Data controller
The controller is Alfercom S.r.l., registered office at Via Altinate 125, 35121 Padua (PD), Italy — VAT IT05068010288.
For anything concerning personal data, including exercising the rights described below, the contact point is [email protected].
Alfercom has appointed a Data Protection Officer, reachable at the same address.
What we collect, why, and on what legal basis
Joining the waitlist
When you join the waitlist we collect your email address, the product you selected (Personal, Business or both), the language of the site you were using, the date of your first and latest signup, and the country the request came from, derived from your IP address by our infrastructure (we do not store the IP address alongside the signup — only the country code, e.g. IT).
Purpose: to tell you when Booost launches, to inform you about the founding offer reserved for the waitlist, and to send you the welcome email confirming your signup.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by completing and submitting the form with the stated purpose next to it. You can withdraw it at any time by writing to [email protected], without affecting the lawfulness of processing carried out beforehand.
Retention: until the product launch and the communications connected to it, and in any case no longer than 24 months from your last interaction — unless you ask us to delete it sooner, which we do straight away.
The welcome email
On your first signup we send one welcome email. To deliver it we disclose your email address to our sending provider (see Recipients). We do not sign you up to any recurring newsletter and we will not send you marketing about third-party products.
The "Booo" chat
If you open the site chat, the text of the messages you write is sent to an AI model running on Cloudflare's infrastructure (Workers AI), together with Booost's public documentation, to generate the answer.
We do not store the conversations on our systems, we do not link them to you, and we do not use them to train models. The model provider acts as our processor and does not train its models on the content submitted.
Legal basis: legitimate interest (Art. 6(1)(f)) in helping people who visit the site, in a form that does not require identifying them.
Because the chat exists to answer questions about Booost, please do not enter personal data in it — yours or anyone else's — beyond what the question requires.
Abuse and bot protection
To stop the waitlist form being flooded by scripts and the chat from generating runaway costs, we apply two measures:
- A per-IP rate limit. Your IP address is used as a technical counting key for requests and is automatically deleted within 20 minutes. It is not linked to your signup.
- Cloudflare Turnstile, a bot check that does not profile users. When the check runs, your IP address and a token are transmitted to Cloudflare.
Legal basis: legitimate interest (Art. 6(1)(f)) in the security of the service and the prevention of abuse.
Technical browsing logs
Like any website, the infrastructure serving these pages processes the technical data needed to deliver them (IP address, browser type, page requested, timestamp). It serves to deliver the site, keep it secure and diagnose faults.
Legal basis: legitimate interest (Art. 6(1)(f)).
The typeface
These pages use the high-legibility Atkinson Hyperlegible Next typeface. We serve it from our own servers: loading a page, your browser contacts neither Google Fonts nor any other external domain, and no third party learns your IP address.
What we do not do
- No third-party requests that track you. Fonts, stylesheets, scripts and images all come from our own domain. The only external call that happens on its own is to Cloudflare Turnstile, the bot check protecting the waitlist form, and that is all it does.
- No profiling. No advertising tracking, no third-party pixels, no marketing cookies.
- No behavioural analytics. We do not use Google Analytics or anything equivalent.
- No selling or sharing your data with third parties for their own purposes.
- No AI model training on your data.
- No automated decision-making producing legal effects concerning you.
Recipients
Your data is handled by our authorised personnel and by the providers listed below, appointed as processors under Art. 28 GDPR.
| Provider | What it does | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, waitlist storage (Workers KV), running the chat model (Workers AI), bot protection (Turnstile), content delivery | Waitlist signup, chat messages, IP address, technical logs |
| VibeDojo (sending.dev) and Amazon Web Services (Amazon SES) | Sending and delivering the welcome email | Email address, email content |
Transfers outside the European Union. Some of these providers are US companies or may process data outside the European Economic Area. Where that happens, the transfer relies on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) and/or the provider's certification under the EU-US Data Privacy Framework, with the supplementary measures set out in the respective data processing agreements.
We may also disclose data to judicial or other public authorities where the law requires it.
Your rights
You can exercise the rights under Articles 15-22 GDPR at any time:
- access to your data and a copy of it;
- rectification of inaccurate data;
- erasure ("right to be forgotten");
- restriction of processing;
- portability in a machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, for processing that relies on it.
To exercise them, write to [email protected]. We reply within 30 days. We ask for no forms and no explanations: if you ask us to remove you from the waitlist, we remove you.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of the country where you live.
Security
The site is served over HTTPS only, with security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) active on every page. Access to waitlist data is restricted to authorised personnel. We store no passwords, because the site has no user accounts.
Changes to this notice
If we change how we process data we update this page and the "last updated" date at the top. If a change is material and directly affects you — for instance a new purpose for waitlist subscribers — we tell you by email before it takes effect.
Related
- Cookie policy — what (little) gets stored on your device, and why there is no consent banner.
- Website terms of use — the waitlist, the founding offer and the AI chat.
This notice is written in Italian. The English version is a courtesy translation: in case of any discrepancy, the Italian version prevails. You can read it here.