Privacy
policy.

This is a translation provided for convenience; in case of discrepancy the French version prevails. Read the French version.

This privacy policy describes how BoostVote collects, uses and protects users' personal data, in compliance with Regulation (EU) 2016/679 (GDPR) and the amended French law no. 78-17 of January 6, 1978 (Informatique et Libertés).

1. Data controller

The controller of the personal data collected through boostvote.fr is the publisher of the BoostVote service. Any request regarding the processing of your data can be sent through the official Discord server.

2. Data collected

Data provided by the user

• Registration data: email address, password (hashed).
• Profile data: display name.
• Bot configuration data: in-game name (Minecraft username, account or character name depending on the game), login credentials for voting sites or servers (encrypted), choice of enabled sites, Telegram configuration (bot token, chat ID) where applicable.
• 2FA verification codes: passed on temporarily so the bot can log in, not kept beyond that use.

Data collected automatically

• Connection data: IP address, user agent, login timestamps.
• Usage data: vote statistics (successes, failures, sites concerned, timestamps), technical bot logs.
• Billing data: provided by Stripe (customer IDs, subscription status, history).

Cookies

Only strictly necessary cookies are set: the Laravel session cookie (authentication) and the CSRF cookie (form security). No advertising cookie or third-party audience measurement without consent.

3. Purposes and legal bases

Purpose	Legal basis
Creating and managing the user account	Performance of the contract (art. 6.1.b GDPR)
Running the automated voting service	Performance of the contract (art. 6.1.b)
Billing and subscription management	Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c)
Security, fraud prevention, logging	Legitimate interest (art. 6.1.f)
Service notifications (2FA alerts, errors)	Performance of the contract (art. 6.1.b)
Marketing communications (where applicable)	Consent (art. 6.1.a)

4. Retention periods

• Account data: for the whole duration of the contractual relationship, then deleted within 30 days of cancellation, unless legal obligations require otherwise.
• Billing data: 10 years (accounting obligation, art. L.123-22 of the French Commercial Code).
• Technical logs and vote logs: 12 months maximum.
• Connection logs: 12 months (article L.34-1 of the French Postal and Electronic Communications Code).
• 2FA codes: single use, not kept.

5. Recipients and processors

Personal data is neither sold nor passed on to third parties for commercial purposes. The following processors handle data on behalf of BoostVote:

• OVH SAS (France) — hosting of the servers and the database.
• Stripe Payments Europe Ltd (Ireland / EU) — payment processing and subscription management. Stripe privacy policy.
• Third-party voting sites — the server lists on which the game server you chose is listed, indirect recipients through the bot, which logs in on your behalf.
• Third-party technical providers — ancillary technical services used by the bot to submit votes (with no identifying personal data passed on beyond the in-game name).
• Telegram Messenger Inc. — only if the user enables Telegram notifications and provides their chat ID.

Each processor is contractually bound by confidentiality and security obligations compliant with the GDPR.

6. Transfers outside the EU

Data is hosted in the European Union (OVH France). Some technical processors (Stripe, ancillary technical providers, Telegram) may process data from third countries; these transfers rely on the European Commission's standard contractual clauses and/or the applicable adequacy decisions.

7. Security

BoostVote implements reasonable technical and organizational measures to protect data:

• User passwords hashed (bcrypt algorithm).
• Game and voting site credentials encrypted in the database.
• Isolation in a dedicated Docker container for each bot.
• TLS/HTTPS encrypted communication across the whole website.
• CSRF protection, input validation, logging of sensitive actions.
• Restricted and logged access to data.

In the event of a data breach likely to result in a risk to users' rights and freedoms, the CNIL and the people concerned will be notified within the legal deadline (72 hours).

8. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access — get a copy of the data concerning you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — subject to legal retention obligations.
• Right to restriction of processing.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object to processing based on legitimate interest.
• Right to withdraw your consent at any time for processing based on consent.
• Right to set post-mortem instructions regarding what happens to your data.

To exercise your rights, contact the publisher through the official Discord server, with proof of your identity. A reply is provided within one month, which may be extended by two months if the request is complex.

You also have the right to lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr).

9. Minors

The service is not intended for people under 15 years of age. Minors aged 15 to 18 must obtain prior permission from their legal guardians to take out a paid subscription.

10. Changes

This policy may be updated to reflect changes to the service, the processors or the regulations. The date of the last update is shown at the top of the page. Substantial changes will be notified by email or via the dashboard.

11. Contact

Any question about the processing of your data can be sent via our Discord.