Privacy policy

Last Updated: February 17, 2026

Article 1. Introduction and Legal Framework

About This Policy

Autoboosty operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience. Autoboosty is powered by Shopify, which enables us to provide the services to you. This Privacy Policy describes how MONOFY TECHNOLOGIES LTD, operating under the trade name Autoboosty, collects, uses, and discloses your personal information when you visit, use, or make a purchase or other transaction using our services or otherwise communicate with us.

Applicable Data Protection Laws

We are committed to protecting your privacy and ensuring transparency in our data handling practices in accordance with applicable international privacy laws. Our data processing activities comply with the General Data Protection Regulation (Regulation EU 2016/679) for customers in the European Union, the UK General Data Protection Regulation and Data Protection Act 2018 for customers in the United Kingdom, the Personal Information Protection and Electronic Documents Act for customers in Canada, the Lei Geral de Proteção de Dados (Law No. 13,709/2018) for customers in Brazil, the California Consumer Privacy Act as amended by the California Privacy Rights Act for customers in California, and other relevant United States state privacy laws including the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act. Where multiple laws apply to your personal information, we provide you with the protections and rights afforded by the most stringent applicable law.

Agreement and Consent

Please read this Privacy Policy carefully. By using and accessing any of our services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Article 2. Personal Information We Collect

Definition of Personal Information

When we use the term personal information, we are referring to information that identifies or can reasonably be linked to you or another person. Under GDPR and UK GDPR, this is referred to as personal data. Under LGPD, this is referred to as dados pessoais. Personal information does not include information that is collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. We may collect or process various categories of personal information, including inferences drawn from this personal information, depending on how you interact with our services, where you live, and as permitted or required by applicable law.

Contact and Account Information

Contact details include your name, address, billing address, shipping address, phone number, and email address. Account information includes your username, password, security questions, preferences and settings that you establish when creating an account with us.

Financial and Transaction Information

Financial information encompasses credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details. Transaction information comprises the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel, as well as your past transactions.

Technical and Usage Data

Device information encompasses information about your device, browser, or network connection, your IP address, and other unique identifiers that may be associated with your device. Usage information includes information regarding your interaction with our services, including how and when you interact with or navigate the services, which pages you visit, and how long you spend on particular pages. Advertising and analytics data includes information collected through cookies, pixels, and similar tracking technologies from Meta Platforms Incorporated and Google LLC, such as your interactions with our advertisements, pages visited on our website, products viewed, and conversion events.

Communications

Communications with us include the information you provide in communications with us, for example when sending a customer support inquiry or participating in surveys, promotions, or feedback requests.

Article 3. Sources of Personal Information

Direct Collection from You

We collect information directly from you when you create an account, visit or use our services, communicate with us through email or other means, make a purchase, or otherwise provide us with your personal information voluntarily. This direct collection occurs when you complete registration forms, checkout processes, contact forms, or provide information in response to surveys or promotional offers.

Automatic Collection Through Technology

We collect information automatically through your use of our services, including from your device when you use our products or services or visit our websites, and through the use of cookies, web beacons, pixels, and similar tracking technologies. This automatic collection occurs continuously as you navigate our website and interact with our content, even if you do not actively provide information or make a purchase.

Third Party Sources

We receive information from our service providers when we engage them to enable certain technology and when they collect or process your personal information on our behalf. These service providers include Shopify, our e-commerce platform provider, Western Bid Incorporated, our payment processor for PayPal transactions, and various other technology service providers who assist in delivering our services. We may also receive information from our partners or other third parties, including advertising platforms, data analytics providers, and social media platforms.

Article 4. Cookies and Tracking Technologies

Overview of Tracking Technologies

We and our third-party partners use cookies, web beacons, tracking pixels, and similar technologies to collect information about your browsing activities, interactions with our services, and effectiveness of our marketing campaigns. Under GDPR and UK GDPR, the use of cookies and similar technologies requires your consent for non-essential purposes. Under LGPD, cookies that are not strictly necessary for the provision of services require your explicit consent. These technologies play a crucial role in enabling us to provide personalized experiences, understand how visitors use our website, and deliver targeted advertising to users who may be interested in our products.

Essential Cookies

Essential cookies are necessary for our services to function properly. They enable basic functions like page navigation, secure areas access, and shopping cart functionality. Without these cookies, our website cannot function properly, and they are therefore deployed automatically when you access our services. Under GDPR, UK GDPR, and LGPD, essential cookies do not require consent as they are strictly necessary to provide the service you have requested. These essential cookies do not collect information about you that could be used for marketing purposes.

Analytics and Performance Tracking

Analytics cookies help us understand how visitors interact with our services. We use Google Analytics to collect information about pages visited and time spent on each page, how you arrived at our services including the referral source, your general location at the country or city level based on IP address, device and browser information, navigation patterns and clicks throughout our website. Information generated through Google Analytics may be transmitted to and stored by Google on servers in the United States and other countries. To opt out of Google Analytics, you may visit https://tools.google.com/dlpage/gaoptout.

Advertising Pixels and Marketing Technologies

We deploy advertising and marketing pixels from Meta Platforms Incorporated and Google LLC to facilitate targeted advertising. The Meta Pixel enables us to track conversions from Facebook and Instagram advertisements, build audiences for targeted advertising, optimize advertisement delivery, and measure campaign effectiveness. The pixel collects information including your IP address, browser information, page visits, products viewed, items added to cart, purchases completed, and other interactions. This information is transmitted to Meta in accordance with Meta's Data Policy at facebook.com/privacy/policy. We use Google Ads tracking technologies to track conversions from Google Ads campaigns, create remarketing lists, measure return on advertising spend, and optimize advertisement delivery. Google collects information about your interactions with our website and uses this data to serve relevant advertisements across Google's advertising network.

Information Collected and Usage

Information collected through tracking technologies includes your IP address and device identifiers including mobile advertising identifiers, browser type and version, pages visited and content viewed, time and date of visits, referral URLs, click behavior and conversion events, products viewed and added to cart, purchase history and transaction details. This information is used to personalize your experience, remember preferences, analyze site performance, improve our services, deliver targeted advertising, measure marketing effectiveness, and build audience segments.

Managing Cookies and Opting Out

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies. Please note that disabling cookies may limit your ability to use certain features. To opt out of targeted advertising, you may visit our Do Not Sell or Share My Personal Information page, enable Global Privacy Control in your browser, visit the Digital Advertising Alliance at http://optout.aboutads.info, visit the Network Advertising Initiative at http://optout.networkadvertising.org, or for European users visit the European Interactive Digital Advertising Alliance at http://www.youronlinechoices.eu. For Meta ad preferences visit https://www.facebook.com/ads/preferences and for Google visit https://adssettings.google.com. We honor Global Privacy Control signals sent by your browser.

Article 5. Legal Basis for Processing Under GDPR and UK GDPR

Contract Performance

We process your personal data to perform our contract with you when you make a purchase or create an account. This includes processing payments, fulfilling orders, delivering products, managing your account, and providing customer service. Without processing this data, we cannot fulfill our contractual obligations to you.

Legitimate Interests

We process certain personal data based on our legitimate interests in operating and improving our business, provided these interests are not overridden by your data protection rights. Our legitimate interests include preventing fraud and ensuring security, analyzing website performance and user behavior to improve our services, conducting marketing analytics to understand customer preferences, maintaining and improving our IT systems and website functionality, and enforcing our legal rights and complying with legal obligations. You have the right to object to processing based on legitimate interests by contacting us at info@autoboosty.com.

Consent

For certain processing activities, we rely on your explicit consent. This includes the use of non-essential cookies and tracking technologies for marketing and analytics purposes, sending marketing communications by email or other electronic means, processing sensitive personal data where required by law, and sharing data with third parties for their own marketing purposes. You have the right to withdraw your consent at any time by contacting us at info@autoboosty.com or using the unsubscribe mechanisms provided in marketing communications. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Legal Obligation

We process personal data where necessary to comply with legal obligations to which we are subject. This includes retaining transaction records for tax and accounting purposes, responding to lawful requests from authorities, complying with court orders and legal proceedings, meeting regulatory reporting requirements, and preventing and detecting fraud or other criminal activity as required by law.

Article 6. Your Rights Under GDPR and UK GDPR

Right of Access

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and where that is the case, access to the personal data and information about how it is being processed. You may request a copy of your personal data free of charge, though we may charge a reasonable fee for additional copies or manifestly unfounded or excessive requests.

Right to Rectification

You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to Erasure

You have the right to obtain the erasure of personal data concerning you without undue delay where one of the following grounds applies: the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent on which processing is based and there is no other legal ground for processing, you object to processing based on legitimate interests and there are no overriding legitimate grounds for processing, the personal data has been unlawfully processed, or the personal data must be erased for compliance with a legal obligation. This right does not apply where processing is necessary for compliance with legal obligations, establishment or defense of legal claims, or other exceptions provided by law.

Right to Restriction of Processing

You have the right to obtain restriction of processing where one of the following applies: you contest the accuracy of the personal data for a period enabling us to verify accuracy, the processing is unlawful and you oppose erasure and request restriction instead, we no longer need the personal data but you require it for establishment or defense of legal claims, or you have objected to processing pending verification of whether our legitimate grounds override yours.

Right to Data Portability

You have the right to receive personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller without hindrance from us, where the processing is based on consent or contract and the processing is carried out by automated means.

Right to Object

You have the right to object at any time to processing of personal data concerning you which is based on legitimate interests, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing, and we shall cease such processing upon receiving your objection.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes applicable data protection law. For the European Union, you can find your data protection supervisory authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the United Kingdom, you may lodge a complaint with the Information Commissioner's Office at https://ico.org.uk.

Article 7. Relationship with Shopify

Platform Services and Data Processing

Our services are hosted by Shopify Incorporated, which provides the underlying e-commerce infrastructure. As the merchant operating this store, Autoboosty serves as the data controller for personal information collected in connection with your purchases. Shopify acts as a data processor, processing personal information on our behalf solely to provide platform services including hosting, payment processing through Shopify Payments, inventory management, and analytics.

Enhanced Features and Data Sharing

We use certain Shopify enhanced features that incorporate data from your interactions with our store along with data from other merchants. When you interact with these enhanced features, Shopify becomes a data controller for providing these services, which may include analytics, marketing tools, and fraud prevention leveraging platform-wide data.

Your Rights and International Transfers

For information processed by Shopify as a data controller, Shopify is responsible for responding to rights requests. Visit https://www.shopify.com/legal/privacy/consumers to learn more. Both Autoboosty and Shopify may transfer your information internationally, with appropriate safeguards including Standard Contractual Clauses where required under GDPR, UK GDPR, or other applicable data protection laws.

Article 8. Payment Processing with Western Bid Incorporated

Payment Processing Partnership

When you select PayPal as your payment method, we share personal information with Western Bid Incorporated, our authorized payment processor and merchant of record for PayPal transactions. Western Bid Incorporated is a Florida corporation located at 3500 West Hallandale Beach Boulevard, Pembroke Park, Florida 33023, United States. The company has operated since 2001, specializing in payment processing and fulfillment services. Contact: info@westernbid.us or +1-305-307-0382.

Information Shared with Western Bid

We share your full name, billing and shipping addresses, email address and telephone number, payment method information, transaction details including products purchased, quantities, prices, total amount, order number, and date, plus any special instructions. We do not share browsing history, products viewed but not purchased, or marketing preferences unless necessary for customer service or with your consent.

Legal Basis and Purposes

Information is shared to process PayPal payments, comply with PCI-DSS security standards, prevent fraud through transaction screening and address verification, process refunds and chargebacks, and coordinate order fulfillment. Under GDPR and UK GDPR, the legal basis is contract performance. Under LGPD, the legal basis is execution of contract. Under PIPEDA, the purpose is fulfilling contractual obligations. Without this processing, we cannot accept PayPal payments.

International Data Transfers

Western Bid is located in the United States. For customers in the EU, UK, or EEA, transfers are protected by Standard Contractual Clauses approved by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 and UK International Data Transfer Agreement approved by the UK Information Commissioner's Office. For Brazilian customers, transfers comply with LGPD Article 33 requirements for international data transfers. For Canadian customers, transfers comply with PIPEDA provisions for cross-border data transfers. We have conducted transfer impact assessments and implemented supplementary measures including enhanced encryption, contractual restrictions, and audit rights.

Data Retention by Western Bid

Transaction records are retained for minimum seven years from transaction date as required by tax laws and financial regulations. Payment card numbers are not retained after transaction completion except for chargeback processing. Other transaction information is retained for financial reporting, tax compliance, fraud prevention, and regulatory requirements. Information is securely deleted or anonymized when no longer required.

Article 9. United States State Privacy Laws

California Consumer Privacy Rights (CCPA/CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have rights to know what personal information we collect, use, disclose, and sell or share including categories, sources, business purposes, and third parties involved, to delete personal information subject to certain exceptions, to correct inaccurate personal information, to opt out of sale or sharing for cross-context behavioral advertising, to limit use and disclosure of sensitive personal information though we use it only for permitted purposes, and to non-discrimination for exercising rights.

We collect sensitive personal information including financial account information, precise geolocation data for delivery, and account credentials. We use and disclose sensitive information only for permitted purposes including processing transactions, preventing fraud, ensuring security, complying with legal obligations, and providing requested services. We may sell or share identifiers such as cookies and device identifiers, internet activity information including browsing and search history, and inferences for targeted advertising with Meta Platforms Incorporated and Google LLC. We do not knowingly sell or share information of consumers under sixteen.

Opt-Out Rights and Procedures

To opt out of sale or sharing, visit our Do Not Sell or Share My Personal Information page, contact info@autoboosty.com with subject CCPA Opt-Out Request including your name, email, California residency confirmation, and verification information, or enable Global Privacy Control which we honor. We acknowledge requests within two business days, verify identity if necessary, process opt-outs within ten business days, and send confirmation.

Other State Privacy Rights

Residents of Virginia under the Virginia Consumer Data Protection Act, Colorado under the Colorado Privacy Act, Connecticut under the Connecticut Data Privacy Act, Utah under the Utah Consumer Privacy Act, and Montana under the Montana Consumer Data Privacy Act have similar rights including accessing personal information, correcting inaccuracies, deleting personal data, obtaining portable copies, opting out of targeted advertising and data sales, and opting out of profiling for significant decisions though we do not engage in such profiling. Contact us to exercise these rights.

Article 10. Canadian Privacy Rights Under PIPEDA

PIPEDA Compliance

For Canadian customers, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private sector organizations collect, use, and disclose personal information in the course of commercial activities. Under PIPEDA, we are required to obtain meaningful consent for the collection, use, and disclosure of personal information, to collect information by fair and lawful means, to use personal information only for the purposes for which it was collected, to protect personal information with appropriate safeguards, and to provide access to personal information upon request.

Your Rights Under PIPEDA

Canadian customers have the right to access personal information we hold about them and to challenge the accuracy and completeness of that information, to request correction of inaccurate or incomplete personal information, to withdraw consent for certain uses and disclosures of personal information subject to legal and contractual restrictions, to know how their personal information is being used and to whom it is being disclosed, and to file a complaint with the Privacy Commissioner of Canada if they believe their privacy rights have been violated. To exercise these rights, contact info@autoboosty.com.

Accountability and Transparency

Under PIPEDA's accountability principle, we are responsible for personal information in our possession or custody, including information transferred to third parties for processing. We have designated a privacy officer responsible for ensuring PIPEDA compliance and addressing privacy inquiries. We maintain documentation of our privacy policies and practices and make information about our privacy practices readily available to individuals.

Article 11. Brazilian Privacy Rights Under LGPD

LGPD Compliance Framework

For Brazilian customers, we comply with the Lei Geral de Proteção de Dados (LGPD), Law No. 13,709/2018, which establishes rules for the processing of personal data. Under LGPD, personal data processing must be based on one of the legal bases provided in Article 7, and we process your data based on execution of contract, compliance with legal obligations, legitimate interests, consent where required, and protection of credit. We are committed to the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability as established by LGPD.

Rights of Data Subjects Under LGPD

Brazilian customers have the right to confirmation of the existence of processing, access to personal data, correction of incomplete, inaccurate, or outdated data, anonymization, blocking, or deletion of unnecessary, excessive, or processed in non-compliance with LGPD, portability of personal data to another service or product provider upon explicit request, deletion of personal data processed with consent except in cases provided by law, information about public and private entities with which we share data, information about the possibility of not providing consent and the consequences of denial, and revocation of consent. To exercise these rights, contact info@autoboosty.com. We will respond within fifteen days of receiving your request.

International Data Transfers Under LGPD

When transferring personal data to countries that do not provide an adequate level of data protection as determined by Brazilian authorities, we implement appropriate safeguards as required by LGPD Article 33. These safeguards include Standard Contractual Clauses, specific contractual clauses for data transfers, global corporate rules or certifications, and contractual guarantees that service providers implement appropriate security measures. Brazilian customers may request information about international transfers by contacting info@autoboosty.com.

Article 12. How We Use Your Personal Information

Providing and Improving Services

We use your information to perform our contract including processing payments, fulfilling orders, remembering preferences, sending account notifications, processing transactions, creating and managing accounts, arranging shipping, facilitating returns, enabling reviews, and creating customized shopping experiences with product recommendations. We use information to better understand your needs and tailor services accordingly.

Marketing and Advertising

We use information for marketing purposes including sending promotional communications by email, text, or mail where consented or permitted by law, showing online advertisements on our services or other websites, and creating targeted campaigns based on purchase history, cart activity, and browsing behavior. We analyze effectiveness and optimize marketing strategies based on customer responses.

Security and Fraud Prevention

We use information to authenticate accounts, provide secure payment experiences, detect and investigate fraudulent or illegal activity through analyzing transaction patterns, protect public safety, comply with legal obligations to prevent criminal activity, and secure services against unauthorized access and data breaches. You are responsible for keeping account credentials safe and not sharing passwords.

Communications and Legal Compliance

We use information to provide customer support, respond to inquiries, deliver effective services, and maintain business relationships through updates about orders and account status. We use information to comply with applicable law, respond to legal process and government requests, investigate or participate in legal proceedings, and enforce our terms and policies.

Article 13. Data Retention

Retention Principles

We retain personal information only as long as necessary to fulfill purposes outlined in this Privacy Policy, unless longer retention is required or permitted by law. Under GDPR and UK GDPR, we apply the storage limitation principle, retaining data in a form which permits identification only for as long as necessary. Under LGPD, we retain data for the period necessary to fulfill processing purposes. Criteria for determining retention periods include the nature of information collected, purposes for collection, applicable legal or regulatory requirements, and legitimate business needs for accounting, tax, legal, and operational purposes.

Specific Retention Periods

Transaction and payment records including order history, payment information, and shipping details are retained for seven years from transaction date to comply with financial reporting, tax requirements, accounting standards, and address warranty claims, disputes, or chargebacks. Marketing communications and preference data including newsletter email addresses, communication preferences, and consent records are retained for three years from last interaction or until opt-out. Customer service records including emails, chat transcripts, and support tickets are maintained for three years from case closure. Account information for registered users is retained during account activity and for one year after closure or last login. Cookies and tracking data are retained for a maximum thirteen months from collection, requiring renewed consent where applicable. Analytics data may be retained indefinitely in anonymized or aggregated form. Legal and dispute records are retained seven years from resolution or as required by limitation periods.

Deletion and Your Rights

After retention periods expire, we securely delete or anonymize information unless retention is required for ongoing legal proceedings, regulatory investigations, or valid legal requests. You may request deletion at info@autoboosty.com, subject to legal obligations to retain certain information and exceptions under data protection laws.

Article 14. Contact Information and Exercising Your Rights

Your Privacy Rights

Depending on where you live, you may have rights including requesting access to personal information we hold, requesting deletion of personal information subject to exceptions, requesting correction of inaccurate information, and receiving portable copies in structured, commonly used, machine-readable format. These rights are not absolute and may apply only in certain circumstances. We may decline requests as permitted by law.

Contact Information

For questions about this Privacy Policy, to exercise privacy rights, or report privacy or security concerns, contact info@autoboosty.com. Our mailing address is MONOFY TECHNOLOGIES LTD, 6-7 St Mary At Hill, Unit 3, Office A, 1st Floor, London, ENG, EC3R 8EE, United Kingdom. We respond to requests within one month or two months for complex requests with explanation. For urgent requests, we provide interim responses within seventy-two hours.

Data Controller

For applicable data protection laws including GDPR, UK GDPR, LGPD, and PIPEDA, Autoboosty operated by MONOFY TECHNOLOGIES LTD is the data controller of personal information collected in connection with your use of our store and services, except where Shopify acts as data controller for specific enhanced features and where Western Bid Incorporated serves as merchant of record for payment processing as described in this Privacy Policy.