In short
Boon stores your wallet address, your profile, your payments, your messages, the files you upload, your notices and a record of which terms you accepted. We use them to run Boon, move money correctly, keep the site safe and keep records the law requires. Your files are stored with Bunny, and your payments and wallet address are public on the Solana blockchain forever, where neither Boon nor anyone else can delete them. You have rights over your information, such as seeing it or asking for it to be deleted, but some of it can't be deleted.
1. Who is responsible
[operator name, still to come], company number [company number, still to come], [address, still to come], is the controller of your personal information on Boon. Contact: [contact email, still to come]. [data protection contact, still to come]. [eu or uk representative, still to come].
2. What Boon stores
| What | Details |
|---|---|
| Wallet address | The Solana address you sign in with. It identifies your account. |
| Sign-in records | A random sign-in token, stored only in scrambled (hashed) form, and when it expires (after 30 days). The one-time messages your wallet signs to sign in. |
| Profile | Your display name, and if you set them up: handle, tagline, bio, picture and category as a creator; name, website and description as a business. Shows you list, with their details and dates. |
| Payments | Each payment you start: what it was for, the amount, your wallet, the transaction on the blockchain, and its status. Refunds and payouts, with their reason. |
| Activity | Polls, options, proposals, votes, backing, updates, deliveries, ratings and comments, deal requests, deal terms and their acceptance, content reports and reports about delivered work, and evidence. |
| Messages | Messages in a deal, and system events in it (for example "terms proposed" or "paid"). |
| Files | Pictures, clips, delivered files, evidence and show covers you upload. Their type, size and dimensions, who uploaded them, and when. Pictures are re-encoded when uploaded, which removes hidden details such as location. |
| Notices | The in-app notices Boon shows you, and whether you've read them. |
| Share cards | Cards you create to share your own vote, and whether you've stopped sharing them. |
| Terms acceptances | Which document and version you accepted, when, and for a deal, the exact deal terms. |
| Moderation | Bans, with the internal reason and any message to you; admin decisions; a log of every admin action, including each time an admin reads a deal's messages. |
What Boon doesn't store: passwords, email addresses, phone numbers, your wallet's key or recovery phrase, or payment card details. Boon uses your internet address for a moment to limit repeated sign-in attempts, and doesn't save it. [server and hosting logs, still to come]: check what the host logs.
Your browser keeps one cookie to keep you signed in, and remembers which wallet app you used last, on your own device. Boon uses no advertising or analytics cookies.
3. What is public
- On Boon: your profile; polls, options and proposals you create; shows you list; ratings and comments; your name and amount when you back a proposal. Boon doesn't show wallet addresses on its pages, except a shortened address as a name for an account that has no display name. Your collection is private. Delivered work and updates can only be seen by the people who paid.
- On the Solana blockchain: every payment, refund and payout, with the wallet addresses and amounts, is public to anyone, forever. Someone who knows your wallet address can see your payments on Boon and anywhere else. Boon can't hide, change or delete anything on the blockchain.
4. Why Boon uses it
| Purpose | Lawful basis (draft) |
|---|---|
| Running your account, polls, proposals, deals and payments | Contract |
| Checking payments on the blockchain, paying out and refunding correctly, keeping a record of money | Contract; legal obligation |
| Recording which terms you accepted | Legal obligation; legitimate interests (proving what was agreed) |
| Showing your profile, ratings and backing on public pages | Contract; legitimate interests |
| Moderation, reports and bans, keeping uploads records | Legitimate interests (a safe, honest platform); legal obligation where it applies |
| Security, preventing fraud and abuse | Legitimate interests |
| Tax, accounting and any checks the law requires | Legal obligation |
5. Who else handles it
- Bunny (Bunny.net, Bunny Storage and its content delivery network) stores and serves uploaded files for Boon. Files that only people who paid may see are given to them through short-lived addresses. [storage region, still to come].
- The Solana network is public. Payments you approve in your wallet are sent to it and are visible to anyone. It isn't a processor for Boon, and nobody controls it.
- [hosting provider, still to come] runs Boon's servers and database.
- [blockchain network provider, still to come]: the service Boon uses to read and send transactions on Solana. It sees the addresses and transactions Boon asks about.
- Your wallet app (for example Phantom) is separate, with its own privacy policy. Boon doesn't control what it collects.
- Media players. If you tap to play a clip from YouTube (its privacy-enhanced player), Vimeo, Spotify or SoundCloud, that service receives information from your browser, under its own policy. Nothing loads from them until you tap.
- Solscan. Receipts link to the transaction on Solscan, a public blockchain explorer. Opening the link takes you to its site.
- Boon may share information with authorities, or advisers, where the law requires or allows it.
Boon doesn't sell your information, and doesn't use it for advertising.
6. How long Boon keeps it
[retention period, still to come] for each kind of information. Points for the decision:
- Payment, payout and terms acceptance records may need to be kept for a set time for tax, accounting and legal claims.
- Removed files keep a record of who uploaded them, for moderation.
- Admin action logs are only ever added to.
- Anything on the blockchain stays there forever, whatever Boon deletes.
7. Your rights
Depending on where you live, you may have the right to:
- see the information Boon has about you, and get a copy;
- correct it;
- ask Boon to delete it;
- ask Boon to limit how it uses it, or object to that use;
- get it in a form you can take elsewhere;
- complain to a data protection authority, for example the Information Commissioner's Office (ICO) in the UK, or the authority where you live in the EU.
To use these rights, contact [contact email, still to come]. [how Boon checks it's you, still to come]: for example, by a message signed with your wallet.
Limits. Boon can't delete or change anything on the blockchain. Boon may need to keep some records, such as payments and terms acceptances, even after you ask for deletion, where the law requires it or for legal claims. Wallet addresses linked to a profile are likely to be personal information.
8. Children
Boon is for people aged [minimum age, still to come] or over. Boon doesn't check age.
9. Security
Boon keeps sign-in tokens only in scrambled form, refuses some risky file types, gives uploaded files random names, and gives paid-only files only to the people allowed to see them. No system is perfectly secure. [security breach notice, still to come].
10. Changes to this notice
When this notice changes, Boon shows the new version with a new date. [how people are told, still to come].