Personal Data Processing Policy

What this document is about

The Policy explains which personal data the DeadBoost service processes on deadboost.com, why, on what basis, how long it is kept and what you can do with it.

The document is prepared under the Law of Georgia on Personal Data Protection (No. 3144 of 14 June 2023).

It describes how the service actually works, not plans. If some processing is not in the text, it does not exist in the system either. When something changes, we change the policy first and only then enable the new processing.

The Policy applies to customers, registered users, performer candidates and website visitors without registration.

The contractor under the agreement is Individual Entrepreneur Nikolai Karelin. To provide the services we engage third parties — booster performers — and remain responsible to you for quality, timing and the safety of the data shared, including the actions of the engaged performer. Service terms, timing, cancellation and refunds are described in the Offer.

Who processes the data

Personal data operator and seller of the services: Individual Entrepreneur Nikolai Karelin, identification (registration) number 306528157, country of registration: Georgia, address: Adjaria, Batumi, Bagrationi 129.

Questions about personal data processing, withdrawal of consent and requests about your data — contact@deadboost.com. The Contractor handles them directly: Georgian law does not require a separate data protection officer for a business of our size.

Address for personal data requests, inquiries, withdrawal of consent and claims: contact@deadboost.com. We consider an email to this address a legally significant communication.

Personal data processing in Georgia is supervised by the Personal Data Protection Service (personaldata.ge). Georgian law does not require operators to be entered in a register.

What data we collect: account

This data appears at registration and sign-in. The account does not work without it.

• Sign-in email address — only for accounts created by email. Social sign-in accounts get a service address like steam-…@steam.local instead, and no emails go to it. The address for emails is a separate field described in the next section.
• Name — entered by you or received when signing in with Steam, Telegram or Discord.
• Role in the system: customer, performer, support, administrator.
• Password salt and hash. The password itself is not stored and cannot be recovered.
• Registration date.
• Social sign-in identifiers: steam_id (SteamID64), telegram_id, discord_id — if you signed in with these services.
• Avatar: a selected preset or an uploaded file; separately — the avatar from your Steam, Telegram or Discord profile.
• Performer's public pseudonym — only for performer accounts.
• Performer's game account (SteamID3), set by an administrator. The performer's publicly shown win rate is calculated from it, and for this the identifier is sent to an external game API (see the section on data sharing).
• Marks of account blocking and suspension from work, if applied, and who applied them.
• Two-factor authentication (TOTP) secret — only for service staff.
• Hash of the session refresh token and its expiry. The token itself is not stored — only its sha256 hash.

What data we collect: contacts and social links

These are fields of your account. They are optional: an order is placed and fulfilled without them. We do not refuse the service or worsen the terms if you leave them empty.

• Telegram contact.
• Discord contact.
• Links to your social media profiles — a list you enter yourself.
• “About you” text.

What data we collect: email for messages and Telegram

You leave the address for emails yourself — at the payment step (“Where should we send your receipt and order updates?”) or in settings. It is optional: an order is placed and fulfilled without it. We send a link to the address; until you follow it, no order emails go there.

The DeadBoost bot messages you in Telegram only if you signed in with or linked Telegram and allowed the bot to message you in the Telegram window.

• The address for emails, whether and when it was confirmed, and the email language.
• Whether order emails, bot order messages and offers are switched on.
• Consent to offers: given or withdrawn, when, from which IP address, where (checkout, settings, a link in an email) and which version of the consent text.
• A mark that the souls bonus for a confirmed email was granted and the sha256 hash of the address, so the bonus for one address is granted only once. The address itself is not stored in this mark.
• A sending log: type of email or message, channel (email or Telegram), time, success or error text, and the promo code if the email contained one.
• A mark that Telegram did not let the bot message you: after it the bot does not message you until you press “Check” in settings.

What data we collect: orders

Order data is needed so that the service can be provided, accepted and, if necessary, a dispute reviewed.

• Order parameters: type of service, mode (Piloted, Duo, coaching), values chosen in the calculator.
• Price calculation snapshot: the price the server calculated at checkout together with its breakdown. It does not change after payment.
• Total amount, currency, applied promo code.
• Timestamps: order creation, taking into work, completion by the performer, confirmation by the customer. The fact and time of payment are recorded by an entry in the order event log — the order has no separate payment field.
• Game account identifier (SteamID3), if you linked it for progress tracking.
• Identifiers of the customer and the assigned performer.
• Order event log: status changes, who performed an action and when, event service data.
• Progress reports, if the performer left any: rank step, number of games and wins, the performer's note. Order progress is now calculated automatically from game statistics (see the section on the external game API).
• Disputes: who opened it, the reason, status, decision (refund or confirmation), who decided and when.
• Reviews: rating, text, publication flag.
• Bans from the order room (chat and voice), if applied.
• Tips: amount, currency, your message, status and the payment service identifier.
• Payments: payment method, amount and currency, status, payment identifiers at the payment service; for cryptocurrency payments — also the coin, network, the wallet address the transfer came from and the transaction identifier.
• Promo codes: code, discount size, to whom it was issued, by whom and in which order it was used, validity period.

What data we collect: messages, attachments and voice

The order chat is the main communication channel between the customer, the performer and the administration. Messages are stored in the database.

We keep the chat history on purpose. In a dispute it is the service that must prove the quality of the service, and the conversation together with the progress log is the main evidence. So a short retention period would be bad both for you and for us.

• Text of order chat messages.
• Sender's identifier, role and display name, the message sequence number, the time sent.
• Service messages about order events in the same feed.
• Before sending, messages from the customer and the performer are automatically checked by an algorithm for attempts to exchange contacts and payment details: messengers, social networks, email, phone numbers, card numbers, crypto wallets. A message with such data is not delivered, and the sender sees a warning. The server's technical log records the fact of blocking, the user identifier, the order and the reason. Messages from support staff and the administration are not checked. The same check applies to the message you attach to a tip.
• Attachments: files you attach to messages. We do not keep the original file name — the file gets a random name and is stored on the server disk in the order's folder. The database stores the type, size, image dimensions, who uploaded it and when.
• Images are re-encoded on the server, which also removes shooting metadata, including geolocation. The file type is checked by content, not by the declared type.
• An attachment is served via a link with a time-limited signature. The signature is valid for up to 7 days, and until it expires the file is available to anyone who has the link: sign-in is not re-checked on download. Do not forward attachment links to third parties.
• Attachments that were uploaded but never sent are deleted automatically after 24 hours.
• Voice communication in the order room works through the собственный сервер DeadBoost (Hetzner, Германия) media server and is enabled only if configured on the server. The media server receives an access token with the order room and participant identifiers. Call recording (egress) is not configured in the service, and no recordings are created on our side. If recording is ever introduced, we will change the policy before enabling it and warn the participants.

What data we collect: performer applications

If you submit the “Become a booster” form, we keep the application data to review it.

• Name or nickname.
• Contact: Telegram or Discord.
• Current rank in the game.
• Link to the Steam profile.
• Text about yourself.
• The IP address from which the application was sent and the time it was sent — protection of the form against mass automated submissions.
• Application review status.
• An agreement is concluded with a candidate who passes selection. For settlements and taxes we receive and process the data needed to identify the performer and pay their fee.

What data we collect: technical data

We collect less technical data than is usual for such documents. Below is the complete list.

In the database the IP address is stored in two cases: in the discount issue log and in performer applications. The IP address is not written to the administration's action log — the system has no such field.

• Discount issue log. So that one person does not get discounts in a row, we keep the IP address, the user identifier (if you are signed in), the value of the technical httpOnly cookie deadboost_spin and the size of the discount issued. Within the calculation window (one day by default) one browser and one account get no more than one discount; for unregistered visitors the number of issues from one IP address is additionally limited. The fact of issue, the IP and the user identifier also get into the application's technical log.
• Performer application — the sender's IP address (see the section above).
• Web server log on our server: IP address, date and time of the request, the requested address, response code, browser information. This is our own processing, not “third-party infrastructure”. The purpose is protection against attacks and troubleshooting.
• The IP address is used as a temporary counter of failed staff sign-in attempts. It lives in the server's memory and does not get into the database.
• To choose the currency, the website determines whether a request comes from Russia and checks the device time zone. The sign of a visit from Russia is kept in the technical cookie db_rub_ip; the time zone is checked only in the browser. The country code and time zone are not written to the database; an order stores only the currency and the type of price list.
• In our own systems we do not determine location more precisely than the country, do not use device fingerprinting, do not buy data about you from third parties and do not share data with advertising networks. What external analytics collects after your consent is described in the cookie section.
• We currently do not store acceptance data — the Offer version, IP address and browser information at checkout — in the order.

Signing in to a Steam account in Piloted mode: how it works now

This is the most important section. Read it before ordering in Piloted mode.

In Piloted mode the performer plays on your account, so you give them access. The login and password are not shared: the performer posts in the order an image of the sign-in QR code from their Steam client, you scan it in the Steam mobile app (Steam Guard section) and confirm the sign-in. This requires the Steam Guard mobile authenticator.

The QR code image is stored on our server while the sign-in request is open and is deleted after the sign-in is confirmed, cancelled, replaced with a new code or after 10 minutes. It is visible to you, the performer who took the order, and support and administration staff. Only marks of actions remain in the order log and in the chat (QR sent, sign-in confirmed, cancelled, expired) — without the code itself.

The service has no separate encrypted credential storage. If you nevertheless send your login, password or Steam Guard codes as a message in the order chat, they will be saved in the conversation history in the database in plain form, together with the other order messages, and will remain there for the conversation retention period.

Chat messages are accessible to the performer who took the order and to support and administration staff. The system has no technical restriction of staff access to individual orders or only to open disputes: support and the administration can see any order and any conversation in it. A staff member viewing a conversation is not logged — the system has no logging of message views.

We do not claim that credentials are encrypted, and we do not claim that Steam Guard codes are automatically hidden or removed from the conversation. There is no such mechanism. There is also no technical ban on sending a password in the chat — the message filter looks for contacts and payment details, not passwords.

What we recommend to reduce the risk:

• Do not send your password and Steam Guard codes in the chat: they are not needed to sign in, and the service does not request them.
• Do not disable Steam Guard: QR sign-in is confirmed only in your Steam mobile app.
• In the Steam app, confirm only the QR code shown on your order page.
• Do not give anyone access to the email linked to Steam or your Steam Guard backup codes. The service does not request them.
• After the order is completed, click “Sign out of all other devices” in the Steam Guard settings — this ends the performer's session.
• Duo and coaching do not require account access: you do not need to sign in to the account at all.

Disclosing the risk does not relieve us of responsibility

We disclose how access sharing works and give recommendations. This is so that you decide knowingly, not to shift the consequences onto you.

The disclosure and recommendations do not limit DeadBoost's responsibility for the safety of the data shared and for harm from its disclosure, loss of the account or actions of the engaged performer — to the extent established by the laws of Georgia.

If you did not follow the recommendations, this does not deprive you of the right to compensation and is not a ground to refuse to consider a claim.

Separately about the game rules: Piloted mode contradicts Valve's user agreement, and you accept this risk knowingly — it is described in detail in the Offer. But we are responsible for any breach of the agreed working procedure (third-party programs, playing outside the agreed hours, disclosure of your data).

What is published on the website

Some data becomes visible to an unlimited number of people. It is more honest to say this in a separate section.

• A review appears in the public feed immediately after it is sent, together with the author's name from the account. There is currently no pre-moderation: an administrator may hide a review later.
• For performers, the pseudonym, win rate and number of matches over the recent period are published. These figures are calculated from the performer's game account via an external game API.
• We will delete a review or anonymize its authorship at your request. We never link a refund or dispute resolution to removing or changing a review.

Purposes and legal grounds for processing

We process data only for the purposes below and on the stated grounds.

• Registration, sign-in and operation of the account — performance of the agreement and your actions to conclude it.
• Placing, paying for, fulfilling and accepting an order, communication about the order in the chat and by voice — performance of the agreement.
• Sharing the necessary order data with the performer who took it — performance of the agreement and a processing instruction.
• Tracking order progress and showing game statistics — performance of the agreement; for this the game identifier is sent to an external game API (see the next section).
• Reviewing disputes, refunds, proving the quality of the service — performance of the agreement and protection of the parties' rights.
• Accepting payments, refunds, tax and accounting records — performance of obligations imposed on us by law.
• Moderating reviews and the staff action log — performance of the agreement and our legitimate interest in monitoring staff actions.
• Protecting discounts and promo codes from being obtained repeatedly by one person — our legitimate interest.
• Protecting against taking a deal outside the service (automatic checking of messages for contacts and payment details) — our legitimate interest.
• Protecting against attacks and troubleshooting (web server log, sign-in attempt counter) — our legitimate interest.
• Reviewing a performer application — your consent given when submitting the form.
• Web analytics — only your separate consent in the cookie banner. Without consent analytics scripts are not loaded.
• Order emails and bot messages (payment, contractor, completion, dispute, refund, payment reminder) — performance of the contract. They can be switched off in settings.
• Offers and bonuses by email and in Telegram — only with your separate prior consent: the “Send me offers and bonuses” checkbox is unticked by default. We do not combine consent to the Offer, consent to data processing and consent to mailings into one checkbox. Offers come at most once a week.
• We do not process special categories of personal data or biometric data.

Who we share data with

We do not sell data and do not share it for other parties' advertising. The circle of recipients is limited to those without whom the service does not work.

• The performer who took your order — sees the order parameters, the conversation and attachments, including credentials if you sent them. The performer's access is limited to their order. We are introducing the procedure for formalizing processing instructions with performers; until it is complete, DeadBoost is responsible for the performer's use of your data.
• Support and administration staff — access to all orders and conversations, without a technical restriction to individual orders. Internally we require that conversations be accessed only for moderation, dispute review and refunds.
• Hetzner Online GmbH (Germany) — hosting provider. The website and API run, and the database, chat attachments, uploaded avatars and their backups are stored, on a server rented from it in Finland (Helsinki). This is a cross-border transfer.
• Cloudflare, Inc. (USA) — traffic delivery and protection: all requests to the website and API pass through its servers. Your browser's secure connection terminates at a Cloudflare node and is re-encrypted to our server, so Cloudflare processes requests in full — including the IP address, browser information, chat messages, uploaded files and sign-in data. On a network error the browser may send Cloudflare a technical report about it (Network Error Logging). This is a cross-border transfer.
• api.deadlock-api.com — an unofficial public API for game data. Our server sends it the game account identifier (SteamID3) and receives match history, rank, in-game nickname and avatar. This happens when tracking order progress, when showing your game statistics in your profile, when calculating the public performer showcase and when signing in with Steam — including if you did not link a game account separately: it is derived from your Steam sign-in. In addition, your browser contacts deadlock-api.com servers directly: on the home page — for statistics on the distribution of players by rank, on the order progress panel and in game statistics — for rank and hero images; in doing so the service receives your IP address and browser information. This is a cross-border transfer; the service is located in за Cloudflare (США), физическое размещение оператор публично не раскрывает.
• Media server собственный сервер DeadBoost (Hetzner, Германия) — technical transmission of voice in the order room, without recording.
• Valve (Steam), Telegram and Discord — only if you chose to sign in with them. The sign-in takes place on their pages, and we receive the identifier, name and avatar. With Steam sign-in our server confirms the sign-in by a request to Steam; with Discord it exchanges the sign-in code with Discord and requests the profile; the Telegram sign-in script is loaded from telegram.org only after you click the Telegram button. We do not copy avatars from these services: the browser loads the image directly from their servers, so when such an avatar is shown on the website, the service learns the IP address of whoever is viewing it. This is a cross-border transfer.
• PayPal (paypal.com) — the payment service through which our payment collection agent Individual Entrepreneur Yaroslav Spaskyi (Georgia) accepts payments on our behalf. On the PayPal page you sign in to your PayPal account or enter a card, and PayPal receives these details, the amount and purpose of the payment, as well as your IP address and browser information. The agent and we receive from PayPal the payer's name and email address from the PayPal account, the amount, currency, payment identifier and its status. This is a cross-border transfer.
• OxaPay (oxapay.com) — the payment service that accepts cryptocurrency payments. On the payment page the service receives the amount and purpose of the payment, the chosen coin and network, the wallet address the transfer came from and the transaction identifier, as well as your IP address and browser information; under its AML rules the service may check the transaction. We receive from the service the amount, currency, coin and network, the address and transaction identifier and the payment status. This is a cross-border transfer.
• Resend, Inc. (USA) — the email sending service. It receives the address for emails and the subject and text of the email, and hands the email to the recipient's mail service. This is a cross-border transfer.
• Telegram — if you allowed the bot to message you: the text of an order message or offer and your Telegram identifier are passed through the Telegram Bot API. This is a cross-border transfer.
• Yandex Metrica and Google Analytics 4 — only after your consent to analytics and only if the counter has been connected by the website owner. Google Analytics 4 is a cross-border transfer to the USA.
• An unlimited number of people — to the extent described in the section “What is published on the website”.
• Government authorities — upon a reasoned request within the law.
• Data is not shared with anyone else.

Payment, receipts and payment disputes

A section about money so that you do not have to search other documents.

PayPal payments are accepted by the PayPal payment service. Our service does not process or store payment card data: the card is entered on PayPal's side, and we receive the amount, currency, payment identifier, status, and the payer's name and email address from the PayPal account.

The recipient of funds for orders and tips is Individual Entrepreneur Nikolai Karelin. Tips are an addition to the service price, only by your explicit action, without pre-ticked boxes. The service does not transfer money between users and is not a payment agent.

There are no recurring charges or subscriptions: you make each payment separately, and payment data for subsequent charges is not saved.

Cryptocurrency payments are accepted by the OxaPay (oxapay.com) payment service. Your wallet and its keys stay with you; we receive the amount, coin and network, the sending address, the transaction identifier and the payment status — they are kept in the payment data for reconciliation and refunds. Information about the transfer itself is public by the design of the blockchain.

The charge is made in the currency shown on the payment screen and recorded in the order's price snapshot. If your card currency is different, the conversion is done by your bank at its own rate.

Once payment acceptance is connected, the payment will appear on the statement as PAYPAL *DEADBOOST. If you see an unfamiliar charge, write to contact@deadboost.com — it is faster than going through the bank.

For each order we keep the price calculation snapshot, the status log with timestamps, progress reports and the conversation history. We use this set when reviewing a dispute and when considering payment claims as confirmation of the agreed terms and of the actual provision of the service.

The procedure for cancelling an order, refunds and dispute review is described in the Offer. Automatic acceptance of an order, if applied, means only acceptance of the result and a ground for settlements with the performer — it does not deprive you of the right to make claims about the quality of the service within the periods set by the laws of Georgia.

Cookies, local storage and analytics

The website uses cookies of two categories.

Technical — needed for the website to work and set without consent: deadboost_refresh and deadboost_staff_refresh (sign-in session, httpOnly), deadboost_media and deadboost_media_staff (viewing attachments in the order chat, httpOnly), deadboost_oauth_state (protecting the Discord sign-in procedure), deadboost_spin (tracking the discount issue limit), db_rub_ip (sign of a visit from Russia, used to choose the currency), db_locale (the chosen website language).

Analytics — only after your consent. Yandex Metrica and Google Analytics 4 scripts are loaded only after you click “Accept” in the cookie banner and only if the counter identifiers are set in the website settings. The list of actually connected counters is updated at the same time as they are connected; before connection, analytics scripts are not loaded even with consent.

What Metrica collects after consent: a click map, link clicks, Session Replay (Webvisor — recording of actions on the page) and e-commerce data via dataLayer. Together with goals we send parameters without your name and email: the type of service, the amount and currency of the calculation or order, the size of the discount received. Approximate location by IP address and device parameters are collected by the analytics service itself — it determines the composition of this data and its retention period.

The banner has a single “Accept” button. Until it is clicked, analytics scripts are not loaded; access to the website, checkout and order fulfilment does not depend on it.

Your consent is saved in the browser's local storage (localStorage, key deadboost:cookie-consent). There is currently no separate “Cookie settings” button on the website: you can withdraw consent by clearing the website data in your browser or by writing to contact@deadboost.com. The fact of consent is currently not recorded on the server.

localStorage also stores interface settings: deadboost:casino-win (the last discount won), deadboost:promo-banner:casino20 (hidden promo banner), deadboost:sound-off (sound off), deadboost:chat-sound-off (chat message sound off), deadboost:order-next:… (the order action panel has already been opened), deadboost:hero-paused (home page animation paused), deadboost:calc-widget-hint (calculator hint shown). This data stays in your browser, is not sent to the server and disappears when the website data is cleared.

Retention periods

We keep data no longer than needed for the purpose for which it was obtained. The period runs from completion of the work by the performer, not from your confirmation: if an order remains unconfirmed, the countdown still runs from the completion mark.

There is no automatic time-based cleanup in the system yet: deletion after the period expires is performed by the administration. This is a limitation, not a promise of a mechanism.

• Account data — while the account exists, and 30 days after a deletion request.
• Order data, price snapshot, event log, progress reports, the dispute and its decision — 3 years. This period is needed so that you can make claims about service defects within the period set by the laws of Georgia, and we can present evidence.
• Order chat messages and attachments — 2 years.
• Messages with Steam credentials are kept together with the rest of the conversation. We will anonymize them earlier at your request to contact@deadboost.com: the message text is replaced with a deletion mark, and the record itself remains so that the order history keeps its integrity.
• QR code image for Piloted sign-in — while the sign-in request is open, but no longer than 10 minutes; deleted automatically after the sign-in is confirmed, cancelled, replaced with a new code or expires.
• Unsent attachments — 24 hours, deleted automatically.
• Refresh token hashes — until the session expires; the record is deleted when you sign out.
• Documents and data on payments, refunds and tips — for the period established by legislation on accounting, taxes and the use of cash registers.
• Staff action log — 3 years.
• Discount issue log and promo codes — 1 year after the promo code expires.
• The address for emails and email settings — while the account exists; can be deleted earlier by email to contact@deadboost.com.
• Log of consents to offers — 3 years after consent is withdrawn, to prove that emails were sent with consent.
• Log of sent emails and bot messages — 1 year.
• Web server log — 6 months.
• Backups of the database, attachments and avatars — up to 8 weeks, then deleted automatically (see “Where the data is stored”).
• Rejected performer applications — 6 months, then deleted.
• Published reviews — while the review is published.

Where the data is stored

The website, API, database, chat attachment files and uploaded avatars are hosted on a rented server in Finland (Helsinki) with the hosting provider Hetzner Online GmbH (Germany).

Cross-border transfers: Hetzner hosting (all service data is on the server in Finland); Cloudflare in the USA (all website and API traffic passes through its nodes); api.deadlock-api.com (game statistics by account identifier and direct requests from your browser for statistics and images); the PayPal payment service and the payment collection agent Individual Entrepreneur Yaroslav Spaskyi (Georgia) (PayPal account or card details and payment data at payment); the OxaPay payment service (cryptocurrency payment data); Valve (Steam), Telegram and Discord — when signing in with them and when showing avatars from these services; Telegram — for bot messages if you allowed the bot to message you; Resend in the USA (email addresses and texts); Google Analytics 4 in the USA — if this counter is connected and you have given consent; the voice chat media server — if voice communication is enabled. There are no other cross-border transfers.

Backups of the database, attachments and avatars are created automatically once a day and stored on the same server: copies for the last 14 days and one copy for each of the last 8 weeks; older ones are deleted automatically. So deleted data remains in backups for no longer than 8 weeks.

To protect against losing the server, the administrator downloads a backup to their computer. With each download the script deletes copies older than 8 weeks from the computer.

How we protect data

Below are the measures that are actually implemented. There are no “100% secure” promises here: absolute protection does not exist.

• The connection to the website is encrypted (HTTPS).
• Passwords are stored only as a hash with an individual salt; the original password cannot be recovered from the database.
• Refresh tokens are stored as a sha256 hash; the session cookie is httpOnly.
• For staff, sign-in to the administrative part is protected by a separate session and two-factor authentication (TOTP).
• Uploaded files are checked by content, not by the declared type; images are re-encoded, and shooting metadata and geolocation are removed from them; limits on upload volume and frequency apply.
• Access to an order conversation is limited to the order participants, support and the administration. Attachments, however, are served via a temporary signed link without re-checking sign-in (see the section on messages).
• The log records modifying actions of staff: blocks, performer assignment, dispute decisions, hiding and publishing reviews, role changes, marking payment. The staff member's IP address and conversation views are not logged.
• What does not exist: separate encrypted storage of Steam credentials, a technical ban on sending a password in the chat, and logging of staff access to messages. So credentials sent in the chat are protected no better than the rest of the conversation. We say this directly rather than hiding it in general wording.
• In the event of a leak we will notify the Personal Data Protection Service of Georgia within the periods set by the Law on Personal Data Protection and inform the affected users.

Your rights and how to exercise them

Under the Law of Georgia on Personal Data Protection you have the right to:

• Receive confirmation of the processing of your data and information about it: purposes, data composition, sources, periods, recipients.
• Receive a copy of the data processed.
• Demand that data be corrected if it is incomplete, outdated or inaccurate.
• Demand that data be blocked or destroyed if it is processed unlawfully or is no longer needed for the purpose of processing.
• Withdraw consent where processing is based on consent.
• Object to processing for analytics and marketing.
• Appeal our actions to the Personal Data Protection Service of Georgia (personaldata.ge) or to a court.
• Send requests to contact@deadboost.com from your account email address. If the address is different, we will ask you to confirm your identity — otherwise we might hand the data to the wrong person.
• The response time for a personal data request is 10 business days from receipt, extendable by no more than 5 business days with notice of the reasons.
• Consumer demands — a refund of money paid, a price reduction, reimbursement of costs and losses — are considered and satisfied within 10 calendar days of submission. This is a different, shorter period, and it is not replaced by the period for data requests.
• Sending a claim to contact@deadboost.com is not a mandatory condition for going to court.
• We do not charge for exercising your rights.

Withdrawing consent and deleting your account

Consent to analytics is withdrawn in the browser: clear the website data and the banner will ask again; until “Accept” is clicked, analytics scripts are not loaded. You can also write to us and we will help.

Consent to offers is withdrawn in one click: with the “Unsubscribe from offers” link in any email or the “Offers and bonuses” toggle in settings. Order emails are switched off in the same place. The souls bonus granted for the email is not taken back after withdrawal.

Withdrawing consent in other cases, deleting the account and deleting individual messages — by email to contact@deadboost.com. There is currently no account deletion button in the interface: the administration handles the request manually within no more than 30 days of receiving the email.

At your request messages are anonymized: the text is replaced with a deletion mark, and the record of the message remains so that the order and dispute history keeps its integrity.

Data we are required to keep by law (documents on payments, refunds and receipts) and data of an open order or dispute are kept. In that case we will tell you what exactly remains, why and for how long.

Deleting the account does not cancel obligations under a paid order that is not yet completed.

Age of users

The website is intended for persons aged 18 and over. There is currently no automatic age check, and we do not intentionally collect children's data.

If we learn that an order was placed by a minor without the consent of a legal guardian, we will stop processing and cancel the order. An agreement with a minor concluded without a legal guardian's consent has no force: the money paid is refunded in full by the same payment method within 10 days.

Data needed for the refund and for accounting and tax records is kept for the period established by law; other data is destroyed. A legal guardian may demand this by writing to contact@deadboost.com.

Changes to the policy

We may change this policy. A new version takes effect from the moment it is published on the website; the version number and date are given at the end of the document.

If a change expands the composition of data or the purposes of processing, we will ask for new consent where processing is based on consent, and will not apply it retroactively to data already collected.

There is no archive of previous versions at permanent links yet — we will set it up together with the publication of the website's legal pages. Until then the version published on the website is considered current; we will provide its number and date on request to contact@deadboost.com.

Contacts

Operator: Individual Entrepreneur Nikolai Karelin, identification (registration) number 306528157, country of registration: Georgia, address: Adjaria, Batumi, Bagrationi 129.

Email for personal data requests, withdrawal of consent and claims: contact@deadboost.com.

Questions about personal data processing, withdrawal of consent and requests about your data — contact@deadboost.com. The Contractor handles them directly: Georgian law does not require a separate data protection officer for a business of our size.

Version: 1.4 of 17.10.2026.