Privacy Policy

Holiday Boost is an application for e-commerce merchants that generates holiday-themed variations of product images and schedules them on the merchant’s storefront. For data we receive from your store on your behalf (such as your product catalog), you — the merchant — are the data controller and we act as your data processor, processing it to provide the Service as described in this policy. We are the data controller for information you provide to us directly — such as your account email, support messages, and your interactions with this website — and for the limited marketing uses described in section 3. You can reach us at support@holidayboost.app.

When you connect a store, we collect and process:

• Store information — your store’s name and domain, platform identifiers, and the API access credentials the platform issues to us.
• Catalog data — product titles, categories, statuses, and product images, which are the core input the Service works on.
• Configuration & activity — the holidays, products, schedules, caps, and review decisions you set in the app, plus the generated images and publication history.
• Account data — the email address and login details you use for the Service, if and when we offer and you create a direct account.
• Usage & log data — technical logs such as IP address, browser type, pages viewed, and actions taken, used for security and to operate the Service.
• Billing data — billing is handled by your platform (for example, Shopify Billing). We receive charge and subscription status, but we never receive or store your payment card details.

We use the data above to:

• provide the Service — generate holiday variations of your product images, schedule them, publish them to your storefront, and revert to your originals;
• operate your account, billing, caps, and preview reviews;
• provide support and respond to your requests;
• secure, monitor, debug, and improve the Service, including aggregate, de-identified analytics;
• as permitted by our Terms of Service, showcase store names, logos, and before/after image examples in our marketing — we act as the data controller for this use, and you can opt out by emailing support@holidayboost.app;
• comply with legal obligations and enforce our Terms.

Where GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, improvement, support), and legal obligation.

To generate holiday variations, your product images and related product context are transmitted to third-party AI image-generation providers (for example, Google’s Gemini API). The provider processes the image to produce the variation and handles it under its own terms and data-use commitments. We use Google’s paid API services, for which Google states that prompts and responses are not used to improve its products and are logged only for a limited period, solely to detect and prevent policy violations. Generated variations are stored by us so you can review, publish, and revert them. If we change AI providers, we will reflect the change in the service providers listed in this policy.

Images generated by AI are machine output. As explained in the Terms of Service, you must review them before they are published and you are responsible for what appears on your storefront.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share data only with service providers that help us run the Service, and only what they need:

• Your e-commerce platform (for example, Shopify) — to read your catalog, publish images, and process billing;
• AI providers (for example, Google) — to generate image variations, as described above;
• Cloud infrastructure — database, file-storage, and hosting providers that store the Service’s data (currently including Supabase);
• Authorities or advisors — where required by law, to protect our rights, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to the transferred data).

We keep store and catalog data while your store is connected to the Service. We delete or de-identify the data associated with your store within thirty (30) days of receiving Shopify’s shop-redaction notice (which Shopify sends about 48 hours after you uninstall) or a verified deletion request from you at support@holidayboost.app, except for records we must keep for legal, billing, or security purposes and residual copies in routine backups, which expire on a rolling basis.

Note that images already published to your storefront live in your store, not in the Service — removing the app does not alter your storefront’s then-current images, so review your store state before uninstalling.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent.

• EEA/UK (GDPR). You may exercise the rights above and lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA). You may request to know, delete, or correct personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information beyond what is necessary to provide the Service. We will not discriminate against you for exercising your rights.

To exercise any right, email support@holidayboost.app. We respond to verified requests within thirty (30) days, and we may need to verify that you control the store in question before acting on a request.

Our service providers may store and process data in countries other than yours, including the United States. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses or the providers’ certified transfer frameworks. For questions about international transfers or data-processing terms, contact support@holidayboost.app.

We use reasonable technical and organizational measures to protect the data we hold — including encrypted transport, scoped API credentials, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you use the Service at your own risk to the extent permitted by law.

The website and app use cookies and similar technologies that are strictly necessary to operate the Service — such as keeping you signed in and securing sessions. We do not use third-party advertising cookies. You can control cookies through your browser, but disabling essential cookies may break sign-in.

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date and, for material changes, provide notice through the Service or by email. Your continued use of the Service after a change takes effect means you accept the updated policy.

Privacy questions or requests: support@holidayboost.app.