Privacy policy

IMPACTIQ, S.L. (hereinafter, “boostiQ” or “the Controller”) respects the privacy of users and is committed to protecting the personal data entrusted to it. The purpose of this Privacy Policy is to inform the user, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and other applicable regulations, about the processing of their personal data.

2.1. Data controller

  • Identity: IMPACTIQ, S.L.
  • Tax ID (NIF): B70890264
  • Address: Calle del Cidro 3, Oficina 111, 28044 Madrid (Spain)
  • Contact email for data protection matters: [email protected]
  • Data Protection Officer (DPO): boostiQ has not appointed a Data Protection Officer. For any matter relating to the processing of your personal data you may contact [email protected].

2.2. Data we process

boostiQ processes the following categories of personal data depending on the context:

  • Identifying and contact data: first name, surname, business email, telephone, company, job title.
  • Browsing data: IP address, device identifiers, browser, operating system, pages visited, time spent, source of the visit.
  • Account and service usage data: access credentials (encrypted), history of prompts and conversations with the assistant, credit usage, account settings, connected integrations.
  • Payment data: processed directly by our provider Stripe Payments Europe, Ltd. boostiQ does not store full card details on its systems. We receive only confirmation of the charge, the last 4 digits, the card brand and the card country for billing and fraud prevention purposes.
  • Advertising campaign and analytics data connected by the customer: when the customer authorises the OAuth connection of their Meta Ads, Google Ads, LinkedIn Ads or Google Analytics 4 accounts, boostiQ accesses metrics, campaign identifiers, audiences, creative information and, in some cases, aggregated data on the customer’s end users. boostiQ processes this data as a Processor on behalf of the customer (see DPA).
  • Communications data: the content of messages the user sends us via the contact form, email, support chat, etc.

2.3. Purposes and legal bases

boostiQ processes personal data for the following purposes, on the legal basis indicated in each case:

  • Handling the free trial request and account registration: performance of pre-contractual and, where applicable, contractual measures (Art. 6(1)(b) GDPR).
  • Provision of the contracted SaaS service: performance of the contract (Art. 6(1)(b) GDPR).
  • Invoicing and accounting/tax obligations: compliance with legal obligations (Art. 6(1)(c) GDPR).
  • Handling enquiries, technical support and complaints: performance of the contract and/or consent (Art. 6(1)(b)/(a) GDPR).
  • Sending commercial communications and newsletters: the user’s express consent (Art. 6(1)(a) GDPR and Art. 21 LSSI). The user may withdraw consent at any time.
  • Service improvement, usage metrics and fraud prevention: legitimate interest of the Controller (Art. 6(1)(f) GDPR), provided that the rights and freedoms of the user do not prevail.
  • Compliance with judicial or administrative requests: compliance with legal obligations (Art. 6(1)(c) GDPR).

2.4. Data retention

Data is retained for the following periods:

  • Customer account data: for the entire term of the contract. After cancellation, it is retained for up to 90 days in a “bin” state to facilitate possible reactivation, unless an express request for earlier deletion is made.
  • Billing data: 6 years, in accordance with Article 30 of the Spanish Commercial Code and tax regulations.
  • Prospect data (contact forms without a contract): 24 months from the last effective contact, unless the user requests deletion earlier.
  • Subscription to commercial communications: until the user withdraws consent.
  • Technical logs and security records: 12 months, unless there are legitimate reasons to retain them longer (security incidents, judicial requests).

2.5. Recipients and processors

boostiQ shares personal data with the following processors, all of which are contractually bound in accordance with Art. 28 GDPR:

  • Stripe Payments Europe, Ltd.: secure payment processing. Based in Ireland, with transfers to the USA under the European Commission’s standard contractual clauses (SCCs).
  • Hosting / cloud provider (Hostalia): hosting of the Website. Based in Spain.
  • Clientify: management of leads from the contact form, transactional email and email marketing. Based in Spain.
  • Google LLC: web analytics (Google Analytics 4) and measurement services. Where authorised by the user via the cookie banner.
  • Meta Platforms Ireland Ltd.: measurement and optimisation of advertising campaigns via the Meta pixel. Where authorised by the user via the cookie banner.
  • Anthropic PBC (United States): processing, by means of language models, of the instructions and queries the user enters on the Platform, in order to generate the copilot’s responses, analyses and recommendations.

Additionally, when the user, in the course of using the Platform, connects their advertising platform accounts (Meta Ads, Google Ads, LinkedIn Ads) or analytics accounts (Google Analytics 4), boostiQ accesses those platforms on behalf of the user, acting as a Processor. This relationship is governed by the Data Processing Agreement (DPA) available at /dpa.

boostiQ does not disclose data to third parties beyond those indicated, except where required by law or by court order.

2.6. International transfers

Some of the processors (notably Stripe, Google, Meta and Anthropic) may process data in the USA or other countries outside the European Economic Area. In all cases, boostiQ requires appropriate safeguards in accordance with Chapter V of the GDPR: standard contractual clauses approved by the European Commission, adequacy certifications or equivalent.

2.7. User rights

The user may at any time exercise the following rights over their personal data:

  • Right of access: to obtain confirmation of whether their data is being processed and, where applicable, a copy of it.
  • Right to rectification: to correct inaccurate data.
  • Right to erasure (“right to be forgotten”): to request the deletion of their data.
  • Right to restriction of processing: to request the suspension of processing in certain circumstances.
  • Right to data portability: to receive their data in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
  • Right to object: to object to the processing of their data on grounds relating to their particular situation.
  • Right not to be subject to automated decision-making: including profiling, except in the cases provided for by law.
  • Right to withdraw consent: without affecting the lawfulness of the prior processing.

To exercise any of these rights, the user may write to [email protected] clearly stating the right being exercised and attaching, where applicable, a document proving their identity. boostiQ will respond within a maximum period of one month.

The user also has the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if they consider that the processing of their data does not comply with the regulations.

2.8. Security

boostiQ has implemented appropriate technical and organisational measures to guarantee the security of personal data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of users.

The measures adopted include: encryption in transit (HTTPS/TLS 1.2+), encryption of credentials at rest, role-based access control, regular backups, activity logging, staff training and security incident response procedures.

In the event of a personal data breach, boostiQ will notify the AEPD and, where appropriate, the affected users, within the time limits and under the conditions provided for in the GDPR. Incident notification email: [email protected].

2.9. Automated decisions

Some boostiQ features use artificial intelligence to analyse campaigns and suggest or execute actions (MKT, THINK and EXECUTOR modes). These functions operate under the supervision and control of the user, who decides at all times what level of autonomy to grant the assistant. boostiQ does not make decisions that produce significant legal effects on the user without their intervention.

2.10. Amendments

boostiQ reserves the right to amend this Privacy Policy. Any substantial amendment will be communicated to the user by email with reasonable notice.

Last updated: 6 May 2026