Privacy Policy

Holiday Boost is an application for e-commerce merchants that generates holiday-themed variations of product images and schedules them on the merchant’s storefront. For data we receive from your store on your behalf (such as your product catalog), you — the merchant — are the data controller and we act as your data processor, processing it to provide the Service as described in this policy. We are the data controller for information you provide to us directly — such as your account email, support messages, and your interactions with this website — and for the limited marketing uses described in section 3. We are also the data controller for what we hold about the businesses we contact by email (see Businesses we contact and preview pages).

The Service is operated by Holiday Boost. You can reach us at hey@holidayboost.ai.

When you connect a store, we collect and process:

• Store information — your store’s name and domain, the contact email on your store account, platform identifiers, and the API access credentials the platform issues to us.
• Catalog data — product titles, categories, statuses, and product images, which are the core input the Service works on.
• Configuration & activity — the holidays, products, schedules, caps, and review decisions you set in the app, plus the generated images and publication history.
• Account data — the email address and login details you use for the Service, if and when we offer and you create a direct account.
• Usage & log data — technical logs such as IP address, browser type, pages viewed, and actions taken, used for security and to operate the Service.
• Billing data — billing is handled by your platform (for example, Shopify Billing). We receive charge and subscription status, but we never receive or store your payment card details.

We use the data above to:

• provide the Service — generate holiday variations of your product images, schedule them, publish them to your storefront, and revert to your originals;
• operate your account, billing, caps, and preview reviews;
• provide support and respond to your requests;
• secure, monitor, debug, and improve the Service, including aggregate, de-identified analytics;
• as permitted by our Terms of Service, showcase store names, logos, and before/after image examples in our marketing — we act as the data controller for this use, and you can opt out by emailing hey@holidayboost.ai;
• comply with legal obligations and enforce our Terms.

Where GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, improvement, support), and legal obligation.

To generate holiday variations, your product images and related product context are transmitted to third-party AI image-generation providers (for example, Google’s Gemini API). The provider processes the image to produce the variation and handles it under its own terms and data-use commitments. We use Google’s paid API services, for which Google states that prompts and responses are not used to improve its products and are logged only for a limited period, solely to detect and prevent policy violations. Generated variations are stored by us so you can review, publish, and revert them. If we change AI providers, we will reflect the change in the service providers listed in this policy.

Images generated by AI are machine output. As explained in the Terms of Service, you must review them before they are published and you are responsible for what appears on your storefront.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share data only with service providers that help us run the Service and contact businesses, and only what they need:

• Your e-commerce platform (for example, Shopify) — to read your catalog, publish images, and process billing;
• AI providers (currently Google’s Gemini and FAL, and, when enabled in our settings, OpenAI, Anthropic, DeepSeek or MiniMax): to generate image variations, as described above, and the preview mockups we send to businesses we contact; to judge from a store’s public catalog and product photos which of its products suits a holiday preview, and which holidays suit that product; and to choose, from the names and job titles a business-contact database lists for a store, the right person there to write to;
• Cloud infrastructure — database, file-storage, and hosting providers that store the Service’s data (currently including Supabase and Railway);
• Website analytics (currently Google Analytics) — on our public website only, and only with your consent: the pages you visit, how you arrived, your approximate location, and your device and browser. Google signals and ad personalization are off, and we never send it your email address or your store’s domain;
• Operational tooling — internal alerting and messaging tools we use to monitor and operate the Service. Our alerting tool (currently Slack) receives account-level events such as an install, a plan change, or an uninstall, together with your store name, store domain, and the contact email on your store account. For the businesses we contact, it also receives the store, the address we wrote to and the name and job title of the person behind it, the preview images, any replies, the outcome of our calls, and how the preview page and the case study page were used (such as the type of device and the country they were opened from). Our email provider (currently Brevo) delivers transactional messages — the acknowledgement we send when you use our contact form, and the store report we compile in response to a data request;
• Email outreach, for the businesses we contact: our email-sending platform (currently Instantly), our mailbox provider (currently Microsoft 365), and an email-verification service (currently MillionVerifier) that checks an address before we write to it;
• IP geolocation (currently IPinfo): receives the network (IP) address of a visitor to one of our preview pages, to derive the approximate country the page was opened from and to recognize automated email-security scanners. We do not store the address itself;
• Call scheduling (currently cal.com): if you book a call from a preview page, it receives what you enter there and a reference to the preview you came from;
• Business-contact data (currently Apollo.io): a database of business contacts from which we obtain the names, titles, work email addresses and work phone numbers of the people who run or market a store we contact. It receives the store’s domain and, when we add a contact to our calling list there, the contact’s name, title, email address and phone number;
• Authorities or advisors — where required by law, to protect our rights, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to the transferred data).

We keep store and catalog data while your store is connected to the Service. We delete or de-identify the data associated with your store within thirty (30) days of receiving Shopify’s shop-redaction notice (which Shopify sends about 48 hours after you uninstall) or a verified deletion request from you at hey@holidayboost.ai, except for records we must keep for legal, billing, or security purposes, operational alert history in the internal tooling described above, and residual copies in routine backups, which expire on a rolling basis.

Note that images already published to your storefront live in your store, not in the Service — removing the app does not alter your storefront’s then-current images, so review your store state before uninstalling.

We email online stores in the United States to show them what the Service could do for their products. Each email links to a preview page: a free, AI-generated mockup of one of the store’s products, styled for an upcoming holiday. This section covers those businesses, whether or not they ever use the Service.

• Who we contact. Businesses in the United States only.
• Where the data comes from. Lists of online store domains, with public information about each store’s website (such as the apps and technology it uses, how popular it is and whether it advertises), and what each store publishes itself: its public storefront information (such as its name, country, city and state, product catalog and product photos) and the contact details on its website (email addresses and phone numbers). We write to an address the store publishes on its website, which can be a Gmail or similar address, or to a common business address at the store’s own domain, such as info@ or hello@. We may use such a common address even when the store lists another one, for example a help-desk address, or when its listed address cannot be verified. We check addresses with an email-verification service before we write to them. For some stores we also use a business-contact database (currently Apollo.io) to find the right person to write to: their name, job title, work email address and, when we plan to call, a work phone number, with the Do Not Call status the database reports for it.
• What we hold. The email address we write to; the store’s name, domain, country, city and state, and product catalog; the contact details it publishes (email addresses and phone numbers) and the public information about its website described above; the name, title and work contact details of the person we wrote to, and of other people at the business the database listed; the product photos we make previews from, and the AI mockups themselves; the history of our emails to you: when each was sent, and any reply or unsubscribe; and the record of any phone call we made (when, and the outcome). If you book a call from a preview page, we also hold what you enter when booking.
• What a preview page records. We record it ourselves, with no third-party analytics or tracking tools: whether the page was opened, how long the preview was on screen and how you interacted with it (for example, a scroll or a tap), which buttons were pressed, any answer you give about the image, the type of device, the names of the browser and operating system, and the approximate country the page was opened from. On the case study page a preview links to, we also record how far you read, how long the page was open and which of its sources you opened. The country comes from your network (IP) address through an IP-geolocation service, or from your device’s time zone; we do not store the IP address. Preview pages and the case study set no cookies and load no third-party scripts.
• How we use it. To make and show your preview, to decide whether and when to follow up, to answer you, and to honor your choice to stop hearing from us.
• Calls. If you open the images we made, we may call the business contact once or twice during business hours to ask what you thought. Calls are dialed by hand, never recorded, and never automated. Tell us not to call and we keep a permanent do-not-call record, like the do-not-contact record for email.
• No sale or sharing. We do not sell this data or share it for cross-context behavioral advertising. The service providers listed under Sharing & service providers receive only what they need to do this for us.
• How long we keep it. The detailed record of each visit to a preview page is kept for at most 180 days; a summary of what happened (for example, that the page was opened and which buttons were pressed) stays with the history of our emails to you. We keep that history, the store’s data and the preview images until you ask us to delete them (or delete the images yourself, as described below), except a do-not-contact record (your address, and when and how you opted out), which we keep permanently so that we never email you again, and a do-not-call record (the business, and when you told us), which we keep permanently so that we never call you again. Neither the 180-day limit nor a deletion reaches our internal alerts (see Sharing & service providers): they repeat what a visit recorded and can show the preview images, and we keep them as an operational log.
• When your preview link closes. The link to your preview closes 30 days after the first email we sent you about it, and the preview page shows the date. After that the link no longer opens your preview. Closing the link deletes nothing: we keep the preview images and the other data as described in the point above, until you ask us to delete them.
• Deleting your preview yourself.The preview page has a “Delete this preview” link, which still works after the link has closed. It erases every preview image we made for your store at once, closes every link to them, and stops our emails to you for good. It also stops our calls. It can’t be undone. As the points above say, we still keep the do-not-contact record, and our internal alerts keep their copies.
• Stopping our emails. Reply “unsubscribe” to any of our emails, use the unsubscribe option your email app may show for our messages, or write to hey@holidayboost.ai. We honor it within 10 business days at most, usually at once. To stop our calls, say so on the call or write to the same address; we honor it at once.
• Your rights. The rights described under Your rights apply to this data too.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent.

• EEA/UK (GDPR). You may exercise the rights above and lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA). You may request to know, delete, or correct personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information beyond what is necessary to provide the Service. We will not discriminate against you for exercising your rights.

To exercise any right, email hey@holidayboost.ai. We respond to verified requests within thirty (30) days, and we may need to verify that you control the store in question before acting on a request.

Our service providers may store and process data in countries other than yours, including the United States. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses or the providers’ certified transfer frameworks. For questions about international transfers or data-processing terms, contact hey@holidayboost.ai.

We use reasonable technical and organizational measures to protect the data we hold — including encrypted transport, scoped API credentials, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you use the Service at your own risk to the extent permitted by law.

The website and app use cookies and similar technologies that are strictly necessary to operate the Service — such as keeping you signed in and securing sessions. These are always on. We do not use third-party advertising cookies.

With your permission we also use optional cookies for session recording and product analytics to understand how the Service is used and to debug and improve it. Session recordings never include our internal development/test stores. You choose whether to allow these optional cookies through the cookie banner shown on your first visit, and you can change your choice at any time using the “Cookie preferences” link in the site footer. You can also control cookies through your browser, but disabling essential cookies may break sign-in.

On our public website, the same choice also covers website analytics (Google Analytics), which measures visits in aggregate — pages viewed, how visitors arrived, approximate location, and device. It is not loaded until you accept, and it is not used inside the app or on the preview pages we send by email. Links from our website and emails to our Shopify App Store listing carry campaign tags that name the page or campaign they came from — never you or your store — so we can see, in aggregate, how many visitors each one sends. Google explains how it uses this data in How Google uses information from sites or apps that use our services.

For the full list of the cookies we set, how long each one lasts, and your choices, see our Cookies Policy.

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date and, for material changes, provide notice through the Service or by email. Your continued use of the Service after a change takes effect means you accept the updated policy.

Privacy questions or requests: hey@holidayboost.ai.