Privacy Policy

1. Who we are

StreamlineBoost installs business systems for small and mid-sized companies. We operate the marketing website at streamlineboost.com and the client dashboard at app.streamlineboost.com. For the personal data described below we act as the data controller, except where section 4 says otherwise.

Streamline Boost is registered in the Netherlands with the Chamber of Commerce (Kamer van Koophandel) under number 89334183.

Contact: support@streamlineboost.com.

2. What we collect

We collect what you actively give us, the aggregate traffic statistics described below, and the technical records our hosting provider keeps in order to serve the site securely. We do not track you across the web, and browsing this website sets no cookies — the one exception is the booking calendar shown after you submit the contact form, explained in our Cookie Policy.

When you submit the contact form

Your first and last name, email address, business name, the option you select for what is most chaotic right now, and anything you type into the free-text field.

When you book a call

After submitting the form you can pick a time for your audit call from a calendar provided by Cal.com. Booking records your name, email address, the notes carried over from the form, the slot you choose and your time zone, so that we can both be sent an invite. Booking is optional — if you close the page instead, we will email you to arrange a time.

When you request an onboarding intake

Business name, contact name, email address, phone number, website, industry, and your description of what you need.

When you hold a dashboard account

Your email address and authentication credentials (your password is stored only as a salted hash — we never see it), your profile details, and the operational records you create while using the dashboard.

When you simply read the site

We use Vercel Web Analytics to understand how many people visit and which pages they read. It works without cookies: instead of tagging your browser, it derives a one-way fingerprint from the request — the page, and general characteristics of your browser and connection — combined with a secret value that is changed every day, so the same visitor cannot be recognised from one day to the next. Nothing is stored on your device and no persistent identifier exists. What we see is aggregate: page views, approximate visitor counts, referring site, country and device type. We cannot identify you from it.

Server logs

Our hosting provider records standard request data, including IP address, user agent and the page requested. These logs exist to keep the service running and secure. They are not used to build a profile of you, and they are not combined with the information above.

3. Why we use it, and on what legal basis

• To reply to your enquiry and prepare a proposal — because you asked us to, as steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).
• To deliver the services you have engaged us for, including operating your dashboard account — performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the service secure — spam filtering, abuse prevention and server logging, on the basis of our legitimate interest in protecting the service and the people who use it (Art. 6(1)(f) GDPR).
• To measure whether the site is working — cookieless, aggregate traffic statistics, on the basis of our legitimate interest in understanding whether our own website reaches anyone (Art. 6(1)(f) GDPR). We chose a method that cannot identify you or follow you between visits precisely so that this interest does not come at your expense.
• To meet accounting and tax obligations — where we are legally required to keep records of our business dealings (Art. 6(1)(c) GDPR).

Providing the information in our forms is voluntary, but without it we cannot respond to you or deliver the service.

4. Who else sees your data

We do not sell your personal data and we do not share it for advertising. We rely on a small number of service providers who process data strictly on our instructions:

• Supabase — the database where form submissions, intake records and dashboard accounts are stored.
• Vercel — hosting for both the website and the dashboard; processes requests, keeps the server logs described above, and produces the aggregate traffic statistics through its Web Analytics product.
• Resend — sends us an email notification when you submit a form. That notification contains the details you submitted, so that we can reply to you directly.
• Telegram — we also receive an alert in a private team chat when a form is submitted, so that enquiries are not missed. That alert deliberately contains no personal data: it says only that a submission arrived and that the details are in our email. We changed this in September 2026, because Telegram offers no data processing agreement to operators of its bot interface, and we would rather not send your information somewhere we cannot hold to terms.
• Cal.com — schedules the audit call. After you submit the contact form, a Cal.com calendar is shown so you can choose a time. It receives your name, email address and the notes carried over from the form, and it holds the booking itself so both of us get a calendar invite and a reminder. It is only loaded once you have submitted the form — not when you are simply reading the site.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

Where we handle personal data on behalf of a client — for example, contact records belonging to a business whose systems we operate — that client is the controller and we act as their processor under a data processing agreement. Those individuals should direct requests to the client in the first instance, though we will always help.

5. Transfers outside your country

Your data is stored inside the EEA. Our Supabase database runs in the eu-west-1 region in Ireland, so form submissions, intake records and dashboard accounts are held within the European Economic Area at rest.

Some of the providers above are established in the United States and may access data from there — Supabase and Vercel for support and operation of the service, Resend to deliver our notification emails, and Cal.com to run the scheduling of your call. Our Telegram alerts travel through that company's international infrastructure, but as described above they carry no personal data, so nothing about you is transferred by that route. Where personal data is transferred outside the EEA we rely on the safeguards permitted under Chapter V of the GDPR — in practice the Standard Contractual Clauses incorporated into these providers' data processing terms, or an applicable adequacy decision. You can ask us which mechanism applies to a particular provider and we will tell you.

6. How long we keep it

• Contact form enquiries — 24 months from your last contact with us, then deleted. If you become a client, your records move to the basis below.
• Client and intake records — for the duration of our relationship, and afterwards for as long as we are required to retain business records for tax and accounting purposes.
• Dashboard accounts — until you ask us to delete the account, after which it is removed within 30 days, except where we must retain specific records by law.
• Bookings — the call record stays in our calendar and in Cal.com for as long as we keep the related enquiry, and is deleted with it.
• Server logs — retained only briefly, per our hosting provider's standard retention.
• Traffic statistics — kept as aggregate counts for as long as they are useful for comparison. Because they contain no identifier, there is nothing in them that can be traced back to you or removed on request.

7. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• receive the data you gave us in a portable, machine-readable format, or have it sent to another provider;
• object to processing we carry out on the basis of legitimate interests, including at any time to direct marketing;
• withdraw consent, where we relied on consent, without affecting past processing;
• lodge a complaint with a data protection supervisory authority. Ours is the Dutch Autoriteit Persoonsgegevens; you may also complain to the authority where you live or work.

To exercise any of these, email support@streamlineboost.com. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else. Exercising these rights is free.

8. Security

Data is encrypted in transit and at rest. Access to the production database is restricted to the credentials our applications need, and the tables holding form submissions are closed to public access entirely — they can be reached only by privileged server-side code, never from a browser. No system is perfectly secure, but we design on the assumption that anything reachable from the internet will be probed.

9. Automated decisions and profiling

We do not make decisions about you by automated means, and we do not profile you. A person reads every enquiry.

10. Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes to this policy

When how we handle data changes, we update this page and the date at the top. We treat that as part of shipping the change, not as a follow-up task — an out-of-date privacy policy is a false statement about a live system.

12. Contact

Questions, requests or complaints: support@streamlineboost.com.