Last updated: 2026-03-11
Carboost is operated by Krisdevs, a company registered in Belgium (BE 0778.905.149) ("we", "us", or "our").
We are the data controller responsible for your personal data processed through the Carboost platform (carboost.app). For any questions regarding this policy or your personal data, contact us at [email protected].
We collect and process the following categories of personal data:
Account data
Authentication & session data
Vehicle data
Video data
Payment data
Organization & team data
Outreach data (dealer outreach feature)
Usage & technical data
We collect data through the following means:
Under the GDPR, we process your personal data on the following legal bases:
| Processing activity | Legal basis |
|---|---|
| Account creation and management | Performance of contract (Art. 6(1)(b)) |
| Video generation and AI processing | Performance of contract (Art. 6(1)(b)) |
| Payment and subscription processing | Performance of contract (Art. 6(1)(b)) |
| OAuth authentication | Performance of contract (Art. 6(1)(b)) |
| Tax and billing record retention | Legal obligation (Art. 6(1)(c)) |
| Security logging (IP, user agent) | Legitimate interest (Art. 6(1)(f)) - fraud prevention and platform security |
| Service improvement and analytics | Legitimate interest (Art. 6(1)(f)) - product improvement |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting us.
We use your personal data to:
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
We share your personal data with the following third-party service providers (sub-processors) who process data on our behalf:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare | File storage (R2), video rendering (Containers) | Images, videos, audio files | Global / United States |
| Google (Gemini AI) | Transcript generation, vehicle analysis | Vehicle data, images, listing text | United States |
| ElevenLabs | Text-to-speech voice generation | Voiceover scripts | United States |
| Polar | Payment processing | Email, name, subscription data | United States |
| Resend | Email delivery | Email addresses, email content | United States |
| Google OAuth | Authentication | Email, name, profile picture | United States |
Each sub-processor is bound by a Data Processing Agreement (DPA) and is required to process your data only for the specified purposes with appropriate security measures in place.
We maintain an up-to-date list of sub-processors. If we add new sub-processors, we will update this policy accordingly.
Your personal data is transferred to and processed in the United States by our sub-processors. These transfers are protected by the following safeguards:
You may request a copy of the relevant transfer safeguards by contacting us at [email protected].
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data category | Retention period |
|---|---|
| Account data | Duration of your account, plus 30 days after deletion |
| Session data & tokens | 30 days (auto-expiry) |
| Generated videos | 7 days after generation (automatically deleted) |
| Vehicle data & images | Duration of your account or until you delete them |
| Payment & billing records | 7 years (Belgian tax law requirement) |
| Security logs (IP, user agent) | 12 months |
| Outreach email records | Duration of your account or until you delete them |
| AI usage logs | 12 months |
When data is no longer needed, it is securely deleted or anonymized. Backup systems may retain data for up to an additional 30 days before purging.
As a data subject under the GDPR, you have the following rights:
To exercise any of these rights, contact us at [email protected]. We will respond within one month. In complex cases, this may be extended by two additional months, and we will inform you of any extension.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA):
Carboost is a business service not directed at children. We do not knowingly collect personal data from anyone under the age of 16. Under Belgian law, the digital age of consent is 13 years.
If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will promptly delete such data.
We implement appropriate technical and organizational measures to protect your personal data, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours and inform affected individuals without undue delay where the risk is high.
We may update this privacy policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending a notification via email or through the platform.
We encourage you to review this policy periodically to stay informed about how we protect your data.
For any questions about this privacy policy, to exercise your data protection rights, or to raise a concern, contact us at: