Security & Privacy

Website enquiries and your privacy

When you submit a fit check, assessment quote request, or contact enquiry, the details you provide are sent to BossCo’s intake service and recorded in its internal customer workflow so BossCo can review and respond. If online submission is unavailable, the form instead opens a pre-filled email that is only sent if you choose to send it. We collect your name, email, company, enquiry, optional website and goals, and your consent to this use. Basic technical information may be processed for hosting, security, and abuse prevention.

The form does not subscribe you to marketing. This website does not include advertising trackers or analytics. Draft form details stay in page memory; please avoid passwords, payment information, or sensitive customer information. Submission requests carry a random reference to help prevent duplicate records.

Vercel hosts the public website. The intake service uses the HQ infrastructure configured for BossCo. Enquiries are available to authorized internal users, not on public pages. Retention and deletion requests can be sent to info@bosscoai.com. If submission is unavailable, the page tells you; a failed form does not claim receipt.

Customer Data Ownership

Customers retain ownership of their business information. Ownership and permitted processing are documented as part of the customer agreement.

Data Isolation

Customer information is logically separated from other client environments, with access limited by authenticated user permissions. The isolation approach is defined and validated for the specific implementation.

Access Controls

Production deployments use individual authentication and role-based access controls where appropriate. Access is configured around the responsibilities and approved audiences for the system.

Encryption

Infrastructure providers are selected to support encryption of information in transit and at rest. The services and settings used for each deployment are reviewed during implementation.

AI Data Use

When supported AI business or API services are used, customer business information is processed under the provider’s business-data terms and is not used to train public foundation models by default. The applicable service, terms, settings, and any exceptions are reviewed for each implementation. For example, OpenAI’s business-data terms describe its default approach for business products and the API.

Least-Privilege Access

BossCo systems and integrations should receive only the permissions necessary to perform the approved business function. Required access is identified during setup and reviewed when the scope changes.

Approved Knowledge

Knowledge systems can distinguish between information intended for employees, dealers, customers, or other audiences. Source approval and access boundaries are established before information is made available.

Monitoring and Logging

Production systems can maintain appropriate activity and diagnostic logs while avoiding unnecessary storage of credentials and sensitive information. The scope of logging and access to logs are defined for the deployment.

Data Retention

Customer data retention and deletion requirements can be established as part of deployment. The implementation documents applicable storage locations, provider limitations, and the process for requesting deletion.

Infrastructure

BossCo may use established infrastructure and AI providers such as Vercel, Supabase, OpenAI, and other approved third-party platforms depending on the implementation. Specific architecture and subprocessors may vary by customer and are documented during implementation.