Privacy Policy

1. Introduction

Boost Media Ltd. ("Boost Media," "we," "us," or "our") operates the BoostBot service. BoostBot is an AI-powered chatbot plugin for WordPress websites that helps businesses automate visitor conversations, capture leads, schedule meetings, and provide instant answers based on site content.

This Privacy Policy explains how data is collected, used, stored, and protected when you use the BoostBot WordPress plugin and the BoostBot Cloud Service. It applies to site administrators who install the plugin and to visitors who interact with BoostBot-powered chat widgets.

2. What Data We Collect

2.1 Data Stored Locally on Your WordPress Site

The BoostBot plugin stores the following data in your WordPress database. You, the site owner, have full control over this data:

• Chat conversations — Messages exchanged between visitors and the chatbot
• Lead information — Names, email addresses, and phone numbers submitted through chat forms
• Meeting bookings — Scheduled meetings including visitor contact details and selected time slots
• Analytics data — Page URLs visited, widget interactions, conversation counts
• Knowledge base content — Indexed excerpts of your site's posts, pages, and products used for AI-powered search
• Bot configuration — Widget settings, personality, appearance presets, and tone

2.2 Data Sent to the BoostBot Cloud Service

When the plugin communicates with the BoostBot Cloud Service (boostbot.boostmedia.co.il), the following data is transmitted:

• Site URL and registration info — Your website domain, used for authentication and service provisioning
• Chat messages — Visitor messages and conversation context, forwarded to AI providers for response generation
• Content chunks — Excerpts from your site content, sent for semantic embedding and knowledge base indexing
• Credit usage — BoostCoin consumption events for billing purposes
• Google Calendar tokens — OAuth tokens for meeting synchronization (when you connect Google Calendar)
• Feedback submissions — Messages, screenshots, and technical logs sent through the plugin's feedback form

2.3 Data We Do NOT Store on Our Servers

2.4 What Our Backend Does Store

• Site registration record — Your site URL and a cryptographic authentication key
• Credit balance — Your BoostCoin balance and transaction history
• Usage logs — Aggregated API call counts for billing and service monitoring
• Google Calendar OAuth tokens — Stored securely for meeting synchronization (when connected)

3. Third-Party Services

BoostBot uses the following third-party services to provide its AI-powered features. When you use BoostBot, data is shared with these providers as described below:

We use API-level access for all AI providers, meaning your data is processed under their business API terms (not consumer terms). These providers do not use your data to train their models when accessed through their API.

4. How We Use Your Data

• Provide AI-powered chat responses — Messages are sent to AI providers in real time and responses are streamed back
• Knowledge base search — Your site content is indexed to enable the AI to answer visitor questions accurately
• Credit tracking — We track BoostCoin usage to manage your credit balance
• Meeting synchronization — When connected, meeting bookings are synced to your Google Calendar
• Service improvement — Anonymized, aggregated usage statistics help us improve the product
• Technical support — Feedback submissions and diagnostic data are used to resolve issues

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Retention

• Conversations and leads — Stored in your WordPress database under your control. You determine retention through your own data management practices.
• BoostCoin credits — Maintained on our backend as long as your site is registered with the service.
• Knowledge base — Indexed content is stored locally on your site. Embeddings are regenerated when you re-index.
• Google Calendar tokens — Stored as long as the integration is active. Permanently deleted when you disconnect.
• Feedback submissions — Retained for the time needed to address your request, then deleted.
• Plugin uninstallation — Deactivating and deleting the BoostBot plugin removes all plugin data from your WordPress database (tables, options, and cached data).

6. Your Rights (GDPR & Israeli Privacy Law)

Under the General Data Protection Regulation (GDPR) and the Israeli Protection of Privacy Law, you have the following rights:

• Right to access — Request a copy of the personal data we hold about you
• Right to rectification — Request correction of inaccurate personal data
• Right to erasure — Request deletion of your personal data. For locally stored data, uninstalling the plugin removes it. For backend data, contact us.
• Right to data portability — Request your data in a machine-readable format
• Right to object — Object to the processing of your personal data
• Right to withdraw consent — Withdraw consent at any time by deactivating the plugin or disconnecting integrations

To exercise any of these rights, contact us at office@boost-media.co.il. We will respond within 30 days.

7. Cookies

The BoostBot plugin uses a minimal number of cookies to function:

BoostBot does not set any third-party tracking cookies. The visitor_id is a randomly generated identifier stored in the browser's localStorage and is used only for conversation continuity on the specific site where the plugin is installed.

8. Data Security

• All data in transit is encrypted using HTTPS/TLS
• Authentication between the plugin and backend uses cryptographic JWT tokens with short expiry (15 minutes)
• API keys are hashed using SHA-256 before storage
• Google Calendar OAuth tokens are stored in an access-controlled database
• The backend runs on infrastructure located in the EU (Hetzner, Germany) with appropriate security measures
• Access to backend systems is restricted to authorized personnel only

9. Children's Privacy

BoostBot is a business tool designed for website administrators. It is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

10. Google Calendar — Limited Use Disclosure

BoostBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the calendar and email scopes necessary for meeting synchronization
• We do not read, modify, or delete existing calendar events
• We do not share Google user data with third parties
• We do not use Google data for advertising purposes
• You can revoke access at any time via Google Account Settings

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

For privacy-related questions, data requests, or concerns, please contact us: