Privacy Policy

Last updated: 6 May 2026

This Privacy Policy applies to LocalBoost, operating the BOOST brand ("we," "us," "our," the "Company"), based in Neuchâtel, Switzerland, and describes how we access, collect, store, use, and share ("process") your personal data when you use our services (the "Services").

Operator. BOOST (localboost.ch) is operated by LocalBoost, based in Switzerland. LocalBoost owns the underlying technology, software, and intellectual property powering the BOOST platform, and acts as the data controller for the personal data described in this Policy.

This Policy applies in particular when you:

• visit our website at https://localboost.ch;
• use the BOOST platform (dashboard, fortune wheel, review monitoring, etc.);
• participate in a BOOST game deployed by an establishment (as an end customer scanning a QR code);
• interact with our Services through marketing, support, or integrations.

BOOST is a reputation-management software designed to help restaurants and local businesses collect, monitor, and promote Google reviews from their customers.

For any question about this Policy: contact@localboost.ch.

Our processing of personal data complies with the Swiss Federal Act on Data Protection (FADP/revFADP) and with the General Data Protection Regulation (GDPR) where applicable.

SUMMARY OF KEY POINTS

This summary highlights the essential elements of our Privacy Policy. For details, see the numbered sections below.

• What data do we process? It depends on how you interact with the Services. We collect only what is necessary for them to function.
• Sensitive data? In some cases, Clients (establishments) upload contact lists of their own customers (emails, phone numbers).
• Third-party data? Yes — via the Google Places API, CRM integrations, marketing partners, and public sources (the establishment's Google listing).
• Security? We apply technical and organizational measures (encryption, access controls, hosting in Switzerland / EU).
• Your rights? Depending on where you live, you may access, correct, delete, or export your data.
• Where? Primary hosting in Switzerland and the European Union. No transfer to the United States without standard contractual clauses or an adequacy decision.

TABLE OF CONTENTS

1. DATA CONTROLLER
2. WHAT INFORMATION WE COLLECT
3. HOW WE PROCESS YOUR INFORMATION
4. LEGAL BASES FOR PROCESSING
5. WHEN AND WITH WHOM WE SHARE DATA
6. SUB-PROCESSORS AND SERVICE PROVIDERS
7. COOKIES AND TRACKING TECHNOLOGIES
8. ARTIFICIAL INTELLIGENCE
9. RETENTION PERIODS
10. INFORMATION SECURITY
11. INFORMATION FROM MINORS
12. YOUR RIGHTS
13. "DO NOT TRACK" SIGNAL
14. INTERNATIONAL TRANSFERS
15. MOBILE AND SMS DATA
16. GOOGLE REVIEW MONITORING
17. FORTUNE WHEEL — PARTICIPANT DATA
18. CLIENT (ESTABLISHMENT) RESPONSIBILITY
19. CASE STUDIES AND MARKETING
20. UPDATES TO THIS POLICY
21. CONTACT
22. REVIEW, UPDATE, OR DELETE YOUR DATA

1. DATA CONTROLLER

The data controller within the meaning of the FADP/revFADP and art. 4 §7 GDPR is:

LocalBoost (BOOST) Neuchâtel, Switzerland 📧 contact@localboost.ch 📞 +41 32 310 99 86

For Clients (establishments), LocalBoost acts as processor within the meaning of art. 28 GDPR when it processes End Customer data on their behalf (sending review-request SMS or emails, etc.).

We have not appointed a Data Protection Officer (DPO) as our activity does not legally require it. However, all data-protection requests may be addressed to contact@localboost.ch.

2. WHAT INFORMATION WE COLLECT

We collect the personal data you voluntarily provide when you:

• create an account;
• request information about the Services;
• contact support;
• use platform features;
• participate in a BOOST game (as an end customer).

Categories of data collected

For Clients (establishments):

• first and last name of the manager;
• professional email address;
• phone number;
• business name and establishment address;
• Google Place ID;
• logo and branding assets;
• billing information (legal name, VAT, billing address);
• authentication data (password hash, OAuth tokens for third-party integrations);
• uploaded content (prize visuals, slogans, custom message templates).

For End Customers (wheel players):

• email address (collected via the wheel form);
• phone number (optional);
• first name (optional);
• IP address (anonymized via hash after 30 days);
• device fingerprint for fraud-prevention purposes;
• user agent (browser, operating system);
• prize won, promo code assigned, status (validated / not validated);
• date and time of participation.

For visitors of the marketing site:

• anonymized navigation data (page views, duration, source);
• cookie preferences.

Client responsibility for imported data

When a Client (establishment) uploads contacts of its own customers (for example via a CRM integration), it warrants that it has obtained all necessary consents in accordance with the FADP/revFADP, the GDPR, the Swiss Federal Act Against Unfair Competition (UCA, art. 3 para. 1 let. o), and any other applicable law.

When creating an account or importing contacts, the Client must expressly confirm that such consents have been obtained.

LocalBoost does not independently verify how the contacts were obtained and relies on the Client's representations.

Payment data

Payments are processed exclusively by our providers (Stripe and/or Dodo Payments, PayPal for certain plans). We do not store any complete payment card information on our servers.

Privacy policies of our payment providers:

• Stripe: https://stripe.com/privacy
• PayPal: https://www.paypal.com/ch/legalhub/privacy-full
• Dodo Payments: https://dodopayments.com/privacy

3. HOW WE PROCESS YOUR INFORMATION

We process personal data to:

• provide and maintain the Services: account creation, dashboard access, QR-code generation, fortune-wheel execution;
• manage accounts: authentication, preferences management, billing;
• respond to support requests;
• send administrative communications: billing notifications, security alerts, service updates;
• send review invitations on behalf of our Clients (establishments);
• monitor Google reviews published on Clients' listings and alert them when reviews change or are removed;
• improve the platform through aggregated and anonymized analytics;
• prevent fraud: detection of abusive scans, uniqueness verification of participants, monitoring of suspicious behaviors;
• comply with our legal obligations: billing, accounting retention (10 years under the Swiss Code of Obligations), responses to competent authorities.

Case studies and marketing use

We may use certain business information to create case studies or marketing materials about our Services. This may include:

• Client business name;
• logo;
• public Google reviews;
• voluntary testimonials;
• aggregated results (e.g., "X% increase in number of reviews").

If you prefer that your establishment not be included in marketing materials, contact contact@localboost.ch and we will use commercially reasonable efforts to honor that request going forward.

4. LEGAL BASES FOR PROCESSING

In accordance with art. 6 GDPR and the principles of the FADP/revFADP, we process your data on the basis of:

• your consent (art. 6 §1 a GDPR) — for example when you sign up for the newsletter, or when an End Customer participates in the wheel game;
• performance of the contract (art. 6 §1 b GDPR) — to provide the Services you have subscribed to;
• our legal obligations (art. 6 §1 c GDPR) — billing, accounting, responses to authorities;
• our legitimate interests (art. 6 §1 f GDPR) — platform security, fraud prevention, Service improvement, direct marketing toward existing customers.

You may withdraw your consent at any time, without affecting the lawfulness of prior processing.

5. WHEN AND WITH WHOM WE SHARE DATA

We never sell your personal data. We share it only with:

• our technical sub-processors (see Section 6);
• competent authorities when required by law (judicial requisition, tax authority request, etc.);
• potential acquirers in case of merger, acquisition, or sale of assets (with equivalent contractual data-protection guarantees);
• your establishment (for End Customers) — the establishment where you played receives your email/phone and the prize won, in order to validate your gift;
• Google — when you are redirected to the Google listing to leave a review, you then interact directly with Google under their own terms.

Third-party platform notice

BOOST integrates with third-party platforms such as Google, Meta, and various CRM providers. These platforms operate independently and may delete or modify reviews at their discretion. BOOST cannot guarantee the visibility or permanence of reviews on these third-party platforms.

6. SUB-PROCESSORS AND SERVICE PROVIDERS

To provide the Services, we use sub-processors within the meaning of art. 28 GDPR. All are bound by contractual commitments equivalent in matters of data protection.

The complete and up-to-date list is available upon request at contact@localboost.ch.

7. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to:

• maintain platform security (session cookies);
• analyze usage (anonymized analytics cookies);
• improve performance;
• personalize the user experience.

You can manage your preferences via the cookie banner displayed on your first visit. For more details, see our Cookie Policy (/cookie).

8. ARTIFICIAL INTELLIGENCE

Some optional features of our platform use artificial-intelligence technologies provided by third parties (in particular OpenAI and Anthropic), for example to:

• suggest replies to Google reviews;
• recommend wheel or campaign settings;
• automatically enrich establishment profiles.

Users may disable these AI features in their account settings.

We commit that no identifying personal data (email, phone) is transmitted to these AI providers for training their models.

9. RETENTION PERIODS

We retain your data for as long as necessary to:

• provide the Services;
• maintain active accounts;
• comply with legal obligations (in particular 10-year accounting retention under art. 958f Swiss Code of Obligations);
• resolve disputes and defend our rights.

After expiration, data is anonymized or definitively deleted.

10. INFORMATION SECURITY

We implement technical and organizational measures to protect your data:

• encryption in transit (TLS 1.2+);
• encryption at rest of sensitive data;
• secure infrastructure (Neon, Vercel, Cloudflare);
• role-based access controls (RBAC);
• strong authentication (password + verified email, optional 2FA);
• regular dependency audits (Snyk, Dependabot);
• principle of least privilege on all admin access;
• audit logs of sensitive actions.

However, no system can guarantee absolute security. In case of a security incident affecting your personal data, we will notify the competent authorities (FDPIC in Switzerland, competent supervisory authority in the EU) within 72 hours, and will notify you where appropriate in accordance with art. 24 FADP and art. 34 GDPR.

11. INFORMATION FROM MINORS

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect data from minors.

If you are a parent or guardian and believe your child has provided us with personal data, contact us at contact@localboost.ch and we will delete it promptly.

For fortune-wheel games deployed by establishments, it is the responsibility of the Client establishment to ensure that participants are adults or have parental consent where applicable.

12. YOUR RIGHTS

In accordance with the FADP/revFADP and the GDPR, you have the following rights:

• right of access (art. 25 revFADP, art. 15 GDPR) — obtain a copy of the data concerning you;
• right of rectification (art. 32 revFADP, art. 16 GDPR) — correct inaccurate data;
• right to erasure ("right to be forgotten," art. 17 GDPR) — request deletion of your data;
• right to restriction of processing (art. 18 GDPR);
• right to data portability (art. 20 GDPR) — receive your data in a structured format;
• right to object (art. 21 GDPR) — object to processing based on legitimate interest;
• right to withdraw consent at any time (art. 7 §3 GDPR);
• right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or with the competent supervisory authority in the EU.

To exercise your rights: contact@localboost.ch. We will respond within a maximum of 30 days. For security purposes, we may verify your identity before processing your request.

13. "DO NOT TRACK" SIGNAL

We do not currently respond to browser Do Not Track (DNT) signals, in the absence of a uniform industry standard.

You can manage your preferences via our cookie banner and disable non-essential cookies.

14. INTERNATIONAL TRANSFERS

Our primary servers are located in Switzerland and the European Union.

Some sub-processors (Neon, Vercel, OpenAI, Stripe, etc.) may process data in the United States. For these transfers, we rely on:

• the Standard Contractual Clauses (SCCs) approved by the European Commission;
• the transfer mechanisms recognized by the Swiss FDPIC;
• adequacy decisions where they exist (e.g., the EU-US Data Privacy Framework).

By continuing to use our Services from a jurisdiction outside Switzerland/EU, you expressly consent to the transfer of your data to the aforementioned countries.

15. MOBILE AND SMS DATA

Mobile opt-in

Phone numbers provided through our platform (during a wheel game or by upload by a Client) are used exclusively to send relevant communications: review invitations, prize notifications, validation reminders.

No resale

We do not sell or share mobile numbers with third parties for marketing purposes.

Opt-out

You can opt out at any time by replying STOP to any received SMS. Opt-out is processed automatically.

Carrier fees

Standard carrier fees may apply.

16. GOOGLE REVIEW MONITORING

BOOST automatically collects public reviews published on your establishment's Google listing, via the Google Places public API and, where applicable, via third-party scraping or data-enrichment providers.

The data collected includes:

• the public name and photo of the review author;
• the rating (stars);
• the text of the review;
• the publication date;
• the merchant's reply where applicable.

This data is publicly accessible on Google. We store it in a private copy, solely to:

• detect deletions by Google;
• track the history of modifications;
• allow you to build legal evidence in case of a dispute with Google (PDF export).

If a review author wishes to obtain erasure of their review from our database, they may contact us at contact@localboost.ch. We will delete the private copy, without being able to guarantee deletion on the original Google platform.

17. FORTUNE WHEEL — PARTICIPANT DATA

When an End Customer (visitor of an establishment) participates in the BOOST fortune wheel:

• they scan a QR code and access a game page;
• they accept the game conditions (rules) before spinning;
• they provide their email (and optionally their phone and first name) to receive their prize;
• the participation is recorded in our database on behalf of the establishment.

This data:

• is visible to the establishment (Client) in its dashboard;
• may be used by the establishment to validate prize delivery;
• may be used by the establishment for marketing follow-ups only with explicit consent (a checkbox is provided for this purpose);
• is never sold or shared with third parties for commercial purposes.

The End Customer has all the rights described in Section 12 and may exercise them at contact@localboost.ch or directly with the relevant establishment.

17.1 Review proof photos (Staff Performance feature)

When the establishment has activated the Staff Performance feature (issue #79), staff members may, with the End Customer's explicit oral consent, take a photo of the customer's screen showing their published Google review. This photo serves as proof of the staff member's contribution to the establishment's review collection.

Data processed:

• A photograph of the customer's mobile screen, which may include the customer's Google profile name, profile picture, and the review text. This data is already publicly displayed by Google on the establishment's Business Profile.
• The staff member ID who took the photo, the timestamp, and the link to the corresponding fortune-wheel participation.

Legal basis (art. 6.1.f GDPR / FADP equivalent): legitimate interest of the establishment for fraud prevention (anti-cheat between staff members) and internal business intelligence (allocation of discretionary bonuses). The processing has minimal impact on the End Customer because the photographed information is already public.

Storage: photos are stored in encrypted Amazon S3 (region eu-west-1 / Switzerland). Access is restricted to the establishment's authenticated managers and the staff member who uploaded the photo.

Retention: 12 months maximum, after which photos are automatically deleted by an Inngest weekly cleanup job (proof-photos.retention-cleanup).

Right to erasure: the End Customer can at any time request the immediate deletion of all proof photos that contain them, by:

• using the dedicated endpoint DELETE /api/auth/player/me/proof-photos from their player session, or
• emailing contact@localboost.ch with a description of their visit (date + establishment).

We respond within 30 days as required by GDPR art. 17.

The staff member must obtain the customer's oral consent before taking the photo. If the customer refuses, the staff member must not take the photo. We provide internal training material to staff to ensure proper handling.

18. CLIENT (ESTABLISHMENT) RESPONSIBILITY

When you use BOOST as an establishment, you act as data controller for your own customers' data. We act as processor on your behalf within the meaning of art. 28 GDPR.

In this capacity, you commit to:

• obtain and maintain all required consents to contact your customers by SMS, email, or other channel;
• clearly inform your customers about the use of their data;
• comply with all applicable laws (FADP, GDPR, UCA, cantonal laws);
• respond to End Customer rights-exercise requests (you may ask us for help in doing so);
• not upload illegally obtained data;
• not send communications to recipients on do-not-contact lists.

Any breach engages your sole responsibility. You indemnify us for any third-party action resulting from a breach on your part (see Section 32 of the Terms and Conditions).

19. CASE STUDIES AND MARKETING

We may feature Clients in our marketing materials with:

• business name;
• logo;
• aggregated figures (number of reviews collected, rating increase, etc.);
• public Google reviews.

If you do not wish to appear in our marketing materials, contact contact@localboost.ch and we will use commercially reasonable efforts to remove your brand going forward.

20. UPDATES TO THIS POLICY

We may periodically update this Privacy Policy. Changes will be reflected by the update of the "Last updated" date at the top of this page.

In case of substantial changes (for example, addition of a new processing purpose or a new major sub-processor), we will notify you by email or by an in-platform notification.

21. CONTACT

For any question relating to this Policy:

LocalBoost (BOOST) Neuchâtel, Switzerland

📞 +41 32 310 99 86 📧 contact@localboost.ch 🌐 https://localboost.ch

Swiss supervisory authority

Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1 3003 Bern, Switzerland 🌐 https://www.edoeb.admin.ch

EU residents may lodge a complaint with the supervisory authority of their country of residence.

22. REVIEW, UPDATE, OR DELETE YOUR DATA

You may at any time request:

• access to your data;
• rectification of inaccurate information;
• deletion of your personal data;
• export of your data in a structured format (JSON / CSV).

For security purposes, we may verify your identity before processing your request (for example via a confirmation email).

Send your request to: contact@localboost.ch

We will respond within a maximum of 30 days.