1. Who we are and what this policy covers
This policy explains how we handle your personal data. CarrotBoost is run by its owner as an individual trader. In this policy, "we", "us" and "CarrotBoost" mean the owner of the CarrotBoost brand. We decide why and how your data is used, which makes us the controller.
We sell coaching, boosting and game accounts for League of Legends and Valorant, and boosting for Teamfight Tactics. This policy covers carrotboost.gg, the customer dashboard, the booster panel, checkout, our support channels (live chat, email and Discord) and anything else we run under the CarrotBoost name.
For questions or requests about your data, write to [email protected]. We have a representative in Europe for data protection matters. Send your request to the same address and we will pass it on.
This version applies from October 6, 2026. We keep earlier versions and will send you a copy of one on request.
2. What we collect and why
Account data: your email address, a username, and a password that we store as a one-way hash. You can add a first and last name, a bio, a profile picture and a banner. If you sign in with Google or Discord, we receive the ID, email address, name or username and avatar that service shares with us. We use this to create your account and keep it secure. Legal basis in the EU and UK: contract.
Order data: the service you buy, the game and your goal, for example your current and target rank. Also your server or region, roles and champions, your Riot ID or in-game name, notes for your specialist, coupons used, price, currency, and the order status with dates. We use it to take, carry out and support your order. Legal basis: contract.
Messages and reviews: messages in the order chat, support tickets, contact form messages, live chat and emails, Discord messages you send us, and any review or tip you leave. We use them to answer you, solve problems and keep a record in case of a dispute. Legal basis: contract, and our legitimate interest in handling disputes.
Payment data: the amount, currency, payment method, status and Stripe transaction ID of each payment, refunds, your store credit balance and history, and invoices (name, email address, items, discounts, fees and taxes). Your card number, expiry date and security code go straight to Stripe and never reach our servers. We use this data to take payment, refund, issue invoices and keep accounting records. Legal basis: contract and legal obligation.
Security and device data: your IP address, approximate country, browser and device type, the time of your last login, and the number of failed login attempts. We work out your approximate country from your IP address on our own server, with a country database, so the address is not sent to anyone for this. We do not look up or store your city. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. We use this data to stop fraud, abuse and account takeover and to apply rate limits. Legal basis: legitimate interest.
Language and currency: we suggest a language and currency from your browser language or your country, and remember the choice you make. Legal basis: legitimate interest in showing the site in a suitable language and currency.
Bot protection: forms such as contact, booster application and password reset use hCaptcha, which checks signals from your browser and device to tell people from bots. Legal basis: legitimate interest.
Error reports: when something breaks on our servers, Sentry receives a technical report. Passwords, tokens and cookies are removed before the report leaves our server. Legal basis: legitimate interest in fixing faults.
Game data: we look up public game data for a Riot ID, such as rank and champion mastery, through the Riot Games API. Legal basis: contract.
Analytics and live chat: only if you press Accept in the cookie banner, we load Google Analytics to count visits and pages, and the Tawk.to chat widget. Legal basis: consent, which you can withdraw as described in section 8.
Email: we send email about your account and orders: confirmations, invoices, password resets, support replies and notices about changes to your order. We do not send marketing emails. If that changes, we will ask for your consent first.
We do not ask for or knowingly collect special category data such as health information, biometric data, or data about origin, beliefs or sexual orientation. Please do not put such data in free-text fields. Booster applicants are the one exception for ID photos, covered in section 11.
3. Your game account login
For boosting services, a specialist logs in to your game account and plays for you. For that, we ask for the account's login name and password at checkout or on your order page. Coaching and duo services do not need your login.
Only the specialist assigned to your order and the CarrotBoost staff who need it to fix a problem with the order can see it. Specialists do not see your email address or payment details.
We store the password encrypted in our database, send it over TLS, and keep it out of logs and error reports.
We use the login only to carry out your order. We do not use it for any other purpose, we do not sell or share it, and our specialists do not touch in-game currency, items or linked payment methods.
We delete the login 30 days after the order is completed or cancelled. Please change your password when the order ends.
When you buy a game account from us, its login details appear in your dashboard and are kept with the order record.
Playing on an account for someone else is against the game publisher's rules. The Terms of Service explain the risk and what we do if the publisher takes action.
4. Who receives your data
We share data only with the recipients below, and only what each one needs. We do not sell personal data and we do not share it for advertising.
Specialists and coaches assigned to your order receive your Riot ID, region, goal, notes and order chat. For boosting, they also receive your game login.
Stripe processes payments. It acts as our processor and, for fraud prevention and legal compliance, as an independent controller. Stripe's privacy policy applies to its own use.
Railway hosts our servers, which are in Amsterdam. Cloudflare sits in front of carrotboost.gg for security and speed, so it sees your IP address and requests.
Resend sends our emails. Tawk.to provides live chat, and Discord provides our community server and the bot that sends order notices. Google Analytics measures visits when you accept cookies.
hCaptcha checks forms and Sentry receives error reports.
Google and Discord receive a request when you choose to sign in with them. The Riot Games API receives the Riot IDs we look up.
We also give data to authorities, courts and professional advisers when the law requires it or when we need to defend a legal claim, and to a buyer if CarrotBoost is sold, under the protections in this policy.
5. Transfers outside your country
Our main servers are in the European Union. Several providers named in section 4 are in the United States. When your data goes there, we rely on the recipient's certification under the EU-US Data Privacy Framework (and its UK extension) where it has one. Where it does not, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum). You can ask us for a copy of the safeguards by email.
Our team and our coaches work from different countries, so data may also be viewed from outside the country where you live.
6. How long we keep your data
Account data stays while your account is open. If you close it, we delete or anonymise the data within 90 days, unless the law requires us to keep some of it.
Orders, payments and invoices are kept for 7 years for tax and accounting.
Your game login is deleted 30 days after the order ends.
Order chats, support tickets, contact messages and live chat transcripts are kept for 2 years after the order or ticket closes.
Security data (IP address, country, device and failed login counts) stays with your account while it is open.
Booster identity documents and photos are deleted 12 months after the booster stops working with us. Payout records are kept for 7 years for tax and accounting.
Google Analytics data is kept for 14 months.
7. Your rights
Under the GDPR and the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict its use or send it to you in a portable format. You can object to processing based on our legitimate interest, and withdraw your consent at any time, which does not affect what we did before.
You can change your profile in your dashboard. For anything else, including closing your account, email [email protected] from the address on the account. We may ask you to confirm who you are. We answer within one month and do not charge a fee unless a request is clearly unfounded or excessive.
You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office. We would like the chance to fix the problem first, but you do not have to wait.
9. Security
Traffic between your browser and our servers uses TLS. Passwords are stored as one-way hashes. Game logins, booster identity documents and payout files are encrypted in the database. Access is limited to staff who need it for their work.
No system is free of risk. If a breach affects your data, we notify the supervisory authority within 72 hours where the law requires, and tell you without delay when there is a high risk to you.
10. Children
CarrotBoost is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a minor has given us data, write to [email protected] and we will delete it.
11. Boosters and specialists
People who apply to work with us give us more data: legal name, country, Discord account, date of birth, an ID document and its type, a photo of their face and a photo of them holding the ID, and their IP address. Once accepted, they also give payout details such as bank name, account number, address and supporting documents.
We use this to check identity and age, prevent fraud, pay them and meet legal duties. Legal basis: contract, legal obligation and legitimate interest. Only the staff who run onboarding and payouts can see it, and the files are encrypted in storage. Banks and payment providers receive the payout details they need to send money.
Identity documents and photos are deleted 12 months after the booster stops working with us. Payout records are kept for 7 years, unless the law requires longer.
12. California and other US states
In the past 12 months we collected the categories in section 2: identifiers, account and order records, payment records, internet and device data, approximate location, messages and, for boosters, ID documents. We collected them from you, from the service you use to sign in, and from your device.
We do not sell personal information and we do not share it for cross-context behavioural advertising. You can ask us what we hold, to correct it or to delete it, and we will not treat you differently for asking. Email us from your account address or use live chat. An authorised agent may act for you with your written permission.
13. Automated decisions
We do not make decisions about you by automated means that have legal or similarly significant effects. The sign-in form locks for a short time after several failed attempts, and payment and fraud tools may flag an order for review. We do not use your personal data to train artificial intelligence models.
14. Changes to this policy
When we make a material change, we email registered users and show a notice on the site at least 30 days before it applies. The date in section 1 shows which version is current.
15. Contact and complaints
Email [email protected] or use live chat on carrotboost.gg. We answer privacy requests within one month.
Have questions about this policy? Contact us at [email protected]. You can also review our Terms of Service and Refund Policy.