Data Collection & Compliance

This page is a plain, complete declaration of what data MMR Boost collects, why, where it lives, and how long we keep it. It complements our Privacy Policy, which covers your legal rights in full detail. Our rule is simple: collect the minimum needed to run the Service, encrypt the sensitive parts, and never sell your data.

1. Data Points We Collect

Every category of data we hold, with its purpose, storage, and retention:

Account data — email, password hash, display name, and account role. Used to create and operate your account. Stored in DynamoDB (AWS, eu-west-1). Retained for the life of your account plus statutory tax/accounting periods.
Order data — service ordered, MMR/options, status, and chat messages with your booster. Used to deliver and support the order. Stored in DynamoDB. Retained as required by financial-record law (typically 5–7 years).
Game credentials — Solo Boost and Calibration only. Used to play on your account. Encrypted with AES-256 in a dedicated table, access audit-logged, and auto-purged within 24 hours after order completion.
Payment data — handled by our payment processors; we never see your full card number. Used to process payments and refunds. Stored by the processor (Stripe, PayPal, NOWPayments), not by us.
Technical data — IP address, browser, and device type. Used to keep the Service secure and reliable. Collected at request time; retained in logs on a short rotation.
Analytics data — pageviews and clicks, captured by PostHog and tied to your account identifier (Cognito ID) and persona once you are logged in. Used to understand product usage and improve the Service. We do not put personal information in analytics event properties. Persisted in your browser via localStorage and a cookie. This is optional — you control it through our cookie banner.
Crash & error logs — when the app hits an unexpected error, we send the error message, error type, and the stack trace (including the React component stack) to PostHog so we can diagnose and fix it. Used solely for reliability. No order or payment data is attached.
Approximate location — derived only from your IP address (coarse, country/region level) by our analytics and edge providers. Used for security and aggregate usage stats. We do not use your browser’s precise geolocation, and we never ask for it.

We do not record your screen or sessions, and we do not sell, rent, or share your data for third-party advertising.

2. Trust & Compliance Overview

Encryption — TLS for all data in transit; AES-256 at rest for sensitive fields such as game credentials.
Access control — least-privilege access and audit logging of credential access.
Regulatory alignment — we operate in line with the GDPR, UK GDPR, and the CCPA/CPRA. Your full rights under each are detailed in our Privacy Policy.
Breach notification — in the unlikely event of a breach affecting your data, we notify affected users without undue delay and, where required, within 72 hours.
No data sales — we have never sold or shared personal information for cross-context behavioral advertising, and we do not do so.

3. Subprocessors

The third parties that process data on our behalf, the data they touch, and where they operate:

Amazon Web Services (AWS) — hosting, storage, and database. Account, order, and credential data. eu-west-1 (application data); us-east-1 (CloudFront edge). DPA in place.
Amazon Cognito — authentication and identity. Email and account identifiers. AWS region. DPA in place.
Amazon SES — transactional email (verification, order updates, receipts). Email address and message content. AWS region. DPA in place.
Stripe — card payment processing. Payment and billing data. Global. DPA in place.
PayPal — PayPal-account payment processing. Payment data. Global. DPA in place.
NOWPayments — cryptocurrency payment processing. Payment data. Global. DPA in place.
Cloudflare — DNS and edge security. IP address and request metadata. Global edge. DPA in place.
PostHog — product analytics and crash/error reporting. Usage events, account identifier, error/stack traces, IP-derived coarse location. US Cloud. DPA in place.

Each processor handles data only for the purpose we engage it for, under its own policy and a data-processing agreement where required by law.

4. Your Rights & How to Exercise Them

Depending on where you live, you can access, correct, delete, restrict, port, or object to the processing of your personal data, and withdraw consent at any time. The full list of rights and legal bases is in our Privacy Policy.

To make a request, contact us through the in-app chat or our Help Center. We respond within 30 days, as required by GDPR Article 12(3). You can opt out of optional analytics at any time via our cookie banner.