Data controller
The controller is Alfercom S.r.l., registered office at Via Altinate 125, 35121 Padua (PD), Italy — VAT IT05068010288.
For anything concerning personal data, including exercising the rights described below, the contact point is the form, choosing the Data protection subject.
Alfercom has appointed a Data Protection Officer, reachable at the same address.
What we collect, why, and on what legal basis
Joining the waitlist
When you join the waitlist we collect your email address, the product you selected (Personal, Business or both), the language of the site you were using, the date of your first and latest signup, and the country the request came from, derived from your IP address by our infrastructure (we do not store the IP address alongside the signup — only the country code, e.g. IT).
Purpose: to tell you when Booost launches, to inform you about the founding offer reserved for the waitlist, and to send you the welcome email confirming your signup.
Legal basis: your consent (Art. 6(1)(a) GDPR), given by completing and submitting the form with the stated purpose next to it. You can withdraw it at any time through the form, without affecting the lawfulness of processing carried out beforehand.
Retention: until the product launch and the communications connected to it, and in any case no longer than 24 months from your last interaction — unless you ask us to delete it sooner, which we do straight away.
The welcome email
On your first signup we send one welcome email. To deliver it we disclose your email address to our sending provider (see Recipients). We do not sign you up to any recurring newsletter and we will not send you marketing about third-party products.
The "Booo" chat
If you open the site chat, the text of the messages you write is sent to an AI model running on Cloudflare's infrastructure (Workers AI), together with Booost's public documentation, to generate the answer.
We do not store the conversations on our systems, we do not link them to you, and we do not use them to train models. The model provider acts as our processor and does not train its models on the content submitted.
Legal basis: legitimate interest (Art. 6(1)(f)) in helping people who visit the site, in a form that does not require identifying them.
Because the chat exists to answer questions about Booost, please do not enter personal data in it — yours or anyone else's — beyond what the question requires.
The contact form
When you write to us through the form we keep your name, email address, the subject you chose, your message and the country the request came from, so that we can answer you and keep track of what was asked. We keep them for 24 months, then they are deleted automatically; sooner if you ask.
Legal basis: legitimate interest (Art. 6(1)(f)) in answering the people who write to us; for data-protection requests, our legal obligation to handle them (Art. 6(1)(c)).
Abuse and bot protection
To stop the waitlist form being flooded by scripts and the chat from generating runaway costs, we apply two measures:
- A per-IP rate limit. Your IP address is used as a technical counting key for requests and is automatically deleted within 48 hours at most (20 minutes for the waitlist and the chat, 30 minutes for the contact form, 48 hours for the ghost hunt). It is not linked to your signup.
- Cloudflare Turnstile, a bot check that does not profile users. When the check runs, your IP address and a token are transmitted to Cloudflare.
Legal basis: legitimate interest (Art. 6(1)(f)) in the security of the service and the prevention of abuse.
Audience measurement
To know how many people visit the site and which links bring them here, we use Cloudflare Web Analytics. It sets no cookie and writes no identifier to your device. It records the page you opened, the link that referred you, your browser and your country, plus how fast the page loaded. Your IP address is used to work out the country and is then discarded: it is neither stored nor linked to you, and no profile is built. The measurement is sent back to booost.network itself, not to an outside domain.
Legal basis: legitimate interest (Art. 6(1)(f)) in knowing, in aggregate, whether the site works and how people find it.
The currency shown on the pricing page
So that someone outside the euro area reads a price in a currency they use, the pricing page asks our own server which country the request came from. Cloudflare derives the country from your IP address before we ever see it, and only the two-letter country code reaches the page: the address itself is neither transmitted to us nor stored, nothing is written to your device, and no profile is built. Payment is always taken in euro, and the page says so next to the converted figure.
Legal basis: legitimate interest (Art. 6(1)(f)) in quoting a price in a form the reader can actually use.
Technical browsing logs
Like any website, the infrastructure serving these pages processes the technical data needed to deliver them (IP address, browser type, page requested, timestamp). It serves to deliver the site, keep it secure and diagnose faults.
Legal basis: legitimate interest (Art. 6(1)(f)).
The typeface
These pages use the high-legibility Atkinson Hyperlegible Next typeface. We serve it from our own servers: loading a page, your browser contacts neither Google Fonts nor any other external domain, and no third party learns your IP address.
What we do not do
- No third-party requests that track you. Fonts, stylesheets and images all come from our own domain. Two external calls happen on their own, and both go to Cloudflare, which already hosts this site: Turnstile, the bot check protecting the waitlist form, and Web Analytics, which counts page views without cookies, without storing your IP address and without following you between sites.
- No profiling. No advertising tracking, no third-party pixels, no marketing cookies.
- No behavioural analytics. We do not use Google Analytics or anything equivalent. Our page counting is aggregate and cookieless: it builds no profile of you and cannot follow you from one site to another.
- No selling or sharing your data with third parties for their own purposes.
- No AI model training on your data.
- No automated decision-making producing legal effects concerning you.
Recipients
Your data is handled by our authorised personnel and by the providers listed below, appointed as processors under Art. 28 GDPR.
| Provider | What it does | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, waitlist and contact-form storage (Workers KV), running the chat model (Workers AI), bot protection (Turnstile), audience measurement (Web Analytics), content delivery | Waitlist signup, contact-form messages, chat messages, IP address, technical logs, page views |
| VibeDojo (sending.dev) | Sending and delivering the welcome email and the messages written through the contact form | Email address, email content |
Transfers outside the European Union. Some of these providers are US companies or may process data outside the European Economic Area. Where that happens, the transfer relies on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) and/or the provider's certification under the EU-US Data Privacy Framework, with the supplementary measures set out in the respective data processing agreements.
We may also disclose data to judicial or other public authorities where the law requires it.
Your rights
You can exercise the rights under Articles 15-22 GDPR at any time:
- access to your data and a copy of it;
- rectification of inaccurate data;
- erasure ("right to be forgotten");
- restriction of processing;
- portability in a machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, for processing that relies on it.
To exercise them, fill in the form choosing Data protection — no account needed. We reply within 30 days. We ask for no forms and no explanations: if you ask us to remove you from the waitlist, we remove you.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of the country where you live.
Security
The site is served over HTTPS only, with security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) active on every page. Access to waitlist data is restricted to authorised personnel. We store no passwords, because the site has no user accounts.
Changes to this notice
If we change how we process data we update this page and the "last updated" date at the top. If a change is material and directly affects you — for instance a new purpose for waitlist subscribers — we tell you by email before it takes effect.
Related
- Cookie policy — what (little) gets stored on your device, and why there is no consent banner.
- Website terms of use — the waitlist, the founding offer and the AI chat.
This notice is written in Italian. The English version is a courtesy translation: in case of any discrepancy, the Italian version prevails. You can read it here.