Privacy policy
Version of 16 October 2026.
This English version is provided for convenience. In case of discrepancy, the French version prevails. Read the French version.
For businesses established in France.
Who processes your data
BoostImpact is a trading name of Girlden LTD, a company registered in England and Wales under number 14837617, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact for any question about your data: info@boostimpact.agency.
The company is established in the United Kingdom and offers its services to businesses located in France. Representative in the European Union within the meaning of article 27 of the General Data Protection Regulation (GDPR): A_DECIDER. No data protection officer has been appointed to date.
Depending on the data, the company acts in one of two roles:
- Controller for the data of its business clients, of businesses that request a free audit, and of visitors to this website.
- Processor, on behalf of the business, for the data of that business's own customers: review requests by email, reviews and comments received, messages left on the business's review page. The controller is then the business; its obligations and ours are set out in the data processing agreement. If you are a customer of a business, please send your requests to that business; if you write to us, we forward your request to it.
Data processed as controller
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Producing and sending the free audit of your Google listing, at your request | Business name, town or city, type of business, email; if you provide them: phone number, link to your Google listing | Pre-contractual measures taken at your request (article 6(1)(b) GDPR) | No period is set in the system to date: A_DECIDER |
| Writing to you at most three times after the audit (2, 5 and 10 days after the report is sent), unless you book a call, reply or unsubscribe | Email, business name, audit date, replies and unsubscription | Legitimate interest in presenting a service related to your business activity (article 6(1)(f)); you can object at any time using the link in each email | Unsubscription kept so we no longer write to you; other data: A_DECIDER |
| Providing the service to the business client: client area, content, replies to reviews, posts, service emails | Login email, contact's name and phone number, business information, uploaded photos, content produced, approval decisions, activity log | Performance of the contract (article 6(1)(b)) | Term of the contract, then A_DECIDER (no automatic deletion at the end of the contract to date) |
| Invoicing and keeping accounts | Company name, address, SIREN number, VAT number, invoices, payments | Legal obligation (article 6(1)(c)) | Statutory retention period for accounting records: A_VERIFIER |
| Keeping proof of acceptance of the terms of sale and the data processing agreement | Onboarding form, accepted version, date | Legitimate interest in proving the contract (article 6(1)(f)) | Term of the contract, then A_DECIDER |
| Keeping the services secure and running | Hosting providers' technical logs (IP address, date, page requested) | Legitimate interest (article 6(1)(f)) | Period set by each hosting provider: A_VERIFIER |
This website sets no audience measurement or advertising cookies. The client area keeps your session in your browser's local storage, which is necessary to stay logged in; logging out ends the session.
Data processed on behalf of businesses
| Why | What data | How long |
|---|---|---|
| Asking the business's customers for a review, once, with at most one reminder | First name, email, date of visit, customer's consent confirmed by the business; sending, page opening, click through to Google | Deleted 120 days after the visit or the request |
| No longer writing to people who have unsubscribed | Email, reason (unsubscribe link or request to the business) | For as long as the business is a client, so that the unsubscription can be honoured |
| Replying to the business's Google reviews | Review text, rating, author's first name and initial, review identifier, reply | Text, rating and author deleted 30 days after receipt; the identifier is kept so the same review is not handled twice |
| Replying to comments received on the business's social networks (plans that include it) | Comment text, name displayed by the network, identifier, reply | Text and author deleted 30 days after receipt |
| Passing on to the business a message left on its review page | Rating, message and first name, both optional; no email address | No period set to date: A_DECIDER |
| Producing content from the business's photos | Uploaded photos, which may show people | Term of the contract, then A_DECIDER |
| Editing a video from the videos filmed by the business (plans that include it) | Original uploaded videos, which may show people and their voices, attached photos, the business's note | Original videos deleted 30 days after the edit is approved or rejected; an unfinished upload is deleted after 24 hours. The edited video follows the rule for content |
A review page or an approval link only opens with a random identifier that cannot be guessed; an approval link can be used once only and expires after 7 days.
Recipients and processors
Your data is neither sold nor rented. It is accessible to the company's authorised staff and to the following providers, each for its own task:
| Provider | Role | Location | Safeguard for transfers outside the Union |
|---|---|---|---|
| Supabase Pte. Ltd. | Database, accounts, client area files | Project in a European region; company in Singapore | European Commission standard contractual clauses (Supabase pages read on 13/10/2026) |
| GitHub, Inc. | Production of content and audits (GitHub Actions); hosting of the preview (GitHub Pages) | United States | EU–US Data Privacy Framework and standard contractual clauses (GitHub privacy statement read on 13/10/2026) |
| n8n | Automations: sending emails, chaining tasks | A_VERIFIER (n8n Cloud or a server chosen by the company) | A_VERIFIER |
| Anthropic | Writing captions, replies to reviews and ideas (Claude), including photo analysis | United States | Data processing addendum included in the commercial terms, with standard contractual clauses (Anthropic page read on 13/10/2026) |
| Reading reviews and publishing on the Google listing (Business Profile API); public listing data for the audit (Places API) | A_VERIFIER | A_VERIFIER | |
| Metricool | Scheduling posts on social networks | A_VERIFIER | A_VERIFIER |
| Higgsfield Inc. | AI-produced videos (not used at present) | United States | EU–US Data Privacy Framework or standard contractual clauses, according to its privacy policy read on 13/10/2026; A_VERIFIER for business use |
| Email sending provider | Sending and receiving emails | Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) | A_VERIFIER |
| Production host of the website and client area | Putting pages online; receiving the website's forms | netlify | If Netlify: EU–US Data Privacy Framework and standard contractual clauses (Netlify policy read on 13/10/2026) |
Posts approved by the business are, by their nature, made public on its Google, Facebook, Instagram or TikTok accounts.
Transfers outside the European Union
As the company is established in the United Kingdom, the data of people located in the European Union is transferred to it in the United Kingdom. Safeguard applicable to this transfer: A_VERIFIER. Transfers to the providers above rely on the safeguards shown in the table.
Your rights
You can ask for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and you can object to processing based on legitimate interest, in particular to prospecting emails: the unsubscribe link in each email is enough. Write to info@boostimpact.agency. You will receive a reply within the time limits set by the GDPR.
Texts written by artificial intelligence are submitted to the business or governed by its settings; no decision producing legal effects concerning you is made by automated means.
You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): cnil.fr/fr/adresser-une-plainte. As the company is established in the United Kingdom, the UK authority, the Information Commissioner's Office, can also be contacted: ico.org.uk.
Security
Login to the client area by a link sent by email, with no password. Each business sees only its own data, a rule enforced by the database itself. Access keys to the services never leave the servers. Exchanges are encrypted (https).
Changes
This policy may change; the version in force is dated at the top of this page. Business clients are notified by email of any change that concerns them.