid, email): to show which Google account is connected to the project.
• Search Console, read only (https://www.googleapis.com/auth/webmasters.readonly): to list the Search Console properties you can access, so you choose your website, and to read its search performance: clicks, impressions, click-through rate and average position, by day, search query, page and device.
• Google Analytics, read only (https://www.googleapis.com/auth/analytics.readonly): to list your Analytics properties and read your website's audience reports: users, new users, sessions, engaged sessions, page views and key events, by day, traffic source, landing page, page and device.
• Google Analytics, edit (https://www.googleapis.com/auth/analytics.edit): only to set up, in the Analytics property you chose, the key events (conversion goals) that match your business, when you ask your AI analyst to do it. We never delete your properties, your data streams or your historical data, and we never change your account users or permissions.

What we keep: the Google account email, the properties you selected, and a copy of the measurements listed above (16 months of daily totals and 90 days of detail when you connect, then the last few days every night). We do not read or keep the identity of your website's visitors: Google only gives us aggregated figures.

How we protect it: Google gives us a refresh token, which we store encrypted in a dedicated secret vault. It is never sent to your browser and never shown on screen. The measurements are only visible to the members of the project.

How we use it: only to show you your figures in Boost My Site and to let your AI employees analyse them, answer your questions and recommend or carry out the actions you ask for. When an AI employee analyses your figures, the relevant figures are sent to the AI model that writes its answer (see section 5), only to produce that answer for you.

What we never do with Google data: we do not sell it; we do not use it or transfer it for advertising, retargeting or interest-based ads; we do not use it to build or train generalised artificial intelligence or machine-learning models; we do not use it to determine creditworthiness or for lending; and we do not let anyone read it, except you and the members of your project, unless you explicitly ask us to (for example for support), it is necessary for security or to comply with the law, or it has been aggregated and anonymised for internal operations.

Limited Use: Boost My Site's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy .

Disconnecting: in Project settings › Integrations, "Disconnect" revokes our access at Google, deletes the token from our vault and deletes all the measurements copied for that project. You can also remove our access at any time from your Google account: https://myaccount.google.com/permissions . If access is removed on Google's side, we stop reading your data immediately and delete it on request or when you disconnect the project.

• To provide the service: create and manage your account and projects, produce the content and analyses you ask for, connect your website, publish on your site only when you approve it.
• To keep the service safe and working: detect abuse, prevent fraud, fix errors, cap spending.
• To talk to you: answer your messages, send emails about your account or your projects, and, if you joined the waitlist, tell you when the platform opens.
• To improve Boost My Site: understand which features are used, from aggregated technical data. We do not use your Google data for this.

We do not sell your personal data, and we do not show advertising in Boost My Site.

Boost My Site's AI employees use language and image models from third-party providers, which we reach through OpenRouter. To answer you, the information needed for the task (for example your business description, a page of your website or a set of figures) is sent to the model, which returns a result. This data is sent only to produce the result you asked for. We do not use your data, and in particular your Google data, to train AI models, and we do not send it to AI providers for any other purpose.

AI can make mistakes. Nothing is published on your website, and no setting is changed in your accounts, without your approval or a rule you set yourself.

• Performance of our contract with you: account, projects, content, connections you ask for.
• Your consent: connecting your Google account, joining the waitlist. You can withdraw it at any time, without affecting what was done before.
• Our legitimate interest: security, error fixing, improving the service, in a way that respects your rights.
• Legal obligations: keeping some records when the law requires it.

We use a small number of service providers, who only process your data on our instructions and to provide their service:

• Supabase: database, authentication, file storage and server functions. Data is hosted in the European Union (Ireland).
• Vercel: hosting of the website and the application.
• OpenRouter and the AI model providers it routes to: text and image generation (section 5).
• Google: Search Console, Analytics and PageSpeed services, when you connect them or ask for a performance audit.
• DataForSEO: search engine data (keywords, search results, competitors) for your projects. We send it keywords and domain names, not your personal data.
• Browserless: reading the public pages of your website.
• Our own processing server, rented from a hosting provider, which runs long tasks such as writing an article.

We may also disclose data if the law requires it, or to protect the rights and safety of our users. If Boost My Site were sold or merged, your data would be transferred under the same commitments, and you would be told beforehand.

Some providers listed above are located, or have subprocessors, outside the European Union, in particular in the United States. In that case, transfers are covered by the European Commission's adequacy decision (EU-US Data Privacy Framework) when the provider is certified, or by the European Commission's standard contractual clauses.

• Account and project data: as long as your account is active. When you delete your account, we delete it within 30 days, except what the law requires us to keep.
• Google measurements and token: until you disconnect Google from the project, delete the project or delete your account.
• Waitlist: until the platform opens to you or you ask us to remove you, and at most 3 years.
• Technical logs: up to 12 months.

We protect your data with encrypted connections (HTTPS), encryption of secrets such as your Google and WordPress credentials, access rules in the database so that each project's data is only readable by its members, and limited administrative access. No system is perfectly secure: if a breach affecting your data occurred, we would inform you and the competent authority as the law requires.

We only use cookies that are strictly necessary for the service, which do not require your consent:

• Session cookies from our authentication provider, to keep you signed in.
• A language cookie, to display the application in the language you chose.
• A cookie that remembers the project you were last working on.

We do not use advertising cookies or third-party tracking cookies.

You can ask us at any time to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw your consent. Write to hello@boostmy.site; we may ask you to prove your identity.

You can also lodge a complaint with your data protection authority. In France, it is the CNIL: https://www.cnil.fr .

Boost My Site is a professional service. It is not intended for people under 16, and we do not knowingly collect their data.

We may update this policy when the service changes. The effective date at the top of the page shows the latest version. If a change significantly affects how we use your data, in particular your Google data, we will tell you before it applies and ask for your consent again when required.

Julien Echavidre, sole proprietorship (EI) — SIREN 511 181 778

4, rue Madame Jan, 44260 Savenay, France

hello@boostmy.site