Privacy Policy

Bosferi is a modular business operating system: AI chat, notes, files, calendar, expenses, and more in one place. This service is operated by Bosferi LLC, registered in the State of Indiana, United States.

Where your employer or another organisation gave you your Bosferi account, that organisation is the data controller and we act as a data processor on their instructions. In that case their own privacy notice governs your data, and requests about it should go to them first.

Today the product handles sign-in, stores the records you create in the apps you use (notes, files, calendar entries, expense records, and similar), and processes payments through Stripe for paid apps and plans. Bosferi AI is an app used the same way as any other. We send transactional emails, such as sign-in codes, password resets and notifications about your account. We only send marketing emails if you opted in, and every one of them lets you unsubscribe.

When an app or integration changes how we handle data, this policy is updated at the same time.

Account and identity

When you create an account we receive your name, email address, and the roles your organization assigns you. You can also sign in with Google, in which case Google shares your name and email with us. Your password is checked by our own identity service and stored there only as a salted hash, never in plain text.

Technical data

Our servers record IP address, browser and device type, timestamps, and the pages requested. When something breaks, an error report with similar technical details is sent to our error monitoring service. This is used for security and debugging only.

Content you create

Anything you enter into an app: chat messages, notes, files, calendar entries, expense records and so on. It is stored so the product can show it back to you and to the colleagues you give access.

Billing

When you pay for a plan, an app or credits, Stripe collects your card details. We never see or store the full card number. We keep the billing name, address, plan and invoice history.

AI features

When you use Bosferi AI or receipt scanning, the messages, files and images you submit are processed by Bosferi AI to produce the answer. Bosferi AI runs on AI models from our technology partners (OpenAI, Google and Anthropic), which receive that content only to generate the response and are not allowed to use it to train their models.

Accounts you connect

If you connect a social network or another service, we store the access it grants us so we can act for you, for example publishing a post. You can disconnect it at any time.

Your customers' data

Some apps store information about your own customers, for example people who book an appointment with you. For that data your organization is the controller and we process it only on your behalf.

Messages you send us

When you use our contact form we keep your name, email, company and message so we can answer you. We keep these messages only as long as needed to handle your request and any follow up.

These are commitments, and each is verifiable in the codebase rather than a promise about intent:

• We do not sell your data. Not to advertisers, data brokers, or anyone else.
• We do not use your content to train AI models, and neither do Bosferi AI's technology partners.

The product itself, meaning the apps you sign in to use, runs no analytics or advertising on your account data or content.

Our public marketing website, the pages outside of sign-in like this one, can use PostHog, Google Analytics, Google Ads and Meta Pixel to measure and improve our marketing. All of them load only after you accept cookies in the banner shown on your first visit. If you decline or make no choice, none of them run. Full detail is on the dedicated Cookie Policy page, including how to withdraw consent at any time.

One of Bosferi's cookies is strictly necessary to keep you signed in, and one only remembers a display preference. Neither needs consent. The others are used only on the public marketing website and require your consent first. Full detail, including how to manage them, is on the dedicated Cookie Policy page.

Your light or dark theme preference is stored in your browser's local storage, not in a cookie, and is never sent to us.

For users in the UK, EU, and other regions with equivalent law, our legal bases are:

• Contract . To provide the service you or your organisation signed up for.
• Legitimate interests . Keeping the service secure, preventing abuse, and fixing faults.
• Legal obligation . Where we must retain records to comply with the law.
• Consent . For analytics and advertising cookies on our marketing website and for marketing emails. You can withdraw it at any time.

We use a small number of service providers to run Bosferi. They process data only on our instructions and may not use it for their own purposes.

The main ones: Stripe, which processes payments for paid apps and plans, and the companies that host our servers and send our emails. We share only what each provider needs to do its job. Stripe receives payment and billing details, not the content you create in Bosferi's apps.

We may also disclose data where the law requires it. Where we are allowed to tell you, we will.

The current list of service providers that process data on our behalf is on our Subprocessors page.

Content stays until you or your organisation deletes it, or the organisation's account is deleted.

Deleting an organization is not immediate. When an owner deletes an organization, its subscriptions are cancelled right away and everyone loses access. Its data, including files, notes, calendar entries, expense records and everything else created in Bosferi's apps, is kept for 30 days and then permanently deleted. During that window the owner can ask to restore it by contacting support, who verify the request before restoring access. After 30 days, deletion is permanent and cannot be reversed by us or by you.

Beyond organisation deletion, we delete or anonymise account data within 30 days of any other account closure, except where law requires us to keep it longer. Security logs are kept on a shorter cycle.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where consent was the basis. California residents additionally have the right to know, delete, correct, and opt out of sale or sharing. And we do not sell or share personal information as those terms are defined under the CPRA.

Exercising any of these will never result in worse service. We answer requests within 30 days. To make one, contact us at [email protected]. If your account came from an organisation, ask them first. They control the data.

To delete your account and all of its data, follow the steps on our Delete Account & Data page.

If you are in the EU or UK and think we have handled your data badly, you can complain to your national data protection authority.

Bosferi LLC is based in the United States, and our service providers may process data in the United States and in other countries. When we transfer personal data out of the EU, the UK or another region with similar rules, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Traffic is encrypted in transit, sign-in supports multi-factor authentication, and each person has a role in their organization. Full details are on the dedicated Security page. Passwords are stored only as salted hashes in our identity service.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a vulnerability, please report it to [email protected].

Bosferi is a workplace tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.

When we change this policy we update the effective date above. For changes that materially affect your rights we will give notice in the product before they take effect, rather than relying on you to notice a new date.

Questions about this policy or how your data is handled: [email protected].