Privacy policy | Next Level Boost

Who is responsible

The controller for your data on this site is Next Level Boost. Questions about your data: support@nextlevelboost.example.

What we collect

Your account: email, username, password (stored only as a secure hash), and Discord or Google ID if you sign in with them.
Order details: game, service, server, your picks and the notes you give us.
Game logins for piloted orders.
Chat messages and images on your orders, support tickets and the live chat (with the email you give us there).
Your in-game name and public game stats while an order runs (rank, matches), read from the game publisher's API.
Payment records: amount, provider, payment reference and refunds. Never your card details.
Booster applications: games, ranks, Discord and the screenshots you send.
Security logs: IP address on sign-in and other sensitive actions, sessions, and country from your connection.

Why, and on what basis

To run your orders and your account (contract, GDPR Art 6(1)(b)): taking payment, giving your order to a pro, the chat, tracking, refunds and support.
To keep accounts and payments safe (legitimate interests, Art 6(1)(f)): security logs, fraud and chargeback checks, hiding contact details in chats.
To meet legal duties (Art 6(1)(c)): invoices and accounting records, and answering lawful requests.
Promo emails (consent, Art 6(1)(a)): only if you ticked "Deals and promos by email". You can take it back at any time.
Anonymous visit counts (legitimate interests): to see which pages help, without identifying you.

We don't sell your data and we don't use it for advertising profiles.

Game logins

Encrypted at rest (AES-256), shown only to the pro on your order while they work on it, every view logged, and deleted when the order closes.

Order chat

Your pro and our support team can read the chat on your order. Emails, Discord names and phone numbers are hidden automatically to keep deals on the site.

Services we use

These services handle data for us, each only what it needs for its job:

Railway: hosting and the database.
Resend: sending emails.
Stripe and PayPal: payments. Each is also responsible for its own payment and fraud checks.
NOWPayments: crypto payments, only if you pay in crypto.
Discord and Google: sign-in, only if you choose it.
Riot Games, FACEIT, HenrikDev and Apex Legends Status APIs: public game stats for order tracking.
Discord: alerts to our team's private channels about orders, tickets and disputes. They can include your username, the order and its amount, and the text of a ticket or dispute; your email only if we switch that on. Never game logins.
Backup storage (for example Cloudflare R2): encrypted copies of the database, if switched on.
Plausible: anonymous visit counts, only if switched on.
Cloudflare: network protection, if we put it in front of the site.
Cloudflare Turnstile: a quick check that sign-ups, guest checkouts, chats and contact forms come from a person, if switched on. It sees your IP address and browser details for that check only.

Outside the EU

Some of these services are based in the United States. Where data leaves the EU, it is protected by the EU-US Data Privacy Framework or the EU's standard contractual clauses.

How long we keep it

Game logins: until the order closes.
Orders, payments and invoices: as long as tax and accounting law requires, up to 10 years.
Chats and tickets: while your account exists, then removed with it.
Sent-email log: 30 days.
Everything else: until you delete your account.

Cookies and counting

One cookie keeps you logged in. When you sign in with Discord or Google, a second short cookie (10 minutes) checks that the sign-in really came from you. Your calculator choices, recently viewed games, language, currency, privacy choice, a saved discount code, the referral code from a friend's link and the key to your live chat are kept in your browser. No tracking or ad cookies.

We count visits anonymously: which page, and whether a calculator or checkout was opened, added up per day. We store no cookie, IP address or anything else that identifies you, On your first visit a small banner asks once: "Only necessary" switches counting off, "Accept all" keeps it on. To change it later, use "Privacy choices" at the bottom of every page. Browsers that send Do Not Track or Global Privacy Control are never counted.

Emails

We email you about your orders and account. You can switch off order updates in your settings. Promo emails go out only if you said yes, and every one has a one-click unsubscribe.

Your rights

You can ask for a copy of your data, to correct it, to delete it, to limit or object to how we use it, and to get it in a portable format. You can take back consent at any time. For a copy, use "Download my data" in Dashboard, Settings. To delete your account, open a ticket on the support page; we erase your personal data within 30 days, and keep only order and payment records the law requires, without anything that identifies you.

You can also complain to a data protection authority, in particular the one where you live.