Privacy Policy · Wild Rift Boosting

1. Who is the controller?

Wild Rift Boosting (the operator of wildrift-boost.com) is the data controller for the personal information you share with us. Questions about this policy or the data we hold on you go to support@wildrift-boost.com.

2. What we collect

When you place an order

Email address, provided by Stripe on checkout. Used to send receipts and order updates.
Order details: current and desired rank, region, boost type, preferred champions and roles, any notes you leave.
Payment metadata: Stripe payment intent ID, amount, currency. We never see or store your full card number or CVC. Stripe handles that and is PCI-DSS Level 1 certified.
Riot account credentials (Solo orders only): your Riot ID and password, encrypted with industry-standard encryption the moment you submit them. DUO orders never require credentials.

When you have an account with us

Display name and (optional) profile picture: shown in your dashboard, on the leaderboard for boosters, and to whoever you are working with on an order. You choose whether to upload a picture.
Activity signals: a timestamp of when you were last active in your dashboard, used to power the “online” indicator and recent-activity timestamps. Stored per user, not per page view, and not shared with third parties.
Wallet, cashback, and loyalty totals: rolling totals so we can apply your loyalty tier discount on future orders and credit cashback at completion.
Referral data: a referral code we generate for you, plus the referral code (if any) you signed up under, so we can credit signup rewards.
Marketing and consent flags: separate toggles for marketing email and GDPR consent. You can change these any time.
Dispute history: a count of credit-card chargebacks filed against your account, used to enforce our anti-fraud policy.

When you apply as a booster

Name, email, Discord username, Riot ID, op.gg URL (optional), current and peak rank, region, hours per week, free-form experience and motivation notes.
For accepted applicants: payout method and payout details, encrypted at rest.

Automatically

IP address and user agent, stored with security event logs for fraud detection and abuse prevention. Retained for 90 days.
Cookies, see section 7 below.

3. Why we collect it (lawful basis)

Contract: processing your order, creating your dashboard session, sending order updates.
Legitimate interest: fraud detection, platform security, aggregate analytics.
Consent: marketing emails (opt-in only), non-essential cookies.
Legal obligation: tax and payment records we are required to keep.

4. How long we keep it

Data	Retention
Riot account credentials	Wiped shortly after order completion
One-time auth codes (2FA forwarding)	Cleared on use, expire within minutes if unused
Order records (for tax and refund history)	6 years (legal requirement)
IP and security event logs	90 days
Marketing email list	Until you unsubscribe
Booster application (rejected)	6 months
Booster profile (accepted)	For the duration of the booster relationship plus 1 year
Profile picture	Until you remove it or delete your account
Dashboard activity signals (last-active)	Overwritten on each new session, no historical log retained

5. Who we share it with

We share the minimum necessary personal data with these third-party processors, each under a Data Processing Agreement:

Stripe (payments): email, payment metadata. Based in Ireland and USA.
Supabase (database and file storage): all the data listed in section 2. EU or US region depending on your signup location.
Resend (transactional email): email address and order number.
Your assigned booster: Riot ID, decrypted password during their session only (Solo orders), preferred champs and roles, any notes you left, your display name and profile picture.

We do not sell your personal data. We do not share it with advertisers or data brokers.

6. Your rights (GDPR and similar)

You have the right to:

Request a copy of everything we hold on you (data portability).
Correct anything that is wrong.
Delete your account and associated data (the “right to be forgotten”). We will keep order records for tax purposes but strip personal identifiers.
Object to specific processing (for example, marketing).
Withdraw consent at any time.
Complain to your local data protection authority.

To exercise any of these, email support@wildrift-boost.com. We will respond within 30 days.

7. Cookies and analytics

We use a small set of cookies and tracking tags:

Session cookie: keeps you logged in. Set when you sign in, cleared when you sign out. Essential.
Local-storage timer: tracks the visible sale countdown on the homepage so it does not reset on every page load. Essential.
Google Analytics 4: aggregate page-view, traffic source, and on-site engagement metrics. We use this to understand which pages and channels work, not to identify individual visitors. Google Analytics sets its own cookies (typically _ga and _ga_*) and Google may process the data on your behalf under their own privacy terms.

We do not use third-party ad-targeting cookies or cross-site advertising trackers. If you are in a region where analytics requires opt-in consent and you would like us to suppress GA for your visit, email support@wildrift-boost.com and we will flag your account.

8. Children

The service is not directed at anyone under 16. If you are under 16, please ask a parent or guardian before ordering and have the payment made in their name.

9. Security

We use industry-standard encryption (TLS in transit, AES-256-GCM for sensitive data at rest), role-based access controls, and rotating backups. Despite our best efforts, no transmission over the internet is 100% secure. If we ever have a breach affecting you, we will notify you within 72 hours as required by GDPR.

10. Changes

Material changes to this policy are announced on the homepage at least 7 days before taking effect. The “Last updated” date at the top of this page always reflects the current revision.

11. Contact

Data questions, deletion requests, and everything else: support@wildrift-boost.com.