Privacy Policy

Bossy ("Bossy", "we", "us") provides a people-operations and operations platform for frontline businesses. This Privacy Policy explains what personal data we handle, why, and the choices you have. It applies to our website, our web and mobile apps, and our marketing.

Bossy is operated by Bossy LLC, 2108 N St, Ste N, Sacramento, CA 95816.

Who this policy is for

We handle personal data for four distinct groups, and your rights depend on which group you fall into:

• Customers — the business owners and administrators who sign up for and manage a Bossy account. For their own account and contact data, Bossy is the controller.
• Members of a customer's team (employees) — when a business uses Bossy, it adds its workers, supervisors, and managers. Their task records, photos, schedules, performance notes, feedback, and journal entries are processed on the employer's behalf. For this data the employer is the controller and Bossy is the processor. If you are an employee and want to access, correct, or delete your data, your request generally goes to your employer; we will support them in responding.
• Marketing contacts and prospects — people who join our waitlist, submit our contact form, ask us for a quote (including a quote for a restaurant ordering site, by WhatsApp or email), or are imported as leads. For this data Bossy is the controller.
• Diners on a restaurant's ordering site — Bossy builds and runs online-ordering websites for restaurants. When you order, sign in, book a table, or collect points on one of those sites, the restaurant is the controller and Bossy is the processor. The restaurant's own privacy notice, linked from its site, explains how it uses your data. See Ordering sites for restaurants.

Data we collect

Account & profile — name, email, role, organization, and authentication data (including two-factor settings).

Operational content you create in the app — tasks and their completion status, photos submitted as proof of work, schedules and shift data, checklists, reports, internal announcements and messages, and people-ops content such as 1-on-1 notes, feedback, goals, and Exchange Journal entries.

Billing data — plan, subscription status, and billing contact. Card details are collected and stored by our payments provider (Stripe); Bossy never receives or stores full card numbers.

Usage & device data — log data, approximate location derived from IP, device and browser information, and product-analytics events used to understand and improve the product.

Marketing data — email address, any name/company you provide, consent timestamp, and campaign attribution (UTM) parameters. We store a hashed form of your IP address for abuse prevention, not your raw IP.

Quote requests for ordering sites — what you choose to send us when you ask about an ordering site: your name, your restaurant's name, city and number of locations, whether you sell on delivery apps, and anything else you write. When you write to us on WhatsApp we also see your WhatsApp number, profile name, and profile photo.

Ordering-site data (processed for restaurants) — for restaurants that use a Bossy ordering site, we store and process their diners' data on the restaurant's behalf: names, WhatsApp numbers, delivery addresses and their map location, orders and kitchen notes, payment method and status, and, where the restaurant turns these features on, customer accounts, loyalty points, and reservations.

How we use data

• To provide, secure, and operate the service for you and your organization.
• To send transactional messages (e.g. task notifications, schedule changes, account and billing emails).
• To email you about Bossy: marketing email if you opted in to it, and, if you signed up for a Bossy account, setup tips and occasional product and plan updates. Every one of these emails has a one-click unsubscribe.
• To monitor reliability and prevent abuse, fraud, and security incidents.
• To understand product usage and improve Bossy.
• To comply with legal obligations.

How we share data

We do not sell personal data. We share data with the third-party providers ("subprocessors") that power the service — for hosting, database and storage, payments, email and messaging delivery, error monitoring, and analytics. See our Subprocessors page for the current list. Each is bound by contract to protect the data. Some may also use personal data for their own purposes, such as preventing fraud, securing their service, or improving their products, as their own terms allow. On our marketing website, Microsoft Advertising sets advertising cookies to measure our ads and to show our ads to people who have visited the site; our Cookie Policy explains this and how to opt out.

We may also disclose data where required by law, to protect rights and safety, or in connection with a corporate transaction (with notice where required).

Connected integrations

Customers can connect third-party tools to their Bossy workspace. Data received through an integration is operational content processed on the customer's behalf, like the rest of their workspace.

• Shopify. When you install Bossy from the Shopify App Store, Bossy receives order identifiers and line items (product, variant, SKU, quantity) to create fulfilment jobs and keep stock accurate, and pushes recalculated availability back to your store. Buyer names, email addresses, phone numbers, and addresses are excluded at the source — Bossy's webhook subscriptions omit those fields, so Shopify never sends them to us. If you instead connect a private Shopify app using your own credentials, order payloads arrive as your app delivers them and may include buyer contact details; they are protected like the rest of your workspace content. For App Store installs, your Bossy subscription is billed by Shopify. Bossy honors Shopify's privacy webhooks: buyer data requests, buyer redaction, and store redaction (which deletes the store's connection data from Bossy).
• Notion. If you connect Notion, Bossy stores copies of the pages you choose to attach to tasks and checklists, and can publish reports to pages you select. Bossy accesses only content you share with the connection.

Disconnecting an integration stops the data flow, and its stored credentials are revoked.

Ordering sites for restaurants

Bossy builds and runs online-ordering websites for restaurants, each on the restaurant's own domain. We play two different roles in that service.

When you ask us for a quote

When you ask us about an ordering site — through the form on our ordering-sites page, or by WhatsApp or email — Bossy is the controller of what you send us. We use it to reply, prepare your quote, and, if you hire us, set up your site and invoice you. We send you news about Bossy only if you say yes. If you are in Mexico, our full privacy notice for this is below.

When you order from a restaurant's site

When you order, sign in, book a table, or collect points on a restaurant's ordering site, the restaurant is the controller of your data and Bossy is its processor. We process that data only on the restaurant's instructions and only to run its site: we host the site and its order screen; store orders, accounts, points, and reservations; send the restaurant's WhatsApp messages from the restaurant's own WhatsApp Business account; create payments in the restaurant's own Stripe account; and request couriers through the restaurant's own Uber Direct account. Those providers deal with the restaurant directly and may use some data for their own purposes, such as fraud prevention or delivery safety, as their own privacy notices explain.

Bossy does not sell diners' data, use it for Bossy's own marketing, share it with other restaurants, or combine one restaurant's diners with another's. Diners' data is stored on servers in the United States. When a restaurant stops using the service, we return and delete its data as our contract with the restaurant provides.

To see, correct, or delete your data, or to stop promotional messages, contact the restaurant using the details in its privacy notice. If you write to privacy@bossyhq.com instead, we will forward your request to the restaurant within two business days and tell you we did.

Privacy notice for quote requests (Mexico)

For people in Mexico, the Spanish text of this subsection is the one that governs.

Who is responsible. Bossy LLC, 2108 N St, Ste N, Sacramento, CA 95816, United States, is responsible for the personal data described here. Our privacy team handles requests about it at privacy@bossyhq.com.

Data we process. What you enter in the quote form on our website or send us by WhatsApp: your name and contact details, your restaurant's name, your city, how many locations you have, whether you sell on delivery apps, and your message. Your WhatsApp number, profile name, and profile photo, which WhatsApp shows us when you write. Whatever you write to us in the conversation or by email, and your email address if you use email. If you hire us: your name or company name, tax ID (RFC), tax address, and billing email, for the contract and invoices. We do not ask for sensitive personal data; please do not send any.

What you send through the form on our website is stored by Bossy with our other contact requests, together with a hashed form of your IP address that we use only to prevent abuse. If you use our website, the cookies and analytics described in our Cookie Policy also apply.

Purposes. Necessary to handle your request: replying to you; preparing and following up on the quote you asked for; and, if you hire us, preparing the contract, setting up your site, and invoicing you. We use your data for these with your tacit consent: if you send us your message after this notice was available to you, we understand that you agree (article 7 of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, "the Law"). Additional, requiring your consent: sending you news and offers about Bossy by WhatsApp or email. We will ask you in the conversation; if you don't say yes, we won't send them, and saying no does not affect your quote.

How to limit use or disclosure. Ask us at any time to stop writing to you (reply "BAJA" or write to privacy@bossyhq.com) and we will add your number or email to our internal do-not-contact list. You can also block our number in WhatsApp.

Who we share it with. We do not transfer your data to third parties, except when a law or a competent authority requires it (article 36 of the Law). To handle your request we use Meta (WhatsApp), which carries the conversation under its own terms; Microsoft for email; Resend, the service that delivers our email and keeps our contact list (if you use the quote form on our website, what you send reaches Resend in the internal email that alerts our team, and your name and email address are kept in our contact list there); and, if you hire us, the providers on our Subprocessors page. Bossy and its providers may process your data in the United States and other countries.

Your ARCO rights and how to use them. You can ask to access, rectify, or cancel your data, or object to its use, and you can revoke your consent. Write to privacy@bossyhq.com with: your name and an email or other way to answer you; a copy of an official ID (or, if a representative writes, proof of their authority and their ID); the data and the right concerned; for a correction, the change you want and a document that supports it; and anything else that helps us find your data (articles 28 and 30 of the Law). We answer within 20 business days of receiving your request and, if it is granted, carry it out within the following 15 business days; each period can be extended once by the same length when the case justifies it (article 31). It is free, except the cost of copies or shipping if you ask for them (article 34). Revoking consent does not undo processing already done. If you disagree with our answer, or we don't answer, you can file a data-protection request with the Secretaría Anticorrupción y Buen Gobierno within 15 business days of our answer (article 40).

Changes to this notice. We publish changes on this page with a new date. If we ever want to use your data for a new purpose, we will ask for your consent first (article 11).

Retention

We retain personal data for as long as an account is active and as needed to provide the service, then delete or anonymize it within a reasonable period unless a longer retention is required by law (for example, billing records). Customer content is retained according to the customer's configuration and is removed following account deletion — see Account Deletion & Data Requests.

Ordering-site data is kept for as long as the restaurant's contract and instructions provide, then returned to the restaurant and deleted.

Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights:

• Customers and marketing contacts can contact us at privacy@bossyhq.com.
• Employees should contact their employer (the controller); we will assist the employer as the processor.
• Diners on a restaurant's ordering site should contact the restaurant (the controller). If you write to us instead, we forward your request to the restaurant within two business days and help it respond.

People in Mexico who asked us for an ordering-site quote can exercise their ARCO rights as described in our privacy notice for quote requests.

You can opt out of marketing email at any time via the unsubscribe link or by contacting us. Opting out of marketing does not affect transactional messages necessary to operate your account.

Security

We protect data with tenant isolation enforced at the database layer, encryption in transit and at rest, two-factor authentication, and audit logging. Read more on our Security & Trust page.

International transfers

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.

Ordering-site data is stored on servers in the United States. A restaurant in Mexico that uses a Bossy ordering site sends that data to Bossy as its processor; under Mexican law this is a remisión, not a transfer.

Children

Bossy is a workplace product and is not directed to children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated date at the top of this page and, where appropriate, additional notice.

Contact

Questions or requests: privacy@bossyhq.com, or Bossy LLC, 2108 N St, Ste N, Sacramento, CA 95816.