Privacy Policy

Information you provide directly:

• Name and contact details, including an email address and a phone number if you share one
• Business name, project details, briefs, and materials shared during an inquiry or engagement
• Newsletter subscription details and information you choose to include in communications
• Do not submit payment-card or bank-account details through public website forms; the public website does not contain a card-payment form

Information collected automatically on the website:

• Basic usage data, device and browser information, referring URLs, and online identifiers collected by optional analytics and session-insight providers when you allow them
• Anti-spam verification data processed by Cloudflare Turnstile when you submit a form
• Information stored locally in your browser to prefill some tool or project-form fields

Private dashboard and connected social accounts:

• Your dashboard sign-in identity and authorization status
• Provider-scoped account or Page identifiers, display names, account type, granted publishing permissions, token expiry, and connection health
• Encrypted access or refresh tokens supplied by LinkedIn or Meta; CuratedBoost never asks for or stores your social-media password
• Approved campaign content, schedules, provider post identifiers, delivery results, and security audit evidence

• Respond to inquiries and communicate about potential or active engagements
• Deliver services and send email updates when you separately subscribe
• Operate, secure, diagnose, and improve the website and private dashboard
• Comply with legal obligations

Connected social accounts:

• Authenticate the account owner and discover only the profiles or Pages the provider authorizes
• Publish owner-approved content to deliberately activated destinations
• Monitor delivery, prevent duplicate publishing, diagnose failures, and maintain security evidence

• Access to the private dashboard is restricted to approved accounts. Social connections and publishing destinations default to inactive.
• Disconnecting a social account immediately disables publishing and destroys its stored token ciphertext. It does not delete posts already published on the provider.
• Inquiry records that do not become an engagement are normally retained for up to 12 months. Newsletter details are retained until you unsubscribe. Client-engagement records are normally retained for three years after the engagement, unless a longer period is legally or contractually required.
• Revoked connection metadata and limited audit evidence may be retained when necessary to prevent duplicate publishing, investigate security incidents, establish approval history, or meet legal obligations. A verified deletion request removes or de-identifies personal data that is no longer required for those purposes.
• No method of digital storage or transmission is entirely secure. We cannot guarantee absolute security.

Relevant providers include:

• Resend for inquiry, project, and newsletter email
• Cloudflare Turnstile for spam prevention
• Google Analytics and Microsoft Clarity after you allow Analytics and session insights
• Sentry for narrowly configured error and performance monitoring; Session Replay loads only after you allow Analytics and session insights
• Google for authentication of approved private-dashboard users
• Supabase for private dashboard, connection, campaign, schedule, and audit records
• Netlify for website hosting and approved scheduled delivery functions
• LinkedIn and Meta to authenticate connected social accounts and receive content explicitly approved for their destinations
• Legal authorities where required by law, regulation, or legal process