BoostSpeed draft: Privacy & Cookies
BoostSpeed policies
Privacy & Cookies
What the store processes, why, and the choices available to you.
Draft updated 15 October 2026. Version 2026-10-15.3.
On this page
About this store Information used by the storePurposes and legal basesCookies and browser storageSharing, retention and international transfersUK and EU privacy rightsYour right to objectAustralia and the United States Seller & contactAbout this store
BoostSpeed is currently an investor demonstration using Creativemark hosted checkout and a shared Stripe sandbox. No live charges are taken. Sample keys do not activate software: they are marked SAMPLE-NOT-VALID. README downloads are not software installers. Use test payment details, not a real card.
Information used by the store
The seller identified below is the store's data controller. The store processes checkout email, order references, products, amounts, currency, payment status and gateway references. Session data associates your browser with its cart, chosen currency and orders. IP addresses and request/security information may be processed by the web infrastructure and security controls.
Private delivery and administrative audit records record actions such as downloads and licence reveals. Licence-key stock is stored encrypted; this does not mean every order field or log is encrypted. The merchant app does not store payment-card numbers or security codes. Hosted checkout and Stripe handle payment details under the notices shown there.
Information comes from you, your browser, payment-status messages and store operations. Providing checkout email is needed for the checkout flow; without it an order cannot be submitted. If you contact support, the information you send is also used to handle that request. Please redact unrelated information from screenshots and never send passwords, full card details or a complete licence key.
The hosted checkout separately records the purchase agreements shown to you, including their version and text, acceptance time, checkbox wording, source page, checkout email, IP address and browser user-agent. Those records help establish what was presented and agreed; they do not prove that software was installed or activated.
Stripe privacy noticePurposes and legal bases
For a paid order, necessary order handling, payment coordination, delivery and support rely on performing the contract or steps you request before it. Necessary statutory accounting and tax records rely on legal obligations. Proportionate security, fraud prevention, dispute handling and operating the demo rely on legitimate interests in protecting customers and the service, subject to balancing your rights. Demo participation is not a paid contract.
The store does not currently install GA4 browser tracking. An optional service-account reporting connection can read aggregate analytics reports from a configured property; it is not itself a browser tracker. Optional internal growth reviews use aggregate reports, not a customer-facing credit or eligibility score. Order-status checks automatically control delivery access, including holding access during refund or dispute review. Ask the orders contact about an incorrect status. Payment providers have their own payment and fraud checks; this notice does not describe all of their decision-making.
ICO: lawful basis for processingCookies and browser storage
The store uses a session cookie for requested cart, currency and private-order access, and a CSRF cookie to protect form submissions. They are not advertising or analytics cookies. Blocking them can prevent checkout or order access. Closing a browser may not clear cookies if it restores a previous session.
In the current store configuration, boostspeed_session is a browser-session cookie with an eight-hour server-side session age. boostspeed_csrf can remain for up to 364 days and may be renewed when used. These are cookie lifetimes, not the retention periods for order or support records. Your browser's site-data controls let you inspect or delete them; deleting the session cookie can also remove access to your private order.
No optional browser analytics or advertising cookies are currently installed by this storefront. Hosted checkout may use its own essential payment and fraud-prevention technologies; review its notice separately. Non-essential tracking must not start without consent where the applicable rules require it.
ICO: storage and access technologies, including cookiesSharing, retention and international transfers
Checkout receives your email, the selected items, quantities, currency and any applied promotion code. Necessary data goes to the Creativemark checkout service, Stripe and the hosting/infrastructure providers involved in running the store. Relevant records may be provided to a payment provider, card issuer, professional adviser or authority to resolve a dispute or meet a legal duty. This storefront has no advertising-data sale or cross-context advertising integration. Installing or activating a manufacturer's product can involve separate processing by that manufacturer; read the product's own privacy notice. This policy does not claim that every buyer's details are sent to a manufacturer.
Retention is assessed by order/support needs, accounting duties, security investigations and legal-claim periods, including necessary backup handling. [Retention schedule and deletion arrangements to be confirmed]. [Hosting locations, recipients and international transfer safeguards to be confirmed]. These gaps remain unresolved in this draft; no particular transfer mechanism or automatic deletion schedule is represented as being in place.
ICO: what privacy information should be providedUK and EU privacy rights
Depending on the applicable law and legal basis, you may request access, correction, deletion, restriction or portability. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact the privacy contact below; proportionate identity checks may be needed. Use the subject 'Privacy request'. Legal retention duties can limit deletion.
You can complain to the UK Information Commissioner's Office (ICO) or, where EU law applies, the competent data-protection authority where you live or work. A complaint to us does not replace these rights.
ICO: make a privacy complaintEuropean Commission: your data-protection rightsYour right to object
You have a right to object to processing based on legitimate interests, giving reasons connected with your situation. We must stop that processing unless the applicable law allows it to continue, for example for compelling overriding grounds or legal claims. If your data is used for direct marketing, you can object to that use at any time. Use the privacy contact below; accepting sale terms is not consent to marketing.
ICO: objections to legitimate-interest processing and direct marketingAustralia and the United States
Where Australian privacy law applies, you may request access or correction and raise a handling complaint with us, then the OAIC where appropriate. US rights vary by state and the law's applicability: they can include access, correction, deletion, portability, non-discrimination, opt-outs and appeals. Send a request to the privacy contact below. This draft does not assert that every state law applies to the operator or that unbuilt request tools exist.
OAIC: open and transparent handling of personal informationOAIC: privacy complaintsCalifornia Attorney General: consumer privacy rightsSeller & contact
BoostSpeed is operated by HULO GLOBAL LIMITED. Company and contact details are published on Hulo Global's privacy and support pages.